Recently, Rob Lee of SANS tested a fairly common APT attack scenario against a simulated enterprise environment to generate log files for a course and posted the results on the SANS Computer Forensics and Incident Response Blog. The not-so-surprising result? The attack succeeded, and no log files were generated. This was running the complete McAfee Suite, including:
- Anti-virus
- Anti-spyware
- Safe surfing
- Anti-spam
- Device Control
- Onsite Management
- Host Intrusion Prevention System
Rob was careful to avoid blaming McAfee, since no vendor’s solution effectively defends against targeted attacks:
I have seen a lot of enterprise managed A/V and HIPS suites and none of them have fared well against the APT actors and malware. It is too easy to obscure the malware to avoid detection so any A/V choice here (McAfee, Symantec, etc) would have yielded similar results. And that matches what myself and many others have witnessed in seeing these products at locations where APT adversaries roamed freely for months before detection. In the end, it really would not have mattered to choose product X over Y. We wanted to select a product where most attendees of FOR508 would feel at home when performing incident response.
Even with the some-what inflammatory title of “Is Anti-Virus Really Dead,” he’s careful to state that Anti-Virus is still recommended in almost all environments:
I would never recommend someone go without it, but it is clear that in order to find and defend against advanced adversaries we need to do more than rely on A/V. […] While I'm sure all many of these products stop low-hanging fruit attacks, we found that we basically did whatever we wanted without our enterprise managed host-based A/V and security suite sending up a flare.
After all, corporations don’t want to burn through valuable security and end-user support hours cleaning up after the Java or Flash exploit of the day. However, that didn’t stop some analysts from disregarding the post and focusing on why they’d never recommend running without Anti-Virus.
Although Rob’s research and conclusions make sense in his specific scenario, I still believe that antivirus is NOT dead for the vast majority of us. I guess my litmus test is that I would never bet my career on telling a large government customer to forgo implementing any antivirus solution.
There are plenty of ways around antivirus but I stick by the fact that it will at a minimum catch much of the low-hanging fruit that novices or automated attack tools use.
This is one of the reasons the original poster advocated the continued use of Anti-Virus, even with it’s limitations.
I think a bigger point is being missed. Namely, the entire concept of a ‘trusted internal network’ and a ‘trusted user’ is dead. With the current threat landscape, targeted attacks are being proxied through trusted devices and trusted users – relying on a ‘managed device’ or ‘authenticated user’ to assume a significant level of risk reduction is a huge issue. Keep in mind, running endpoint Anti-Virus and Host Intrusion Prevention software at best prevents 50% of a typical monthly patch cycle’s vulnerabilities. Nothing earth shattering, but many enterprises compromise on this security practice in the name of it being ‘nearly impossible’ and too much of an impact to productivity.
Consumerization strategies provide an excellent opportunity to rectify a lot of the security debt that has occurred in many traditional enterprises. Many business systems will be re-written or re-implemented to allow for ubiquitous access across devices. At that point, it makes sense to partner systems resources with security resources to ensure that, going forward, businesses implement systems that limit their exposure to data loss, don’t rely on the endpoint being trusted, and are monitor-able for abnormal behavior and access routines.
The API is the New Perimeter. It’s time to start protecting services and data and stop playing “plug the endpoint.”
