Friday, September 28, 2007

A Bit More on AV

So, seeing more coverage of AV [in-?]efficiency today (e.g. here as well as all the old stuff here and summarized here) leads me to finally come out of the closet (OMG, I've been in the closet all this time... :-)).

After another one of my friends (who works in security and is obviously pretty darn smart about online risks), "protected" by a major-brand AV, had to rebuild his system, I decided "enough is enough." So, as of a few weeks ago, Symantec AV is gone from my systems, for good.

Time to stop and reflect on this a bit. I've been running AV for a good numbers of years, but not as many as others. Back in good ole days of Win95/98, I was not running anti-virus, mostly relying on my risk avoidance. Then my work PC came with an anti-virus tool and it kinda stayed on. Over all these years, I had exactly 0 (zero) infections on my own machines (apart from viruses that I brought in myself to experiment, of course :-)). However, saying farewell to the most popular security technology is a touching moment, to be sure.

At this point, I am pretty sure about 97.3% :-) of you are getting more and more curious: what is Anton smoking? How can he venture out in the world without any security software on this systems?

Well, I never said that I didn't replace it with anything. I did! I am happy to tell that I replaced the AV with a HIPS-like tool from Savant Protection, which mostly relies on a fancy version of whitelisting to protect the system (details here). As a disclosure, I need to mention that I am on their Advisory Board, but my decision to protect my own systems with it had little to do with it.

First, I installed it just to play with it, but then I realized that I want to run it "in production" due to its many advantages (no updates, no noticeable CPU impact, no silly scans to run, etc) Admittedly, sometimes you will need to respond to a pop-up (in the mode that I run it in!), but it is not a big deal. Feel free to check it out!

So, this post also works as a response to those of you who were saying "stop bitching about AV, you probably run it yourself: it sucks, but it is a must"...

Dr Anton Chuvakin