The information security community continuously laments the ineffectiveness of anti-virus lately. Report after report indicate that AV catches only between 5% and 55% of malware. Can any organization justify the cost for such a generally ineffective control? Symantec themselves has even stated that the usefulness of AV is waning.
However, when the bill comes for next year’s maintenance on your chosen AV platform, you’re going to pay it, aren’t you? And so will nearly everyone else.
Why is that? Behavioral economists categorize a number of cognitive biases in human psychology, such as “herd mentality”. I suspect that we are inclined to “do what everyone else is doing”, which is indeed to keep AV around. Another bias is the “sunk cost fallacy”. We spent a lot of money deploying AV and have spent a lot of money each year since to keep it fed and cared for. Abandoning AV will be turning our back on the investment we’ve made, even if it would save us money now.
I think that there may be an even stronger game theoretic force at play here. If I am responsible for security at my organization, I have many factors to consider when prioritizing my spending. I may fully believe that AV will not provide additional malware protection beyond other controls in place, and therefore I could reallocate the savings from not using AV to some more productive purpose. However, if there IS an incident involving malware at my organization and I made the choice to not use AV, even if AV wouldn’t have stopped it, or if the damages suffered were much less than the savings from not using AV, I am probably going to be working on my resume. Or I assume that I will.
I suspect this is a similar reason why we will not see requirements for AV relaxed in various security standards and frameworks any time soon. From the perspective of a standards body, there is only downside in removing that requirement:
- The AV industry, and probably others, may ridicule the standard for not prescribing the mainstay of security controls, which they have a financial incentive to keep in place
- Organizations following the standard that have malware-related losses may point back to the standard and call it ineffective
- The standards body generally will not incur costs resulting from including a given control, so removing AV as a requirement is not sensible since it does catch some amount of malware, however small
You might be asking: “what exactly are you getting at here?” I’m not proposing that you, or anyone else dump AV. I am proposing that we question why things are being done the way they are. As defenders, we have a limited amount of money and time to spend, and we ought to ensure we are prioritizing our security controls based on effectiveness at mitigating risk to our systems and data and not just because it’s what everyone else is doing.
I’ll also say that, if we’re not willing to dump AV, we ought to (at least from time to time) change the nature of the discussions and criticisms of AV into something productive. For example, if AV is mandatory and it’s not all that effective, we ought to be purchasing the most economical product to save money for other endeavors. Rather than simply comparing effectiveness rates, we could be considering the cost of effectiveness rates per user. If I am paying $50/year/user for an AV platform that is 35% effective, it would be good to know that I could pay $25/year/user for one that is 30% effective. This assumes, of course, that we settle on a standard methodology for rating the effectiveness of AV, which seems like a challenge on its own.