{"id":1384,"date":"2015-10-26T09:00:42","date_gmt":"2015-10-26T09:00:42","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=1384"},"modified":"2015-10-25T01:29:38","modified_gmt":"2015-10-25T01:29:38","slug":"av-is-not-dead-it-just-has-limits","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/","title":{"rendered":"AV is not dead – it just has limits"},"content":{"rendered":"

Antivirus (AV) has been around for decades now and this is both a good and bad thing. On one hand, AV is so well known most people already understand that they need to have it. But on the other, all the attackers know about it. This means the first step in pretty much every attack is “bypass AV.”<\/p>\n

\"AV
AV is not dead, just understand what it can and cant do.<\/figcaption><\/figure>\n

The reality is, bypassing AV is actually not that hard. Partly this is because there is a tendency for antivirus software to use “signature” based detection. Here, all an attacker needs to do is make an insignificant change and the signatures can be totally different.<\/p>\n

Even the better AV products, which uses things like heuristics can be bypassed with freely available tools. \u00a0An example is the\u00a0Shikata ga nai<\/em> framework designed to leave AV helpless.<\/p>\n

The availability of these tools is now so widespread that lots of security professionals are confidently making statements like “AV is dead<\/a>” or posts titled “Why antivirus protection is a joke<\/a>.” You can even watch an excellent YouTube video<\/a> on how to bypass antivirus.<\/p>\n

Basically, everything these people are saying is correct. Attackers can and will bypass antivirus. Often they will do it with very little effort.<\/p>\n

Despite what the vendor may tell you, you can have a top end, fully updated AV product and still<\/strong> get hacked. A lot.<\/p>\n

But this is missing the point. It doesn’t mean that the product is useless or that we should all give it up and live in an AV-free world. It just means that, like every security product, it has its place. Remember, there is no holy grail<\/strong>, silver bullet<\/strong>, product<\/strong> that can do everything and protect you from every cyber threat.<\/p>\n

The important thing to remember is if you DONT<\/em> have antivirus, even the lazy attackers who cant be bothered to bypass it will get in to your system.<\/p>\n

Bringing AV\u00a0Back to Life<\/h2>\n

So, we’ve established that the reports of antivirus being dead are premature, but what do we do about it?<\/p>\n

Remember, security is all about defence in depth. You need to be adding so many layers of controls that the attacker runs out of steam long before they hit your important assets. Within this model, AV has a crucial part to play.<\/p>\n

With this in mind, here are our handy hints on how to keep AV alive in your organisation and make sure it is providing the value you expect.<\/p>\n

    \n
  • Review your security model. AV has a part to play but it is only a part. Make sure you have other controls.<\/li>\n
  • Fund AV properly. Dont blow your budget on an incremental improvement to AV but also dont scrimp and get some freeware version which you cant manage.<\/li>\n
  • Implement good security practices. Whatever else you do, you need to consider the top three security controls: Application Whitelisting; Patching;\u00a0Privilege Management<\/em>. With these in place, your AV works much better. Without them, you will still get hacked. A lot.<\/li>\n
  • Use your antivirus. We’ve lost count of the number of incidents we are called to support which have an origin in a machine where AV has been disabled or not updated in months. This is poor practice.<\/li>\n<\/ul>\n

    The key point here is that AV needs to be part of your security controls. It should never be the only control you have but that isn’t enough of a reason to not have it. While it is possible for reasonably low skilled attackers to circumvent your antivirus controls, you would be amazed at how much it will still stop.<\/p>\n

    If you implement the three security good practices mentioned above, and run an up-to-date AV tool, 90% (or more) of attacks will fail.<\/p>\n

    Don’t give up on AV simply because it cant work on its own.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Antivirus (AV) has been around for decades now and this is both a good and bad thing. On one hand, AV is so well known most people already understand that they need to have it. But on the other, all the attackers know about it. This means the first step in pretty much every attack […]<\/p>\n","protected":false},"author":1,"featured_media":1386,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[5],"tags":[145,11,6,140],"class_list":["post-1384","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-anti-virus","tag-hacking","tag-infosec","tag-security","entry","has-media"],"jetpack_publicize_connections":[],"yoast_head":"\nAV is not dead - it just has limits so dont expect miracles.<\/title>\n<meta name=\"description\" content=\"AV is not dead, whatever the internet may claim. You just need to remember it isn't a silver bullet and it does have limitations.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AV is not dead - it just has limits so dont expect miracles.\" \/>\n<meta property=\"og:description\" content=\"AV is not dead, whatever the internet may claim. You just need to remember it isn't a silver bullet and it does have limitations.\" \/>\n<meta property=\"og:url\" content=\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/\" \/>\n<meta property=\"og:site_name\" content=\"Halkyn Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2015-10-26T09:00:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2015-10-25T01:29:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2015\/10\/protect-152531_1280.png?fit=1024%2C1280&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"1280\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Halkyn Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:site\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Halkyn Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/#article\",\"isPartOf\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/\"},\"author\":{\"name\":\"Halkyn Security\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2\"},\"headline\":\"AV is not dead – it just has limits\",\"datePublished\":\"2015-10-26T09:00:42+00:00\",\"dateModified\":\"2015-10-25T01:29:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/\"},\"wordCount\":658,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\"},\"keywords\":[\"Anti Virus\",\"Hacking\",\"Information Security\",\"Security\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/\",\"name\":\"AV is not dead - it just has limits so dont expect miracles.\",\"isPartOf\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#website\"},\"datePublished\":\"2015-10-26T09:00:42+00:00\",\"dateModified\":\"2015-10-25T01:29:38+00:00\",\"description\":\"AV is not dead, whatever the internet may claim. You just need to remember it isn't a silver bullet and it does have limitations.\",\"breadcrumb\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Halkyn Security\",\"item\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"http:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"AV is not dead – it just has limits\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#website\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\",\"name\":\"Halkyn Security Blog\",\"description\":\"Specialist Security & Risk Management Consultants\",\"publisher\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\",\"name\":\"Halkyn Consulting\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1\",\"width\":\"990\",\"height\":\"170\",\"caption\":\"Halkyn Consulting\"},\"image\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/2329571\",\"https:\/\/twitter.com\/HalkynSecurity\"]},{\"@type\":\"Person\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2\",\"name\":\"Halkyn Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g\",\"caption\":\"Halkyn Security\"},\"description\":\"Halkyn Security Consultants.\",\"sameAs\":[\"http:\/\/www.halkynconsulting.co.uk\/\"],\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/author\/halkyn-consulting\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AV is not dead - it just has limits so dont expect miracles.","description":"AV is not dead, whatever the internet may claim. You just need to remember it isn't a silver bullet and it does have limitations.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/","og_locale":"en_GB","og_type":"article","og_title":"AV is not dead - it just has limits so dont expect miracles.","og_description":"AV is not dead, whatever the internet may claim. You just need to remember it isn't a silver bullet and it does have limitations.","og_url":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/","og_site_name":"Halkyn Security Blog","article_published_time":"2015-10-26T09:00:42+00:00","article_modified_time":"2015-10-25T01:29:38+00:00","og_image":[{"width":1024,"height":1280,"url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2015\/10\/protect-152531_1280.png?fit=1024%2C1280&ssl=1","type":"image\/png"}],"author":"Halkyn Security","twitter_card":"summary_large_image","twitter_creator":"@HalkynSecurity","twitter_site":"@HalkynSecurity","twitter_misc":{"Written by":"Halkyn Security","Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/#article","isPartOf":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/"},"author":{"name":"Halkyn Security","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2"},"headline":"AV is not dead – it just has limits","datePublished":"2015-10-26T09:00:42+00:00","dateModified":"2015-10-25T01:29:38+00:00","mainEntityOfPage":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/"},"wordCount":658,"commentCount":0,"publisher":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"keywords":["Anti Virus","Hacking","Information Security","Security"],"articleSection":["Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/#respond"]}]},{"@type":"WebPage","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/","url":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/","name":"AV is not dead - it just has limits so dont expect miracles.","isPartOf":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#website"},"datePublished":"2015-10-26T09:00:42+00:00","dateModified":"2015-10-25T01:29:38+00:00","description":"AV is not dead, whatever the internet may claim. You just need to remember it isn't a silver bullet and it does have limitations.","breadcrumb":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2015\/10\/av-is-not-dead-it-just-has-limits\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Halkyn Security","item":"http:\/\/www.halkynconsulting.co.uk\/a\/"},{"@type":"ListItem","position":2,"name":"Security","item":"http:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/"},{"@type":"ListItem","position":3,"name":"AV is not dead – it just has limits"}]},{"@type":"WebSite","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#website","url":"http:\/\/www.halkynconsulting.co.uk\/a\/","name":"Halkyn Security Blog","description":"Specialist Security & Risk Management Consultants","publisher":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization","name":"Halkyn Consulting","url":"http:\/\/www.halkynconsulting.co.uk\/a\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","width":"990","height":"170","caption":"Halkyn Consulting"},"image":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/2329571","https:\/\/twitter.com\/HalkynSecurity"]},{"@type":"Person","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2","name":"Halkyn Security","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g","caption":"Halkyn Security"},"description":"Halkyn Security Consultants.","sameAs":["http:\/\/www.halkynconsulting.co.uk\/"],"url":"http:\/\/www.halkynconsulting.co.uk\/a\/author\/halkyn-consulting\/"}]}},"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2015\/10\/protect-152531_1280.png?fit=1024%2C1280&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9yHvD-mk","jetpack_likes_enabled":true,"_links":{"self":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/comments?post=1384"}],"version-history":[{"count":9,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1384\/revisions"}],"predecessor-version":[{"id":1387,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1384\/revisions\/1387"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media\/1386"}],"wp:attachment":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media?parent=1384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/categories?post=1384"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/tags?post=1384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}