Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cisco CSO Says Antivirus Money "Completely Wasted"

Posted by timothy on from the what-about-the-rape-industry-and-the-pillage-industry dept.

mernil writes with an excerpt that kicks off a story at ZDNet Australia: "Companies are wasting money on security processes — such as applying patches and using antivirus software — which just don't work, according to Cisco's chief security officer John Stewart. Speaking at the AusCERT 2008 conference in the Gold Coast yesterday, Stewart said the malware industry is moving faster than the security industry, making it impossible for users to remain secure."

20 of 503 comments (clear)

  1. Agreed by pak9rabid · · Score: 5, Insightful

    Why pay for it, when there are plenty of free alternatives?

    1. Re:Agreed by Eg0Death · · Score: 4, Insightful

      Do you know of any free alternatives that can be administered at the network/Domain level?

      --
      Why is this thus? What is the reason for this thusness?
    2. Re:Agreed by morgan_greywolf · · Score: 5, Insightful

      Why pay for it, when there are plenty of free alternatives?
      No, he's saying the free alternatives are wasted effort as well.
      --
      My blog
    3. Re:Agreed by m.ducharme · · Score: 4, Insightful

      Only if your time is worth nothing to you. :-p

      --
      Rule of Slashdot #0: You and people like you are not representative of the larger population. - A.C.
    4. Re:Agreed by Beardo+the+Bearded · · Score: 5, Insightful

      Don't you get it?

      The bad guys have access to all the same tools you have. They can get their hands on ClamWin, Avast, AVG, etc. They have full access to Windows in any flavour, every variety of Mac OS, and the rainbow of Linux. These aren't script kiddies farting around in their parents' basement. The "bad guys" are groups of organized professionals that know more about your computer than you do.

      THE MALWARE DOES NOT GET DETECTED BY ANTIVIRUS SOFTWARE BECAUSE THE WRITERS TEST IT USING THE SAME TOOLS WE USE!

      To completely harden your system against an intrusion, you have to patch every single hole and then guarantee that there are no more holes. Further, every program that you install on your computer has to be guaranteed to have no holes. Finally, all your hardware (AND its firmware, I'm looking at YOU, 2-wire!) has to pass the same test - NO HOLES! Ask MS how happy they were with the folks who made GoldenEye.

      To hack into a system, you merely have to find ONE hole. That's it. You're banking the health of your computer on the hopes that not one single person has put in an exploitable bug. Nobody on sourceforge made an error. None of the "featured articles" on TDWTF are in your code. None of the lowest bidders from Elbonia pasted together snippets from codesamples.com. All your pointers are bound, all the copying templates are limited (K&R, I'm calling YOU out on this!), and your multi-threaded application is coded properly. Did someone stay up until midnight to meet an arbitrary deadline? Is your program "good enough for who it's for"?

      And you, just now, said, "I want to spend as little as possible on my security systems". Now, I fully agree that the free alternatives are significantly better than the ones that come bundled with your HP-branded Staples Windows Vista Ultimate Ice-Cream PC (Printer Included with Bundle). But the attitude is, "I'll slap on a few quick and easily downloadable programs and call my system secure." The bad guys get these programs too, and they probably know them as well, or better than, the authours.

      One error, anywhere, and your security becomes "by obscurity". That's really what I use at work and at home. I don't have anything valuable on my computer, and I am not a worthwhile target for phishing, exploiting, hacking, etc.

      Any system is exploitable. One error. That's all it takes.

      --

      ---
      ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
    5. Re:Agreed by Z00L00K · · Score: 5, Insightful
      It exists malware for both Apple and Linux too, but not in the same volume as for Microsoft's OS:es.

      And it's not completely useless to have anti-virus software on your machine, but the problem is that they are always a bit behind so there are always a few that takes a hit before the propagation is halted by updated AV software.

      Unfortunately there have been too many mistakes made throughout history with the intent of making it easy for users to work with a computer. This way of relaxed behavior is kicking back because it also makes it easy to create malware.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    6. Re:Agreed by Z00L00K · · Score: 4, Insightful
      If you are a malware writer you only have a few days for your application to kick in or the AV companies will keep up. So it's not completely futile to run AV software but you will get some that aren't caught. The difference is that if no AV software was employed we could have a computer pandemic.

      So even if AV software isn't the best solution but merely a patch it at least protect us somewhat.

      But what's needed is a completely different design of the operating systems we have. SELinux is far too weak in reality - even if it is a good step forward it is very static in it's behavior. It is also necessary to have more dynamically adapting operating systems that can see overall patterns and be able to lock down certain processes if they start to behave in an unexpected way.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    7. Re:Agreed by stonecypher · · Score: 4, Insightful

      When I was your age, this joke was still funny.

      --
      StoneCypher is Full of BS
  2. Stating the obvious.. by somersault · · Score: 5, Insightful

    Companies are wasting money on Windows ;)

    Patching software does work though, I don't see the alternative if you have an exploitable bug in your code? You want that code fixed. It doesn't matter if no damage can be done to your system, you still want all your applications running as expected.

    --
    which is totally what she said
    1. Re:Stating the obvious.. by thermian · · Score: 5, Insightful

      The problem is Windows

      Don't be naive. The problem is simply worse for Windows because windows is the most heavily used OS.

      This idea that Linux is immune from viruses is just stupid. It's not the primary target of most malware, but it is a target. A poorly configured Linux server is pure gold to a spammer.

      Thinking that you are safe just because you use Linux is, well, dumb.

      And as for Apples various OS products? Well they have only a tiny market share. There isn't going to be the same return on investment of time and effort to attack that as much as windows is attacked.

      --
      A learning experience is one of those things that say, 'You know that thing you just did? Don't do that.' - D. Adams
    2. Re:Stating the obvious.. by jedidiah · · Score: 4, Insightful

      Not quite.

      The fact remains that the OS vendor here is in the habit of finding new
      ways to do boneheaded things with software. You could even say that you
      are far less likely to have Windows malware problems if you avoid as
      much Microsoft product as possible while running Windows.

      This is not unlike how earlier versions of Windows were much more crash
      prone if you use MS apps as well.

      This brings up an interesting problem of using Microsoft software on
      other operating systems. That's bound to create problems that would
      not exist on a platform otherwise.

      Yes, sometimes a particular manufacturer (like McDonalds or GM) just makes crap.

      --
      A Pirate and a Puritan look the same on a balance sheet.
  3. Problem of assessing success... by johndiii · · Score: 5, Insightful
    If your security works, nothing happens. So it's easy to say that money is "wasted". If the security doesn't work, the problem is a little more obvious.

    I read this story yesterday, and the quote is a little misleading. Here's the context:

    "If patching and antivirus is where I spend my money, and I'm still getting infected and I still have to clean up computers and I still need to reload them and still have to recover the user's data and I still have to reinstall it, the entire cost equation of that is a waste."

    "It's completely wasted money," Stewart told delegates. Exactly. If it does not work, the money spent on it is wasted. Not exactly controversial.
    --
    Floating face-down in a river of regret...and thoughts of you...
    1. Re:Problem of assessing success... by Tony+Hoyle · · Score: 5, Insightful

      AV is like putting more and more buckets in the attic to catch leaks, rather than fixing the holes.

      If your roof isn't leaking all those buckets are wasted money.

      If they're norton buckets they're also (a) glued to the floor so you can't use them anyway, and (b) full of holes themselves.

  4. Riiight. by SatanicPuppy · · Score: 4, Insightful

    But all the money spent on Cisco's obscenely overpriced security appliances is well spent, right?

    There are a lot of people profiteering in the computer security market, and Cisco is up there.

    --
    ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
  5. They want to go to whitelisting by tepples · · Score: 4, Insightful
    From the article:

    A better way of dealing with the unknown is to use whitelists -- where only authorised or approved software can execute, said Stewart.

    "I'm sick of blacklisted stuff. I've got to go for whitelisted stuff -- I know what that is because I put it there," he said.

    This might work for a corporate environment. But how will PC users in home environments know what to put on a whitelist and what not to put on a whitelist?
  6. Not completely wasted... by Coopjust · · Score: 4, Insightful

    The A/V industry is having difficulty keeping up with the ever evolving and growing malware industry, but "completely wasted"? I don't think so.

    For Geeks who delete suspicious emails, use Thunderbird (so emails are not rendered in the IE engine), etc., sure, an AV may be a useless waste of CPU cycles. But for the nontechnical user, it's important. While it's difficult to keep up with outbreaks, it's important for older viruses in the wild- something Grandma may not catch.

    Now, as for a whitelist. Dumb idea. It puts too much power in the hands of AV companies (who can say "$$$ to get on the list!" or if users can change it, they'll get "IMPORTANT WINDOWS UPDATE- REMEMBER TO ADD TO YOUR WHITELIST!". What about unsigned programs? Updated versions?

    A whitelist might work for children, for work PCs, for other non-administrators. But people ultimately want to install their own programs without the blessing of company XYZ.

    And, as a geek, I strongly disagree that it's impossible to remain secure, it just takes a little training. I know nontechnical users, I teach them for 10 minutes, and they have good habits. Don't open emails saying "A greeting card from a classmate", don't run unsolicited programs, if you get an email saying it's from chase.com "Important Account Update" visit their directly, etc.). Those habits go a long way, along with some layered protection (ZoneAlarm Free, Router w/ a firewall, Avast Home, Immunize in SpywareBlaster, and Immunize in Spybot S&D). That user still has some trouble with some tasks, but with a little common sense and some good protection, they've stayed infection free for 4 years.

    (And, of course, I fix the computer as a friend, and I occasionally run rootkit detection and AV from a LiveCD just to make sure).

  7. clam by Lord+Ender · · Score: 5, Insightful

    Cisco is integrating ClamAV in to their "Cisco Security Agent" HIDS product. They clearly think AV is useful, just not other peoples' AV.

    --
    A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
  8. Re:Agreed -Free For Personal Use by pak9rabid · · Score: 5, Insightful

    Whos says the alternatives have to be anti-virus applications? ;)

  9. Antivirus as virus by pubjames · · Score: 4, Insightful

    I'm sure it's a common experience to Slashdotters to have a friend/relative show them their PC that they think it has a virus because it runs so slowly, when of course the reason it is running so slowly is all the anti-virus crap installed on it.

  10. Some things can't be fixed with software by jon3k · · Score: 4, Insightful

    The problem is the users. No matter how secure you make an operating system users will still click on every link and give people their passwords.