On Anti-X

Anti-malware software has become a mainstay of PC operation. If you don’t run Anti-x software then you are considered an irresponsible administrator or vulnerable user. This is because there has been billions of dollars pushed in to marketing and lukewarm security training in an attempt to secure the masses. I am all for security for the masses but there is an issue. The marketing and training may not provide the masses with an understanding of real vulnerabilities because it does not matter if they understand; only that they act and that action must be equally lukewarm in the form of automated processes if they, the masses, are ever expected perform. I do agree this is the best solution available, at present, and that there are real threats but it is not enough and I am not even going to start on marketing that uses fear as a tool to motivate people in to action. Thus there are two issues (1) current methods of protection are inadequate for current threats and (2) users are not being educated adequately. I do understand that it is not the end users job or purpose in life to function securely but that is the only answer if the masses are ever to be secure. All the automation in the world will not protect a system because automation fails.
To put this in to proper context I recall a conversation I had about a year and half ago with some vendors over lunch. My assistant, their sales guy and chief hardware designer were present and somehow, toward the end of our meal, the topic of conversation moved from business to pure security. The hardware designer also worked with the system administrators on their network. He and I were talking about different administrative practices when he said “I don’t run antivirus software on our network.” My reply, in a British accent, was “You have gown right out your tree my son!” He began to defend his position with technical details of how anti-x was broken and never worked in the first place. I agreed with his postulate but felt it was a frail argument for not running anti-x in the enterprise. I, then, presented my argument that the technical limitations were moot due to the credibility gained from end users by participating in this well known security practice. I explained that there have been billions of dollars in marketing and countless media reports that have engrained in the users mind that anti-x makes you secure and by performing well know security practices you are buying peace-of-mind. The users have to trust the system or it will not be used. I posed this as trade off of the administrative overhead of anti-x software being equal to its provided protection and peace-of-mind. His solution was to continually take baselines of the system and when something malicious occurred they would revert to the last known good copy.
Baseline-Reimage practice is now becoming a formalized process due to the advent of root kits and undetectable super evil malware. The formalization has occurred not because anti-x is broken but because it is inadequate for advanced threats. However, anti-x is still required and useful to defend against low hanging threats and to provide piece-of-mind to the users. A scary state will be when the hyperbola changes from “You must run anti-x!” to “Have you reimaged your computer today?”