Antivirus: The Least Understood Link

Security has to be more than standalone antivirus software

Years ago, brands like McAfee and Norton were trusted names in a world where Internet worms, macro viruses, and the occasional rootkit were the biggest threats to organizational security. Both companies have evolved significantly since back when protection was limited to running a scan after a computer was infected. 

Modern antivirus software offers more proactive protection, blocking potentially malicious files before they can be written to file systems or memory. Moreover, they work in concert with your Security Information and Event (SIEM) system. This allows your system admins to monitor, mitigate, and proactively take measures. 

The value of installing antivirus software without other supporting systems in place is poor. It's money wasted. A standalone antivirus installation is dubious protection against payloads delivered via phishing attacks or compromised websites, as well as many types of adware. 

It's why I'm disappointed to see McAfee and Norton still preinstalled on many consumer (and sometimes, enterprise) Windows PCs. They provide little to no value. Antivirus nagware is the first thing I uninstall when preparing a fresh system. 

If you're a solo user, educating yourself on Internet threats (and how to avoid them), installing AdBlock on your browser, and considering using a non-local admin account for daily use will protect you much better than a $35 investment in Norton. Windows Defender, which comes preinstalled with the OS, is also quite effective and free. 

If you're an enterprise, the antivirus (yes, McAfee and Symantec both offer enterprise solutions) that is part of your SIEM strategy is what you install on client machines. It's imperfect on its own, but with other systems in place, you have a layered approach that can better protect your users and proactively act against threats.

If you're a small company, a mix of user education, reliance on Windows security options, and a good spam filter would be my go-to recommendation.