SwiftOnSecurityDec 28, 2022

Asked by @ajsnonsense: Should I use Norton or move to Defender?

This is one of those questions that can be answered in an edgy way historically 1, turns out to be simple in practice 2, and at broad scale is very complex 3.

1.) Those out of practice will tell you Defender sucks. But it doesn't anymore. Ignore them.
2.) Those talking practically will say absolutely use Defender. Make sure you're on the latest Windows build with Tamper protection enabled and your "Win10 privacy tool" didn't unknowingly disable half the protection features through ignorant choices, and you have a super-powerful solution for free. And they are right. That's what I do.
3.) Defender for home users is great, but intractably could do more because it is cuffed by the requirements it work perfectly without much user input across a billion devices, and that attackers will always test against it even if it can adapt quickly via cloud. [I AM TALKING CONSUMER ONLY THIS DOES NOT APPLY TO DEFENDER ATP OR CUSTOMIZED ENTERPRISE STUFF LIKE ASR GROUP POLICY]
Some third-party vendors have their own very novel and more noisy approaches to try to differentiate themselves from this free offering. I won't get in that here.

tl;dr I would not use anything bundled in a computer, I use Defender, but also do not discount unique approaches others can bring to the table – and if you make an informed choice, I support that.

This is the kind of thing you can't say in 280 characters.

Show threadSwiftOnSecurityDec 28, 2022

The fact is you can reasonably run a modern Windows system without any antivirus at all. Normal user operations just browsing the web have never been safer.
But when you start having users unfamiliar with Windows quirks opening email attachments, getting redirected to sites because they don't have an adblocker, tricked into fake updates.

That's where antivirus saves your ass. It can monitor for failure and respond to it. It acts as a partial backstop to many other layers failing. That SHOULD be its job. If antivirus ever gets a legitimate detection, that is a huge series of failures to make it to your box.

It's easy to be edgy on this topic. Nuance appears pudgy.

Show threadSwiftOnSecurityDec 28, 2022

Even in my hopefully measured response, people I respect can disagree based on their experience and value weights.

I could easily run my personal Windows boxes with no antivirus at all. I'd be fine. I know how this stuff happens, and my target profile for 0days.

I run antivirus anyway. That's my choice. It's informed by what I've seen. And my own mistakes along the way. I was a teen in the halcyon days of XP where you could artisan layer on numerable products to protect yourself.

Browser blast doors like Sandboxie, HIPS change alerting like Comodo, anti-exploit shims like EMET, and a plethora of antivirus vendors.

I don't know how to communicate this better without an extended speech presentation.

Show threadKevin Karhan Dec 28, 2022
@SwiftOnSecurity any 3rd party AV on Windows worsens it's security btw.
Show threadGraham Sutherland / PolynomialDec 28, 2022
@kkarhan @SwiftOnSecurity that take lacks nuance. 3rd party AV certainly adds attack surface, particularly in terms of local privilege escalation. but it doesn't inherently "reduce security". it's a trade-off which strongly depends on whether the extra features of the AV product (above and beyond what Defender offers) are useful to you. evaluating the risk of additional LPE bugs is essentially impossible in any rigorous quantitative sense.
Show threadGraham Sutherland / PolynomialDec 28, 2022

@kkarhan @SwiftOnSecurity you can certainly build an informed opinion based on the history of vulnerabilities in the product, in terms of both severity and handling competence, but that's never a guarantee and there's no hard rule.

I'm of the opinion that Defender + adblock is sufficient for general home use, partly because Defender works well enough but also because your average consumer has no idea how to interpret and assess prior product vulnerabilities.

Show threadGraham Sutherland / PolynomialDec 28, 2022
@kkarhan @SwiftOnSecurity this isn't just random loosely-formed opinion, either. I'm saying this as someone who has professionally performed security reviews (binapp assessments, kernel driver assessments, source code reviews) on AV/EDR products and found/published vulnerabilities in commercial security products.
Show threadKevin Karhan 
@gsuberland @SwiftOnSecurity yeah, but in my experience as sysadmin having to deal with #TechIlliterates constantly, migrating people to #Ubuntu LTS is just faster and easier...
Dec 28, 2022 at 4:57amWeb
Show threadKevin Karhan Dec 28, 2022

@gsuberland @SwiftOnSecurity IMHO 3rd party #AV is just #ValueRemoving rentseeking on #Windows.

An #AV on a #Linux machine [i.e. #Fileserver and/or #Mailserver] however makes sense...

Show threadGraham Sutherland / PolynomialDec 28, 2022
@kkarhan @SwiftOnSecurity I'm strongly opposed to "just use Linux!" as a general response to these issues. There are rare cases where it makes sense, but most of the time it's a failure to prioritise users' needs and almost always for nebulous reasons of "better security" that aren't delivered in practice.