Chalk another one up for "Antiviruses causing more problems than solving them".
They 'worked' when they initially just scanned files for known malicious signatures. Now they're the equivalent of a sledgehammer to a wall with all of the extra bells & whistles strapped to them.
Application whitelisting is the remaining way forward if you actually care about runtime security. That & locking every access point down to the bare minimum.
I would say white listing will have to happen for everything in the near future: applications, ports, URLs (including fragments!), filesystem hierarchies, basically everything.
I'm not sure it's doable with current OS architectures, though.
They 'worked' when they initially just scanned files for known malicious signatures. Now they're the equivalent of a sledgehammer to a wall with all of the extra bells & whistles strapped to them.
Application whitelisting is the remaining way forward if you actually care about runtime security. That & locking every access point down to the bare minimum.
I'm not sure it's doable with current OS architectures, though.