I’ve said it for a few years now, but host-based antivirus is really not working out anymore. Not with its reliance on signatures to detect malware.
Recently, several prominent antivirus vendors have experienced problems with faulty virus definitions:
- Faulty McAfee update burns IT execs
- BitDefender update breaks 64-bit Windows PCs
- [Clamav-announce] problem with daily.cvd 10938
- 100% CPU usage with VIPRE definitions 6272 – 6274
Although all of these vendors have promised the obvious improvements to their QA and testing processes (and I have no reason to believe that they are insincere), there is no sign that these problems will diminish over time. Instead, it is pretty clear that there will be more problems as the massive increase of malware is forcing vendors to push out updates faster and faster.
There are several problems with malware protection which relies on signatures:
- Malware writers are using sophisticated toolkits which reduce the skill and time needed to produce effective malware – both new and variants.
- Polymorphic malware regularly gets around signature detection, forcing AV vendors to constantly push out new signatures – several times per day!
- There are many kinds of malware that are still not properly detected by up-to-date AV solutions with current definitions.
Where does this leave us? Host-based antivirus products are using up more and more CPU cycles to process an ever-growing list of viruses, yet are still unable to keep up with the onslaught of new malware. To make matters worse, the constant creation and release of new definition files is stressing the quality assurance (QA) process for antivirus vendors. We have reached the place where IT professionals are considering turning off automatic AV updates, and deploying labs to test the updates before release.
In short, the odds of timely detection continues to drift downward every so slowly, while the risk of friendly fire from the AV solution itself creeps upward ever so steadily. (The McAfee update issue had an impact on its clients that rivaled a major virus attack.)
We are long overdue for a different approach.
Application Whitelisting
Companies such as Bit9, CoreTrace, and Lumension have been pushing application whitelisting for years now. Microsoft has also provided this technology via AppLocker in Vista, Windows 7 and Server 2008. Even some of the major AV players have purchased or developed application whitelisting technology, but they have not been actively pushing it into the mainstream. They need to start.
Better yet, we as IT leaders and professionals need to start evaluating and deploying the technologies that better address information security concerns in 2010 and beyond, allowing us to make better use our limited budgets and resources.
Application whitelisting is a good idea, because for every environment, there are less items that fall into the “known good” category than bad code that you don’t want to run. Just consider the difference in a firewall rule-set that assumes a “deny all that has not been explicitly opened” stance vs one that tries to explicitly prevent access to all bad protocols and ports.
The frequency of change in the “allow list”, particularly in corporate environments, will be greatly reduced as compared to the “bad list”. This automatically minimizes the chance for error. It also means that the processing power needed to evaluate the former list will be far less than that needed to evaluate the current lists of malware in today’s signature-based AV products.
Mitigating Code-Enabled Data
I think that we really have to weigh the disadvantage of code-enabled data files and either abandon them outright (queue lots of whining), or at least ensure that there are centrally controlled configuration options for enabling or disabling the automation features of productivity applications.
For instance, consider how diminished the threat of macro-embedded documents has become since Microsoft enabled much better controls over macro security, including turning them off by default, and allowing them to be set via policies. Remember when macro viruses were the most common threat vector? We need to do the same for PDF exploits.
Getting a better handle on security at the host level entails not only controlling which application can run, but determining in what context, and with what functionality it can run at any given time. If we can get vendors to provide us with centralized controls regulating all of the features they integrate into their apps, then each person and each organization can determine what level of risk to assume for any given application – and in the event of an emergency, the problematic feature can be disabled or otherwise impaired on as a stopgap.
All of these options will sufficiently mitigate external risks without simultaneously increasing risks from errors. And they will consume less processing power and generate less application conflicts than our current antimalware solutions.
Using the Right Technology
Signature-based security devices still have their place within the enterprise – mostly at the perimeter. (And even there, their days are numbered.) But at the desktop, they are increasingly causing more pain than gain, and it is time for us to change our approach, lest we find ourselves slipping further and further behind the malware writers.
And whitelisting need not concern itself with every executable. Each organization can determine just how much to watch and keep track of, balancing performance, productivity and security according to a risk profile that they select.
Yes, there will be a few challenges to address in order to see mainstream use of whitelisting technology – including the integration of such technology into the patch management process – but, the gains will be well worth it. Environments that have moved in this direction are already seeing significant ROI just in terms of recovering lost administrator time from managing the AV process and from recovering from broken antivirus definitions.
If you haven’t looked at Microsoft’s AppLocker technology, or at the technology from one of the other vendors, you owe it to yourself and your organization to start evaluating, testing and ultimately deploying. Those who get ahead of the curve in the next 9-15 months will save themselves and their organizations significantly vs those who keep using the same old methods, even as the nature and intensity of the threat landscape has changed dramatically.
Blacklisting is out. Whitelisting is in. Please get with the program.