Is antivirus software indispensable after all?

Dell has warned that a small number of its server motherboards may be harboring malicious software. The issue came to light after a customer wrote on a Dell support forum about being contacted by a service technician for a rather unusual procedure: Dell wanted to cleanse a malware from the server motherboard that was recently replaced.

Essentially, malware has been found on the embedded server management firmware of some of its server motherboards. While Dell insisted that the number of effected server motherboards is small, the company was forced to publicly acknowledge the issue, and that it is working to rectify the problem.

It wasn't clear from the limited information how the malware could be spread, it is established that certain unpatched versions of the Windows OS would have been affected, assuming that no antivirus software with an updated definition file is present. Huh, a virus spreading from a motherboard? With the goalposts constantly changing, it is no wonder that those with lower IT inclinations are confused over what constitutes a virus.

And while the era of floppy disks is thankfully gone, the age of attacks launched from USB flash drive is still on us. And guess what? The latest variant could even be spread via networked drives, thanks to the new Windows Shell vulnerability recently discovered in just about all versions of the Windows operating system since Windows XP. While a temporary work-around was quickly released, a suitably (automatically) updated antivirus definition would have done the trick here as well.

The sad fact is that despite the increased prioritization for security over the last couple of years, the constant scrutiny has continued to yield an almost constant torrent of security vulnerabilities and problems--from all kinds of known and new attack vectors. Alternative solutions such as white listing exist, but implementation challenges and limited awareness mean that it is not a solution that is widely utilized.

Personally, I've never been too impressed with how definition-based antivirus solutions are an exercise in "catching up." Beyond powering off your laptop and then locking it into a room unfortunately, the use of a definition-based antivirus solution still appears to be the best defense against malware today.

How do you protect the computing resources in your organization? - Paul Mah  (Twitter @paulmah)