Choice of Anti Virus Tool vs Anti Malware Tool?

Question

We've had a breach in our network recently and we have been challenged over the the AV tool we are using. Because the malware/virus was cleaned (variant of Ransomware) by using an advanced anti malware tool.

Question 1: What are the factors to be considered in selecting appropriate tool (AV vs Anti Malware) or we need to have both the tools installed?

Or

Question 2: Is industry practicing different mechanism to protect their assets?

Note: We've researched on web but couldn't find conclusive answers. The following is one article but no conclusive answer.

https://lifehacker.com/the-difference-between-antivirus-and-anti-malware-and-1176942277

Answer 1

Anti-virus and Anti-malware are the same thing.

The term Anti-virus is from early in the industry where viruses where the bulk of malware affecting users systems and being written so for marketing reason anti-virus was name chosen. Since then the categories of malicious programs has expanded and will continue to as we move forward.

Virus / Worm / Trojan / Ransomware are different types of malware.

1. Selecting the tool - well this is going to be up to your team to gather requirements. Do you have a large fleet and a security team that handles these incidents? Well you're going to need a centralized pane of glass for reporting and taking action. How easy is to push out to your machines? Are you a small business? Well then maybe just a stand lone product on your machines is fine or using Windows Defender. Maybe take some sample malware you get run it through virus total and pick your AV product based off those results

2. Protecting assets - there is no single tool. Virus total shows a good example of AV products detecting some malware but not others. This doesn't mean go load up all the different AV products it just points no all cases are going to be covered.

Security is layers so look at AV + Host Firewall + Application white listing + Monitoring + Least privileged as an example

Answer 2

The virus is bounded with the limited characteristic of viruses and a form of malware which are self-replicating and runs automatically as computer programs to infect your files. Anti-virus software protects you in terms of viruses only.

Malware is described as "malicious code" and covers a wide area such as viruses, trojans, adware, spyware, worms and others. It is used to interrupt PC operation, collect your private data, or gain access to private computer systems. Anti-malware software provides full protection for all forms.

Simply speaking, malware is the umbrella term, i.e Anti-Malware is better in terms of protection versus just Anti-Virus.

Answer 3

Nowadays, Anti-Virus and Anti-Malware is the same thing. The difference between the various solutions available is the detection capabilities and how good the threat databases of their vendors are. In your case, the ransomware was probably encoded or packed in a way that the AV you had missed it, but another program didn't.

From a terminology aspect, a virus is a MALicious softWARE. Even better, virus is an older term for malware. The initial name was inspired by biological viruses, but the complexity of modern malwares had to introduce a broader term. Malware is any software intentionally designed to cause damage to a computer, server or computer network. Malware does the damage after it is implanted or introduced in some way into a target’s computer and can take the form of executable code, scripts, active content, and other software. A computer virus is a type of malicious software that, when executed, replicates itself by modifying other computer programs and inserting its own code. When this replication succeeds, the affected areas are then said to be "infected" with a computer virus.