What is the difference between antivirus and firewalls

Question

I need a brief explanation about the differences between antiviruses and firewalls

Answer 1

Firewall and antivirus software are two fundamentally different and complementary kinds of security applications.

Firewall :

Also known as a 'packet filter'. Basically, software which monitors network traffic and connection attempts into and out of a network or computer and determines whether or not to allow it to pass. Depending on the sophistication, this can be limited to simple IP/port combinations or do full content-aware scans.

A firewall can be thought of as a screen or sieve that categorically strains out potentially harmful data.

Antivirus:

A software which will find programs/files/software/etc that might compromise your computer, either by being executable or by exploiting a vulnerability in the program normally supposed to process them -- Rootkits, trojans, or other types of malware.

It detects these kinds of harmful programs that are already installed on your computer or about to be installed.

It can perform various protective measures (based on the security settings in the Anti-virus software) such as quarantine, permanent removal, fix, etc.,

It will also look for potentially harmful files that are downloaded from the internet or attached to an email and notifies/removes it to protect your computer.

NOTE: Antivirus software has to be updated frequently; each new strain of virus will likely have different signatures.

Answer 2

File ≠ network

An antivirus is working at the file level where a firewall is working at the network protocol level. An antivirus will analyze web pages downloaded (which are local files), and E-mail attachments (which are also local files) to detect if they contain known signatures. A firewall will decide how the protocols 80/tcp or 161/udp (for example) will be allowed or not toward the internal network.

Late ≠ early

An antivirus is an afterward security approach. An antivirus will detect malware with signatures which are edited by anti-virus R & D team. This approach is most notably between 24 and one week late relative to the malware date of appearance. In some cases anti-virus signatures took months to be worldwide broadcasted. A firewall is an in advance security approach. A firewall will block bad (i.e. unwanted because they are most notably used to drive attacks) network protocols or network protocols that are inappropriatly used (for example to build a Denial of Service attack).

An oversimplified analysis is that an anti-virus approach is rather late and a firewall one is rather anticipated relatively to the attackers production of malware. On the other hand, an anti-virus permit to make another full filesystem check with a new signature database. An anti-virus will permit an afterward analysis (late isn't always a weakness). A firewall won't permit such an afterward analysis.

Everywhere ≠ border

To be efficient an anti-virus must be installed on all computers within a fleet to bring to a given level of security. A firewall has to be placed at any border delimiting network area of different security levels. The most traditionnal firewall positionning is at the border router to connect to the Internet.

Answer 3

An antivirus will usually recognize a file's binary signature (roughly speaking, "it contains a byte sequence that's typical of XYZ virus").

For greater protection, many antiviruses are able to check system operation and block suspicious activity patterns (e.g., "this process is trying to write to a system file!").

A firewall could be considered a different implementation of the same "recognition" concept: instead of file systems, it can monitor network traffic and recognize both binary signatures and activity patterns, and block or allow, say, Web connections that start with GET or POST, but not CONNECT, or connections to services (such as Web) but not mail, unless your IP address matches the CEO office, and so on and so forth.

Both antiviruses and firewalls may have deeper inspection capabilities in order to unravel encrypted/compressed/stealthed/obfuscated executables (antiviruses) and complex Internet protocols (firewalls), and of course signature recognition is not so simple as this due to considerations about false positives, false negatives, efficiency, memory footprint, update capability and so on.

It must be noted that the intent of the two is similar, the implementation is different, and the operation is complementary: your average attack surface comprises both network and file systems, so you needs must defend both.

Therefore, a security "solution" or product may integrate both - some would say that it should integrate both - and be referred to as either (or maybe "internet security", "complete security" and so on). So you'll see "the firewall options of the antivirus", or "virus defense capabilities of the firewall".

I've heard antiviruses referred to as filewalls :-)

Answer 4

A firewall is designed to block unauthorized communications. Firewall will not protect system from viruses, spyware and adware. A properly configured firewall can minimize damage caused by spyware by blocking unauthorized access, while antivirus is a software application used for the prevention, detection, and removal of malicious software, including computer viruses, trojan horses, spyware, and adware.
Firewall can be implemented in both software and hardware, while antivirus program is a software application.