Don't count on antivirus software alone to keep your data safe

Who's the Audience here?

Whilst the content may acceptable, I'm just wondering why this article appears in a "news site"? It's not exactly earth shattering revelations, it's verbatim Information Security 101.

What next? "turning your PC off at night saves energy"

Also whilst I agree that nothing is 100% secure and it should be difficult for an attacker, you've missed an important point, it must be remain useful to the business.

I can take a laptop, shut it down, put it in a safe and destroy the key. The laptop is now, as near as possible, 100% secure from cyber threats. Unfortunately in the process its now lost all value to the business.

Yet not a word ..

.. about HIDS/NIDS and APT detection.

You need to keep an eye on your network traffic and server integrity. We have a number of internal hosts that run fake services (basically following the principle of a honeypot or its predecessor, Fred Cohen's Deception Toolkit) that should never be touched by anything but a security scan - those are primary alarm signals to check what is going on. Also check for protocols you normally have no use for.

Next up is the whole issue of Advanced Persistent Threats, which is really the "here and now" of the bigger hacks. These things were going on for months before they delivered results, yet were never spotted. I have not yet seen a decent, integrated solution for APT but I'd welcome one..

Email whitelists

Some of the dodgy emails that get past the Demon and Norton filters for my domain are apparently from known persons or businesses. It often takes a visual inspection of the raw headers to decide that the origin is suspect.

Don't think I've seen many almost convincing payloads that were also from the genuine source.

Not just dodgy websites

It's not really the websites, it's the large heaps of third/fourth/etc party gubbins that appears on every flipping site (reg not as insane as many) that you just have to trust that someone somewhere has at least glanced at to ensure that their random ad-plonking and/or social-network button array hasn't had something extra included without them noticing.

That's a lot of people and systems effectively trusted by proxy which is never a good thing - having to disable scripts gets tedious and is a bit of a kludge for a problem that should not exist.

And on rare occasions the thing that killed your browser is actual malware.

Zero day exploits do not bypass antivirus protection, no do they have anything to do with AV software as the article suggests. A 0day might be used as the initial step to get the malware on the machine but they are entirely different things.

Crypting your malware to avoid signature based detection, splitting and scattering the malware across many memory locations, unusual hooks to existing processes and also tricks to make individual AV's think they have crashed or timedout are just a few of the things that are done to bypass AV's.

'Legitimate work sites' should not be considered malware free. AD server farms sites that serve many top web sites are often compromised to serve malware and some even slip through the front door in that way. Both Google and Microsoft have had their ad servers serving up malware.

Take a layered approach to security and make sure to include network traffic analysis.

"These are solid, reliable tools"

Yeah, especially when they utterly fail to stop a new version of a virus, or when they mistake a Windows system file for a virus, quarantine it and crash the system, or when they grab 99% of CPU for minutes on end and keep you from doing your job without rhyme or reason.

The only thing that is reliable with AV software is the fact that your PC now belongs to it, not to you.

Unfortunately, as imperfect and annoying as they are, we do indeed need them. Therefor the only thing we can do is find the anti-virus that will be as efficient as possible while bothering us the least.

A real treasure hunt, and the treasure is our security.

TJX hacking mastermind Albert Gonzalez scoffed at antivirus tools. He and his cohorts wrote malware specifically designed to evade their detection.

Ooh, scary. Would malware inadvertently designed to evade detection be scarier? I can't decide.

One can imagine him laughing as his team of hackers broke into corporate networks using SQL injection attacks and gained administrative access.

One can, though one hardly wishes to. And what this has to do with antivirus tools I cannot guess.

Then he probably guffawed, Bond villain-style,

I think this is somewhat less than probable. Yes, the blackhats tend to have poor social skills, but guffawing at your own exploits is taking megalomania a bit far. (And do Bond villains guffaw? I can't recall any doing so. Perhaps a bit of chortling.)

as he uploaded the malware directly into server memory,

Easier than uploading it directly to disk...

and when the corporate networks began happily delivering customer credit card data directly to his servers chuckled all the way to the bank.

Chuckling now? The man runs the gamut of mirthful expression. That bastard!

And, again, the relevance of all this to antivirus software is a bit distant. I know, there's some vague point about Mr Scary Person employing attacks for which AV is not a defense. Surely this could have been expressed with less speculation about his maniacal outbursts?

Other topics relevant to business security

- Management buy-in

Without that all you have is a collection of good intentions