Is Your Anti-Virus Doing Its Job?

Every day, new malware and other online threats emerge. In fact, the AV-Test Institute registers over 380,000 new pieces of malware and potentially unwanted applications (PUA) every day.

The 2022 report from the Department for Digital, Culture, Media & Sport ‘Cyber Security Breaches Survey’ reveals that bad actors are still largely targeting people, instead of infrastructure. For those medium and large businesses that identified an attack, the most common threat vectors were phishing attempts (94%) and impersonation campaigns (63%).

However, Digital Pathways research shows that many mid-market businesses do not believe their current cybersecurity strategy is future ready.

Phishing campaigns are evolving, and cyber criminals are getting increasingly sophisticated, often using relevant news and trends as click bait. COVID-19, humanitarian efforts in Ukraine and even popular, sporting events, have all been used to lure victims into clicking a malicious link or opening a corrupted attachment on email.
Some operating systems are much more susceptible to viruses than others, with Windows coming in first, with 87% of ransomware targeted at Windows computers.

In a world where cyber attacks are growing, traditional anti-virus solutions are simply not enough. As confidence in detection-based protection is declining and given remediation even for a single threat is increasingly costly, now is the time to introduce more preventive anti-malware solutions.

This is supported by a recent study by the Ponemon Institute on the state of endpoint security risk, where they found that only 27% of respondents thought that traditional anti-virus solutions were sufficient for new and unknown threats.

The reality is, with our increased reliance on being connected to the web, combined with the rapid expansion of malware, it is becoming harder to prevent devices from getting infected. That means, if you are relying on anti-virus software alone to secure your PC, you do not have enough protection against the growing number of threats. There are too many threats to defend against!

Standard anti-virus software is effective against most known threats. But there are also unknown risks to add into the equation, and this is where they fail. AV engineers need time to understand a new virus and then add the fix to their software which can take days to do. Then a further delay happens as IT teams often do not update immediately. Thus, an update could take a week to be implemented which, in virus terms, is ample time to spread.

Something as seemingly harmless as a web page can be a way for malware to get into your system, simply by visiting them. These typically come from clicking malicious ads, known as malvertising attacks, they land on a page that could download a file or execute a web script that compromises your system.

Given the findings that many companies do not have a clear strategy for tackling these attacks, and where they do, the process is disjointed or out of date, what can an organisation do?

  • Start by taking back control and protecting users from traditional email threats including spam, viruses, large-scale phishing attacks and malicious URLs.

To do this, ensure your solution can address both known viruses, and fileless attacks, such as those coming from websites or, brand-new viruses which have yet to be diagnosed by the AV vendors.

  • Secondly, close any gaps in existing security postures by integrating attack intelligence across email, web, and cloud, using identity and context.

This is about looking at the bigger picture and ensuring bad code is not already in the network, waiting for the trigger to be pulled. Use behavioural analytics, the more granular your data, the better the understanding of what constitutes normal activity, enabling anything unusual to be flagged for review.

  • Thirdly, prevent cross-channel attacks with an autonomous security engine that can respond to any threats at machine-speed.

This helps ensure that when an attack is seen in one location, for example a device within the network or a rogue weblink, all connected devices and services within the organisation are protected by machine level alerts, which contain the outbreak or remove the weblink by filtering from any other user. Remember ransomware tactics are diversifying and can strike at weekends or holidays when fewer IT security staff will be on duty.  This calls for an AI level of monitoring and response.

  • Finally, run regular phishing simulations which are a good way to keep employees sharp, particularly live tests and never underestimate the insider threat.

It is a fact that AV alone is not good enough, and an organisation needs to take a broad approach to stopping bad code entering the network.

Clearly user education is a good starting point, but on its own the company will still suffer a breach, no matter how diligent users are.

Today, the attack surface is so wide that what is needed, is a consolidated solution that covers email, websites, and active content scanning, built around an AI driven intelligent process of detection, containment and remediation, as we are now beyond the ability of most IT teams to fully understand what the attack vector is.

Colin Tankard is Managing Director of Digital Pathways

You Might Also Read:

Never Trust Anything Again - The Zero Trust World:

 

« A Major Skills Training Initiative From (ISC)2
How IAST Improves Application Security & Six Steps to Effective Deployment »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Gamma

Gamma

Gamma is a leading provider of Unified Communications as a Service (UCaaS) into the UK, Dutch, Spanish and German business markets.

Wallarm

Wallarm

Wallarm is the only unified, best-in-class API Security and WAAP (Web App and API Protection) platform to protect your entire API and web application portfolio.

DataArt

DataArt

DataArt is a global technology consultancy that designs, develops and supports unique software solutions. Areas of activity include software security testing.

SecZetta

SecZetta

SecZetta provides third-party identity risk solutions that are easy to use, and purpose built to help organizations execute risk-based identity access and lifecycle strategies.

Kyndryl

Kyndryl

Kyndryl has a comprehensive portfolio that leverages hybrid cloud solutions, business resiliency, and network services to help optimize your IT workloads and transformations.

CyberScotland

CyberScotland

The CyberScotland Partnership is a collaboration of key strategic stakeholders, brought together to focus efforts on improving cyber resilience across Scotland in a coordinated and coherent way.

ThreatLocker

ThreatLocker

The ThreatLocker Platform provides a Zero Trust security solution that offers a unified approach to protecting users, devices, and networks against the exploitation of zero day vulnerabilities.

QuantumCTek

QuantumCTek

QuantumCTek is a Chinese pioneer and leader in commercialized quantum information technology (QIT).

Board of Cyber

Board of Cyber

Board of Cyber offers Security Rating: a fast, non-intrusive, continuous, 100% automated solution to evaluate the cyber performance of an organization.

SEALSQ

SEALSQ

For the last 25 years, SEALSQ have been developing secure semiconductor chips, secure embedded firmware, and tested hardware provisioning services to serve the vision of a safer connected world.

Munio

Munio

Munio is a leading Fortified IT Support and Cyber Security companies in the south east of the UK.

OutKept

OutKept

OutKept offers the highest quality phishing simulation campaigns, supported by a community of ethical phishers, to build awareness, and maintain alertness.

RunReveal

RunReveal

RunReveal's mission is to make sure no breach goes undetected. That means having a product that is accessible and effective for companies of all sizes.

CyberHive

CyberHive

CyberHive offer a complete suite of threat protection modules that seamlessly integrate to block current, as well as future threats.

Nexsan

Nexsan

Nexsan offers versatile and robust data storage solutions tailored to adapt seamlessly across a diverse range of sectors, ensuring reliable performance for critical data management.

CoNetrix

CoNetrix

CoNetrix is a full service computer networking, software development, and security and compliance firm built on the principles of integrity, innovation, and initiative.