Quote Originally Posted by nihil View Post
Well, I don't think that there are many organisations of any size that don't run an AV product, and I don't think that there are that many admins who think that they do much good. They are a CYA insurance policy, or as TH puts it: they let you check a box on a security questionnaire.

True security comes from policies and their enforcement by whatever means.

User education is a good start, but unfortunately is something of a Holy Grail in many cases.

TH mentions 18% which I am guessing includes all forms of attack? I do recall posting on here quite a while back about a UK security outfit who hired coders to write around 3500 new and obfuscated malwares. These were items that you would reasonably expect an AV to detect.

They then tested against 10 of the most common AVs and I don't think that any got more than 50% and most were under 30%.

Traditional AV is hindered in that it is reactive and retrospective, and looks for the malicious code of traditional malware. These days malware isn't so much what it is, but what it does. These are the days of cybercriminals, the days of lulz are pretty much over.
User education doesn't work. In fact, the higher up in the organizational chart that the person resides, the greater frequency of problems you will have. I've seen this first hand. The standing argument is that it only takes one successful attack for the entire notion of user education to go down the toilet.

AV is simply a dated checkbox that poorly written legislation requires. It is the sole reason it remains in my environments.

The statistic comes from all types of attacks, including trojans and root kits, which strangely get omitted from the stats produced by AV vendors. That's a pretty nasty trick if you ask me. I setup my own testing and it lines up perfectly with professionals around the globe who took part in this unpublished study. We knew better than to release the results because corporations are not interested in the truth, they're interested in profit. We shared the knowledge with select security pros around the globe. Those who need to know were provided with the results.