6 ms·

I've seen orgs get through soc2 and pci-dss without kernel anti virus. It's all about compensating controls.

baq 2y ago
You should grab the folks who've done it and start authoring a book. You've got a 100x audience increase today!
bennyelv 2y ago
Alas in the world of B2B, contracts from larger companies nearly always come with lists of specific requirements for security controls that must be implemented, which nearly always include requiring anti-virus. It just not as simple as commenters on this thread wish!
- monocasa 2y ago
  The contracts are rarely specifying stuff like antivirus explicitly, but instead compliance with one or more of the security standards like PCI DSS. Those say you have to use antivirus, but they all have an escape hatch called a "compensating control" which is basically "we solved the problem this is trying to solve this other way that's more conducive to our overall security posture, and got the auditor to agree with us".
  - fragmede 2y ago
    compensating controls ftw. the spirit of the law vs the letter of the law. our system was more secure with the compensating controls, vs the prescribed design. this meant no having to rotate passwords because fuck that noise.
  - bennyelv 2y ago
    My source: I review a lot of contracts. It's very common for things to be explicitly required. Yes you can go back and forth and argue the toss, but it pushes up the cost of the sale and forces your customer to navigate a significant amount of bureaucracy to get a contract agreed. Or you could just run AV like they asked you to...
    - pas 2y ago
      Wait, I thought in this case we are the customer!? Okay what kind of contracts are we talking about? :D
  - aflukasz 2y ago
    Can you propose an example of a compensating control for an "antivirus" that had a chance to pass? Would you propose something like custom SELinux/Apparmor setup + maybe auditd with alerting? Or some Windows equivalent of those.
makeitdouble 2y ago
You should explain how they do it. If for instance they're remoting into a restricted VM all day, that's a different set of tradeoffs many might not be happy with.
- monocasa 2y ago
  Nothing like that, basically what sitharus said above you. Extra network level, zero trust to minimize lateral movement and giving the pen testers a leg up by letting them start already within the corporate network.
sitharus 2y ago
Same, I’ve been in an org that got PCI-DSS level 1 without antivirus beyond Windows Defender or any invasive systems to restrict application installation. It did involve a lot of documentation of inter-machine security controls, network access restriction and a penetration test by an offensive security company starting with a machine inside the network, but it can be done! Also in my opinion it gives you a more genuinely secure environment.

baq 2y ago

You should grab the folks who've done it and start authoring a book. You've got a 100x audience increase today!

Alas in the world of B2B, contracts from larger companies nearly always come with lists of specific requirements for security controls that must be implemented, which nearly always include requiring anti-virus. It just not as simple as commenters on this thread wish!

monocasa 2y ago
The contracts are rarely specifying stuff like antivirus explicitly, but instead compliance with one or more of the security standards like PCI DSS. Those say you have to use antivirus, but they all have an escape hatch called a "compensating control" which is basically "we solved the problem this is trying to solve this other way that's more conducive to our overall security posture, and got the auditor to agree with us".
- fragmede 2y ago
  compensating controls ftw. the spirit of the law vs the letter of the law. our system was more secure with the compensating controls, vs the prescribed design. this meant no having to rotate passwords because fuck that noise.
- bennyelv 2y ago
  My source: I review a lot of contracts. It's very common for things to be explicitly required. Yes you can go back and forth and argue the toss, but it pushes up the cost of the sale and forces your customer to navigate a significant amount of bureaucracy to get a contract agreed. Or you could just run AV like they asked you to...
  - pas 2y ago
    Wait, I thought in this case we are the customer!? Okay what kind of contracts are we talking about? :D
- aflukasz 2y ago
  Can you propose an example of a compensating control for an "antivirus" that had a chance to pass? Would you propose something like custom SELinux/Apparmor setup + maybe auditd with alerting? Or some Windows equivalent of those.

makeitdouble 2y ago

You should explain how they do it. If for instance they're remoting into a restricted VM all day, that's a different set of tradeoffs many might not be happy with.

monocasa 2y ago
Nothing like that, basically what sitharus said above you. Extra network level, zero trust to minimize lateral movement and giving the pen testers a leg up by letting them start already within the corporate network.

sitharus 2y ago

Same, I’ve been in an org that got PCI-DSS level 1 without antivirus beyond Windows Defender or any invasive systems to restrict application installation. It did involve a lot of documentation of inter-machine security controls, network access restriction and a penetration test by an offensive security company starting with a machine inside the network, but it can be done! Also in my opinion it gives you a more genuinely secure environment.