A technical problem has arisen, and the vendor's first suggested solution is to exclude the program's folders from our antivirus. There are multiple reasons I am hesitant to do so:
- Primarily: If a malicious file finds its way into those folders, either via vendor patching or unrelated actions, said file will be ignored by the antivirus whereas it may otherwise have been immediately neutralized.
- We currently only exclude specific files by their SHA256 hash. This program set, however, contains far too many files for this to be feasible.
- This can not be scalable. If we excluded every folder for every approved application, the threat surface would be colossal.
And so forth. In this specific instance, it's something we can do for a specific set of machines to test. The situation did bring forth the general question, however I'm curious to know what the larger community thinks about when is it acceptable to exclude folders in antivirus, and why? The short answer, I would argue, is "as little as possible" for the reasons I listed above and more, but I came to realize that I can't think of a single scenario where it would be a good idea. The functionality is common in antivirus applications, which suggests that there are legitimate reasons to do so, but I can't think of an instance where we would want to leave an entire folder free to become infected.
I struggle to put this into precise words, but it feels like violating some analogue to the least-trust principle -- it'd be a lot smoother day-to-day to give all employees full admin access to everything, until it goes horribly wrong; similarly, it'd be really easy to just exclude folders from antivirus at the first sign of false positive, until that backfires when there really is something malicious in there.
Are there examples I'm not thinking of where it really is the best solution, where this would be the advisable choice? Example scenarios and research are welcome.