1

Assuming one is a worried home user who keeps certain sensitive files, works on personal projects, and generally wants to ensure the integrity of their single system (to keep it simple), what's a user to do? Signature based AV software is being spoken of as quickly becoming obsolete, where does this leave the average, or even power home-user?

5
  • @techraf I think OP is concerened that the very concept of singature based AV is becomming obsolete, not that his particular definitions are getting old. So automatic updates is not the solution.
    – Anders
    Mar 18, 2016 at 8:41
  • @techraf, Anders has hit the question bang on. I say "quickly" mainly due to my limited knowledge of the AV field, and I do not want to make blanket statements, per se.
    – Hammy
    Mar 18, 2016 at 19:50
  • Use a firewall. Most viruses are moot if they cannot communicate with its command host.
    – suhdo
    Apr 1, 2016 at 4:29
  • @Empathy : What if it uses standard HTTP just like my web-browser? What if it is a malicious add-on or plugin in my browser? Apr 4, 2016 at 22:24
  • @Matthew1471 the application would need to granted outbound access, just like the browser. Good point on the browser plugins, as this is nowadays the most common method of infection. Chrome seems to be a very secure browser however.
    – suhdo
    Apr 4, 2016 at 22:40

2 Answers 2

0

A lot of AV software has switched to also include heuristic based detection. While a particular piece of malware might not be known to the AV company or match their signatures, the fact it opens up a socket to a mail server, sends lots of traffic, registers on start-up of my computer and is a hidden program with no window might for example be flagged as "suspicious" and cause an alert.

See Heuristic analysis.

My favourite impartial AV testing site AV-Comparatives perform a number of tests against products, one of which is to use out of date virus definition files and then give them viruses that are now known and see whether the AV product would have heuristically decided it was a virus without any prior knowledge of it (AV-Comparatives Retrospective Test).

2
  • Interesting website. Are they still functional? I ask because there seem to be gaps in the data. Nonetheless, it's great to see this sort of analysis being done. Thank you.
    – Hammy
    Mar 30, 2016 at 2:12
  • Hi Hammy, Glad you like it, I'm constantly surprised how niche that site appears to be online too. They appear to have done a recent "Real-world" test : av-comparatives.org/dynamic-tests so certainly still seem around but maybe there's less demand to test the specific individual detection components of AV, so they're focusing more on what users ultimately ask ("What AV product will catch the most?"). I'll tweet them :-). Apr 4, 2016 at 22:27
0

Since you can never be 100% sure you haven't been compromised, you need to practice defense-in-depth and just aim for as close to 100% as is practical.

  • AV software is becoming obsolete, but it isn't there yet. Keep it around, keep it updated, and run it often.

  • You already know which files are your most sensitive. Back them up often, and keep a copy off-site, so that if they are lost (i.e. from having to wipe your system), you can get them back.

  • If you're flexible about the single-system thing, have a machine that never connects directly to the internet. Carefully mediate what files move across from your offline machine to the one you use to browse. You can't call it an air-gap, but it's close.

  • Disposable virtual machines are your friend.

Defense-in-depth means that if one of your countermeasures fails, another will step in to stop the threat. The more you have, and the more they compliment each other, the safer you'll be. Just not 100% safe.

1
  • #2: backing up sensitive files doesn't address confidentiality. You should encrypt your sensitive files and backup off-site. In this way, if the hacker gets into your machine, he won't be able to read the content of your sensitive files, at least not in a reasonable amount of time.
    – A. Darwin
    Mar 18, 2016 at 9:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .