Developer claims anti-virus does not improve security

Anti-virus is bad, dead (again) and worse, its corpse is poisoning the ecosystem of good software.

There is, according to former Mozilla developer Robert O’Callahan, negligible evidence that anti-malware software produced by third-parties provides any additional security. His arguments have spread from his blog to Twitter and then to IT news websites like IT Pro and The Register.

Is anti-virus useless? Is it worth your time and possibly money?

We test anti-malware software and have, as a team, being doing so for years. We have plenty of strong evidence that third-party anti-malware software provides improved security over that which comes with Windows by default. Our enterprise, small business and consumer reports are free to download.

There is no doubt that updating your operating system makes it more secure. We’ve run tests to prove that this oft-quoted advice is based on real, reproducible data. But what we’ve also seen is that adding a decent anti-virus package to a good patching schedule raises protection levels even higher.

There is a difference

To say that all anti-virus software is equally (in)effective is just plain wrong. There are plenty of results from different testing labs that show this. You may not trust all of those labs, and you may have problems with some (or all) of the ways that they test, but I would strongly suggest that we can’t all be wrong.

Our position on the Microsoft anti-malware included with Windows is that it is far better than it used to be. But that some commercial third-party packages are consistently stronger.

Why do people bash ‘anti-virus’ all the time?

Different individuals and companies have axes to grind when it comes to anti-virus or, to use a more modern and appropriate term, ‘anti-malware’ software.

• New anti-malware vendors sometimes disparage more established vendors as providing less sophisticated products as a marketing tool.
• Windows developers at Microsoft don’t like the perception (which is sometimes the truth) that anti-malware products slow down Windows. When a user has a bad Windows experience, for whatever reason, Microsoft feels the impact.
• Other developers hate that anti-malware products embed themselves into Windows in sometimes strange and unusual ways. This can cause potential havoc with their own efforts and possibly introducing new and powerful security vulnerabilities. Anti-malware vendors argue that they need to do this to prevent particularly nasty threats from digging in at the lowest security levels within the operating system.
• Users who have never (knowingly) suffered a malware attack often question the very necessity for anti-malware.
• Some testers/ researchers make it their life’s mission to discover technical problems with anti-malware. Sometimes they apparently taking the position that “anti-malware is bad for you,” rather than, “you need it, it’s a bit broken but here’s how to fix it.”

So is anti-virus useless, or the ultimate solution?

I have never seen a perfect anti-malware product. I mean that in terms of the protection that it offers; the performance impact that it makes; and the additional attack surface that it exposes. But nor have I encountered a perfect operating system, browser or user.

We can throw away our anti-malware software when our operating systems are fully secure; we, as users, stop clicking on links to malware; and criminals and other ‘agencies’ stop attacking our computers en-masse.