SwiftOnSecurityDec 28, 2022

Asked by @ajsnonsense: Should I use Norton or move to Defender?

This is one of those questions that can be answered in an edgy way historically 1, turns out to be simple in practice 2, and at broad scale is very complex 3.

1.) Those out of practice will tell you Defender sucks. But it doesn't anymore. Ignore them.
2.) Those talking practically will say absolutely use Defender. Make sure you're on the latest Windows build with Tamper protection enabled and your "Win10 privacy tool" didn't unknowingly disable half the protection features through ignorant choices, and you have a super-powerful solution for free. And they are right. That's what I do.
3.) Defender for home users is great, but intractably could do more because it is cuffed by the requirements it work perfectly without much user input across a billion devices, and that attackers will always test against it even if it can adapt quickly via cloud. [I AM TALKING CONSUMER ONLY THIS DOES NOT APPLY TO DEFENDER ATP OR CUSTOMIZED ENTERPRISE STUFF LIKE ASR GROUP POLICY]
Some third-party vendors have their own very novel and more noisy approaches to try to differentiate themselves from this free offering. I won't get in that here.

tl;dr I would not use anything bundled in a computer, I use Defender, but also do not discount unique approaches others can bring to the table – and if you make an informed choice, I support that.

This is the kind of thing you can't say in 280 characters.

Show threadSwiftOnSecurityDec 28, 2022

The fact is you can reasonably run a modern Windows system without any antivirus at all. Normal user operations just browsing the web have never been safer.
But when you start having users unfamiliar with Windows quirks opening email attachments, getting redirected to sites because they don't have an adblocker, tricked into fake updates.

That's where antivirus saves your ass. It can monitor for failure and respond to it. It acts as a partial backstop to many other layers failing. That SHOULD be its job. If antivirus ever gets a legitimate detection, that is a huge series of failures to make it to your box.

It's easy to be edgy on this topic. Nuance appears pudgy.

Show threadSwiftOnSecurityDec 28, 2022

Even in my hopefully measured response, people I respect can disagree based on their experience and value weights.

I could easily run my personal Windows boxes with no antivirus at all. I'd be fine. I know how this stuff happens, and my target profile for 0days.

I run antivirus anyway. That's my choice. It's informed by what I've seen. And my own mistakes along the way. I was a teen in the halcyon days of XP where you could artisan layer on numerable products to protect yourself.

Browser blast doors like Sandboxie, HIPS change alerting like Comodo, anti-exploit shims like EMET, and a plethora of antivirus vendors.

I don't know how to communicate this better without an extended speech presentation.

Show threadSwiftOnSecurityDec 28, 2022

In my experience - the most important denominator of infection is not a product you buy, it is the behavior you act. Knowing what's not worth the risk. When you're being lead on to perform weird actions. Where you're desperate for solutions so you throw caution to the wind and even disable AV like when using pirated software.

That is the real difference and you cannot possibly spend enough money to ask your computer not to do what you tell it to.

Show threadSusanBradley/SBSDiva/PatchLadyDec 28, 2022
@SwiftOnSecurity This "it's the behavior not the OS" is the argument people give me for why they can still use Windows XP in 2022.
Show threadSwiftOnSecurityDec 28, 2022
@susanbradley Entirely fair point, yeah you can take it to extremes where you do not understand the successive hardening. And I remember the "I'm staying on 32bjt WinXP days." Happy to hear more thoughts.
Show threadSusanBradley/SBSDiva/PatchLady
@SwiftOnSecurity I wish our redmond overlords would make it a tad easier by being more exact about what older platforms are vulnerable for but that would take resources away from supported premises platforms like... oh... Exchange 2019 or centered menus in windows 11. Just because you haven't been hit by X doesn't mean you aren't vulnerable to X
Dec 28, 2022 at 5:50amWeb
Show threadSteve SyfuhsDec 28, 2022
@susanbradley @SwiftOnSecurity not for nothing, but we're generally pretty clear about this. vCurrent has best of breed protections.
Show threadSusanBradley/SBSDiva/PatchLadyDec 28, 2022
@SteveSyfuhs @SwiftOnSecurity With my deepest respect, for consumers you need to be better. This is where there is a fail. For e5 absolutely. For Windows 11 Home or where their hardware can't run it, I need more ammo for the masses.
Show threadSteve SyfuhsDec 28, 2022

@susanbradley @SwiftOnSecurity and I should clarify: to that end all versions of *supported* OS get patches so vulnerabilities are *mitigated*.

New whatsits that bolt on fundamentally new protections are vNext/vCurrent.

If it meets our criteria for moderate->critical, we'll patch it.

Show threadSusanBradley/SBSDiva/PatchLadyDec 28, 2022
@SteveSyfuhs @SwiftOnSecurity Exchange - which is a patching beast unto itself needs to be much easier patched and not quite so much of an advertisement for online email lately
Show threadSusanBradley/SBSDiva/PatchLadyDec 28, 2022
@SteveSyfuhs @SwiftOnSecurity btw I wasn't talking about supported OS I was indeed talking about out of support OSs where there isn't an obvious info about being vulnerable. On October 14, 2025 we are going to have a LOT of people on an unpatched OS.
Show threadSteve SyfuhsDec 28, 2022
@susanbradley @SwiftOnSecurity fair enough. But at the same time we're talking five years to a decade. After a certain point we're talking maintenance (5y), security maintenance (10y), and then notta (>10y). If folks don't start their planning until 10yr+1m then they're in a pretty bad spot.
Show threadSusanBradley/SBSDiva/PatchLadyDec 28, 2022
@SteveSyfuhs @SwiftOnSecurity Home users and sohos I need help in October of 2025. These are folks that will never get the uber cool stuff in an E5 and thus the "you need a tpm chip and buy a new computer" is really hard to convince. Then the next layer up is the SMBs. Don't think enterprise here, it's the folks that employ a lot of people but aren't always thrilled about subscriptions (me for example I HATE PAYING WHAT I HAVE TO PAY FOR ADOBE on an annual basis)