Lets talk about the truth – Anti-Virus is Broken
Every year Anti-Virus companies take part in evaluations, they do this primarily so that when their results have been certified they can brag about it in their sales and marketing.
In 2022, MITRE who are a renowned and respected organisation that are best known for a framework on which the cybersecurity industry relies for defence and prevention of malware attacks of malware attacks presented their results. (See image).
To be clear, MITRE focused on two known pieces of malware; “Wizard Spider” and Sandworm”. The results appear in the table to the right.
The columns show the Anti-Virus (AV) company in the first column, a yes or no status to say if the AV had a version for the Linux operating system in the 2nd column, the 3rd shows the percentage score for prevention of an attack and the 4th shows the detection percentage.
You will notice that although the detection percentages are often pretty high, the prevention percentages are spectacularly mediocre in most cases and are downright failures in other cases.
If you can’t see the image clearly, you can open the image in a new tab by right clicking the image and selecting open in a new tab.
Would you get on a plane if the engines only worked 40% of the time?
I’m guessing that the answer to that question would be no. So why do home and business users accept that their anti-virus will only prevent a cyber attack 40% of the time (in some cases)?
Sure, even 40% is better than 0%, but did you know that was the case before you read this?
How has the industry managed to get away with these diabolical results for so long and why do they think it is OK to market the detection part of the results without telling us about the prevention results?
Marketing departments, that’s how!
Truth or Dare
Marketing departments take the good and forget the bad so that products sell, but when the bad is critical there has to be a moral responsibility, surely?
OK, you are not going to die if you get a virus on your computer, but you have paid for a product that claims to provide protection from viruses and in truth, it really doesn’t.
One thing that is really frustrating is that if you had a paid for AV and ended up with ransomware due to a virus, and you tried to get a refund, you wouldn’t get one because of the small print.
The major problem lies in the amount of new malware out there that can’t be detected by your AV.
Zero-Day
Zero-Day malware is essentially malware that hasn’t been seen before. As a result of being new malware, it doesn’t appear in the dictionaries that the AV uses to detect malware.
As a result, you are vulnerable to those new threats. Again, the AV industry shrugs its shoulders and says but we can’t do anything about that – wrong!
Zero Trust
Zero Trust is a methodology that can be used to protect your computer system(s) from the bad guys and their malware attacks.
At the file protection level, Zero Trust says unless we know you are a good file, you can’t execute your code – that turns the traditional AV methodology on its head!
Instead of a list of known bad malware, Zero Trust uses a list of known good software backed up by known good certificates.
Together with traditional good practices, Zero-Trust provides a much higher level of protection. For our contract clients we have provided the backing of a Security Operating Centre.
Conclusion
The AV industry in particular is broken, but not much more than the rest of the industry. It is time for the truth obvious in the marketing materials. It shouldn’t be down to the customer to discover the truth about cyber protection.
Sure, buyer beware and all that, but more emphasis needs to be put on the vendors moral stance, morally the AV industry should not be allowed to get away with making statements like “Number one virus detection rating” when the amount of protection is 40% or less.
As Richard Hollis from Risk Crew said, if your car only turned left 40% of the time you would expect a refund from the car company.
Anti-Virus
cybersecurity
itsupport
malware
zerotrust
