IT departments that need to check the box thats says “does your organization have antivirus or anti malware protection on all desktops?”. Common in soc audits and cyber insurance attestations.
“does your organization have antivirus or anti malware protection on all desktops?”
Talk about suggestive question phrasing. Where better organisational security could often be accomplished by assuming every device attached to the network is a potential threat, and focusing on the network security, shielding devices against each other with only whitelisted protocols, plus locking down all devices that are configured by corporate IT.
Practical IT security in most orgs these days is “configure a big firewall with default settings from corporate provider, assuming everything is safe inside.” then they get one compromised device (USB stick, cell phone transfer, exploit, whatever) and the whole ass network is fucked. and they have a “oh well, we did everything we can” excuse. fucking BS.
Complicate requirement are kind of out of date. They keep adding requirements to them but then don’t often take them away. So if a requiment made sense 20 years ago it’s still there even though there are better strategies to protect your environment.
You could skip a requiment if you can establish a compensatinh control and show that the threat the requirements is intended to address is addressed. For example skipping antivirus by reimagining the devices every morning, this is an absurd example but would work.
Doesn’t help that IT is outsourced to the lowest bidder, which typically means the IT contractor enslaving corporate IT to microsoft and playing a game of “forward the ticket”.
Then “IT managers” in the organisation responsible for the contract typically know jack shit about IT and are busy trying to save face over protecting their users from incompetent contractors.
Yeah but clamav doesn’t have “a centralized dashboard with mdm and intune integration” e.g. a spreadsheet that says when everyone’s last scan was and that their definitions are up to date so the security theater can exist. Not to worry, more likely than not this is just built on a mountain of open source software like clamav that’s probably MIT licensed so MS can slap their logo on it and charge for it
The definitions are always behind, and custom sources are still behind. The configuration sucks and that’s from a NixOS user. The IO latency is atrocious when set to watching the filesystem, and it’s generally unwieldy. The clamscan/clamdscan separation doesn’t make sense either. And it’s slow as hell parsing definitions.
No IT Auditor ever tests this, the just ask and if you say yes they move on. To actually test this you would have to statically sample a random sample of devices and confirm the antivirus is installed.
Instead that auditors are going to ask for a list off devices enrolled in the antivirus and a list of all devices (if the company even has an asset inventory) and see if they look right. But, most like the asset list will come from the antivirus enrollment and it won’t matter.
IT departments that need to check the box thats says “does your organization have antivirus or anti malware protection on all desktops?”. Common in soc audits and cyber insurance attestations.
Talk about suggestive question phrasing. Where better organisational security could often be accomplished by assuming every device attached to the network is a potential threat, and focusing on the network security, shielding devices against each other with only whitelisted protocols, plus locking down all devices that are configured by corporate IT.
Practical IT security in most orgs these days is “configure a big firewall with default settings from corporate provider, assuming everything is safe inside.” then they get one compromised device (USB stick, cell phone transfer, exploit, whatever) and the whole ass network is fucked. and they have a “oh well, we did everything we can” excuse. fucking BS.
Complicate requirement are kind of out of date. They keep adding requirements to them but then don’t often take them away. So if a requiment made sense 20 years ago it’s still there even though there are better strategies to protect your environment.
You could skip a requiment if you can establish a compensatinh control and show that the threat the requirements is intended to address is addressed. For example skipping antivirus by reimagining the devices every morning, this is an absurd example but would work.
Doesn’t help that IT is outsourced to the lowest bidder, which typically means the IT contractor enslaving corporate IT to microsoft and playing a game of “forward the ticket”. Then “IT managers” in the organisation responsible for the contract typically know jack shit about IT and are busy trying to save face over protecting their users from incompetent contractors.
ClamAV exists…
Yeah but clamav doesn’t have “a centralized dashboard with mdm and intune integration” e.g. a spreadsheet that says when everyone’s last scan was and that their definitions are up to date so the security theater can exist. Not to worry, more likely than not this is just built on a mountain of open source software like clamav that’s probably MIT licensed so MS can slap their logo on it and charge for it
There already better alternatives like clamav but I guess that assumes the IT department is actually Linux proficient.
ClamAV is shit, and I’ve been using it on my machine for years
in what sense?
The definitions are always behind, and custom sources are still behind. The configuration sucks and that’s from a NixOS user. The IO latency is atrocious when set to watching the filesystem, and it’s generally unwieldy. The clamscan/clamdscan separation doesn’t make sense either. And it’s slow as hell parsing definitions.
No IT Auditor ever tests this, the just ask and if you say yes they move on. To actually test this you would have to statically sample a random sample of devices and confirm the antivirus is installed.
Instead that auditors are going to ask for a list off devices enrolled in the antivirus and a list of all devices (if the company even has an asset inventory) and see if they look right. But, most like the asset list will come from the antivirus enrollment and it won’t matter.