Paper: Hype heuristics, signatures and the death of AV (again)

Posted by   Virus Bulletin on   Aug 7, 2015

David Harley responds to anti-malware's many criticasters.

Anti-virus is dead. After all, in the current threat landscape, who would use a system that relies on signatures of previously seen malware?

At least, that's what many security experts claim. ESET Senior Research Fellow David Harley has a long history in the security industry — so long that he might even remember the days when anti-virus was indeed purely signature-based — and he has heard it all before.

In an opinion piece published by VB today, David responds to many of the criticisms of the anti-virus industry (or, as it has long been called, the anti-malware industry), pointing out that the assumptions the critics make about how anti-malware products work and what they aim to do, tend to be wrong. He also urges marketers, both inside and outside the anti-malware industry, to make it clear to users that they shouldn't rely solely on anti-malware solutions to protect them against infection.

You can read David's piece here in HTML format or download it here as a PDF.

Posted on 07 August 2015 by Martijn Grooten



Latest posts:

NCSC gives important advice on lateral movement

The UK's National Cyber Security Centre (NCSC) has provided helpful and practical advice on preventing and detecting lateral movement by an attacker within a network.

What kind of people attend Virus Bulletin conferences?

If you are considering submitting a proposal for a talk to VB2018 and you're not familiar with the event, you may find it useful to know what kind of people attend the conference.

Olympic Games target of malware, again

An unattributed malware attack has disrupted some computer systems of the 2018 Winter Olympics. In 1994, a computer virus also targeted the Winter Olympics.

There are lessons to be learned from government websites serving cryptocurrency miners

Thousands of websites, including many sites of government organisations in the UK, the US and Sweden, were recently found to have been serving a cryptocurrency miner. More interesting than the incident itself, though, are the lessons that can be…

We need to continue the debate on the ethics and perils of publishing security research

An article by security researcher Collin Anderson reopens the debate on whether publishing threat analyses is always in the public interest.