14

In a recent interview† with Dave Kennedy, he in passing pegged the average effectiveness of anti-virus products as detecting approximately 3% to 5% of current active threats.

While AV comparisons will typically publish detection rates, those are always based on historical virus samples which are only mildly relevant in today's security landscape. Current virus and malware activity is inherently difficult to properly gauge.

Do we have any scientific measure of the real-world effectiveness of off-the-shelf anti-virus products in detecting and stopping today's active threats?

Put differently, what is the actual real value of running an anti-virus product when facing today's common security threats?

† PaulDotCom Security Weekly Episode 335 -- Excerpt

Improve this question
  • 2
    The only threats are the ones not protected against. – Griffin Nowak Jun 21 '13 at 18:59
  • 1
    And the biggest threat is the user. – Griffin Nowak Jun 21 '13 at 19:00
  • 2
    @Griffin that's very Zen. Not particularly helpful, but certainly meta. – tylerl Jun 21 '13 at 19:01
  • Lol It's also very true and it gives you your answer. They are 1/2 helpful. Yes they protect against the very basics but the exploit that gets you will never be properly protected against. – Griffin Nowak Jun 21 '13 at 19:02
  • 1
    No matter how many security programs you install, its all useless if the real threat is an imprudent user. A conscious user is the best anti-virus there is. If you know basic stuff like differencing a program from a picture you already have the knowledge necessary to keep your computer safer than a thousand anti-virus, at zero resources cost. – Havenard Jun 21 '13 at 22:47
7

Do we have any scientific measure of the real-world effectiveness of off-the-shelf anti-virus products in detecting and stopping today's active threats?

No. New viruses are created everyday, some may spread far enough to get caught by Anti-virus vendors, others might not, slight variations in viruses can cause them to be missed and many people in underground markets offer 'FUD' Crypters/Packers in order to evade AV solutions. With so many people writing malicious code and the code being re-used/modified to suit its more than possible what we see and defend against is only the tip of the iceberg.

Put differently, what is the actual real value of running an anti-virus product when facing today's common security threats?

The vale? It provides another Layer of security. Like all security technologies, no one single defense creates a 'bulletproof' defense against all malicious attacks. I've heard wildly varying estimates as to the size of AV signature database but the point is, that it'll catch low hanging fruits (it'd be embarassing to be pwnt by ILOVEYOU now wouldn't it?) In addition, the herustics engines might work for you from time to time and find new malware that doesn't have signatures.

Its all about defense in depth!

Improve this answer
4

Put differently, what is the actual real value of running an anti-virus product when facing today's common security threats?

Simply put, it inoculates you against well-known existing attacks.

By itself, it is not a panacea. Nothing is. But relative security can only be achieved by overlapping defenses, and antivirus is simply one of many terribly incomplete solutions that together can help make you resilient against those with malicious intent.

What is the value of your white blood cells? Little, if you lack antibodies, T cells, cytokines, or even a basic defense such as skin. Yet even with those complementary defenses, white blood cells are a critical part of your body's immune system.

Improve this answer
4

In addition to the other two answers:

I believe an Anti-Virus can protect you against most viruses out in the wild. However changing a virus signature isn't really too hard, which may allow them to pass through AVs. This means that a targeted attack might still be effective and an anti-virus won't be able to protect you against that.

Improve this answer
1

Antivirus software is a byproduct the crazy email social engineering that has declined in occurrence over the past few years (with email being used less as a primary means of communication) with social networks becoming the standard for personal internet communication (you don't here of people using AIM, Yahoo Messenger or MSN much anymore)

Malware authors have shifted their point of attack to something else on end-user computers, vulnerabilities in software, it partially bypasses the issue of having to trick Antivirus software since it can use a backdoor or exploit to achieve higher level access to a end user's computer most of the time without any user interaction needed.

You are 182 times more likely to be served malicious content via online advertising than pornographic sites. -- source

How does a antivirus stop a program from being exploited to gain super-user access to a computer?

The best antivirus for me the past 3 years is no antivirus software, and keeping all programs up-to-date especially browser plugins.

Also the rise in info-stealing malware shifts the importance of security that it not just is about keeping the computer secure and but also the end user.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.