Do we really need AntiVirus solutions in 2008?

Submitted by Kai on Thu, 2008-10-02 10:19.
I pose this question to you - my readers. In 2008, do we really need antivirus tools anymore?

Mass distributed virus' as we saw them back in the day of the Blaster and similar virus seems to be all off the screen today. Have the virus authors started to write smaller virus that stays below the radar - and thus are not detected by the AV-products? Are they now only targeting special targets - like particular banks, SCADA or singled out corporations? Or countries and causes? Or are they too busy writing malware to care about virus?

Do we really need to pay out on gateway and client AV solutions if there are no virus knocking on the door?

Do you believe that there are no more virus out there? That other threats are taking over and rendering AV-solutions useless?

Is this the whole truth? Or have the AV solutions became so good that they catch everything, even without us noticing?  That they are an absolute critical part of the solution for any entity connected to the net?

I would love your opinion! Please share your thoughts, and I will contribute mine as well ;)


Edit: Followup post: http://www.roer.com/node/417

Double post++

@Kurt: Thank you for commenting! I removed the second of your comments, as you said yourself - it was a double. I hope you do not mind. @Andy: Thanks :) And good to have you back too! Keep it up, buddy! @Larko: lol

sorry for the double post -

sorry for the double post - my browser stalled...

"Have the virus authors

"Have the virus authors started to write smaller virus that stays below the radar - and thus are not detected by the AV-products?" many of the virus authors of old have simply grown up and found more fulfilling things to do with their lives... "Are they now only targeting special targets - like particular banks, SCADA or singled out corporations? Or countries and causes? Or are they too busy writing malware to care about virus? " viruses are malware... non-viral malware, however, seems to be what the cyber-crooks prefer these days... self-replication has a way of getting out of hand and calling attention to the malware... "Do we really need to pay out on gateway and client AV solutions if there are no virus knocking on the door? " who says there isn't? just because you aren't hearing about new epidemics doesn't mean new viruses aren't getting written or even that the old ones have stopped... some of the most prevalent email-born malware are mass-mailing worms that are already a few years old (like netsky.p)... "Do you believe that there are no more virus out there?" absolutely not... some people are still getting infected by decades-old boot infectors... "That other threats are taking over and rendering AV-solutions useless?" other threats are just as detectable with av as viruses are... "Is this the whole truth? Or have the AV solutions became so good that they catch everything, even without us noticing? That they are an absolute critical part of the solution for any entity connected to the net?" let's put it this way - old viruses never die, their populations just shrink to a size too small to accurately report/track... av is one of the things that helps keep those populations small... and when it comes to newer non-viral malware, av is what helps keep it's usability limited... without the blacklist, the bad guys would just find something that successfully bypassed other defenses and keep using it over and over because other defenses cannot be updated as fast as a blacklist...

Kai, It's good to see you

Kai, It's good to see you blogging more. My take on this is that it is still needed. While it is not nearly as effective as it should be and the bad guys are getting under the radar of it there are still lots of older things floating around the internet that it catches. I'm afraid that w/o it we would be in much worse shape overall than we currently are.

Would you have sex with a

Would you have sex with a stranger without a condom if the media reported that you are less likely to catch AIDS than you used to?

Post new comment

The content of this field is kept private and will not be shown publicly.

Navigation

Recent comments

Recent blog posts


The blogger is Kai Roer, a European Information security professional.

View Kai Roer's profile on LinkedIn

Lijit

Resources

Archive

Explore Security Bloggers Network (a FeedBurner Network)