Why Your Antivirus Software Isn't Enough

Greek mythology tells the story of the Hydra, a monster that grew two new heads for each head that a warrior might cut off. The monster was defeated only with the assistance of a goddess’s golden sword and was immortalized as a constellation. The originators of the Hydra myth could not have foreseen how their story would remain relevant thousands of years later in the antivirus software industry.

Virtually every antivirus software program operates by scanning endless streams of code for known virus signatures. Multiple different viruses might share the same signature, which allows a typical antivirus software program to delete multiple mutations of a virus. Regardless, as with the Hydra, cybercriminals create multiple viruses with new signatures for every old signature that has been detected and deleted.

The Evolution of Malware

A computer virus is only one of the many forms of malware that can adversely affect a computer or network. Early forms of computer viruses maliciously destroyed files or spread unwanted email messages to a user’s mailing list. In the early 2000s cybercriminals stepped up their game and learned how to control a user’s computer via remote commands and used malware viruses to steal personal financial information for illicit gains. More recently, whole networks have been held hostage by cryptolocker “ransomware” that blocks access to all information on a network until a bounty is paid for its release.

Viruses are only one of the many malware risks that a network might face. Cybercriminals have developed new tools, including DDoS attacks that freeze up a network by flooding it with tens of thousands of queries. While a security team is distracted by a DDoS attack, the cybercriminal plumb other network weaknesses to steal information.

On a less sophisticated basis, cybercriminals have used lost or stolen mobile devices or USB sticks as levers to enter networks. The end game of all of these techniques is to break into a network and to steal valuable internal or third-party customer information that can be directly exploited or sold on black markets.

Moving Beyond Antivirus Software

Antivirus software is only one of several weapons that an organization needs to maintain in its cybersecurity arsenal. A complete cybersecurity system will include multiple components:

• A password manager. Too often, employees will default to weak passwords or the same password for multiple different website logins. These practices make it much easier for cybercriminals to guess or steal a password and to gain direct access to password-protected information. Password managers enable more robust password protection without requiring anyone to remember complex passwords or patterns.
• Two factor authentication. Organizations should implement a multi-layer login process to their networks that adds a second input step beyond just a user ID and a password. The minor inconvenience of an added step can prevent a major network breach.
• Data and mobile device encryption. Employees who prefer convenience over cybersecurity will share critical corporate information over public wifi networks, which makes that information an easy target for cyber thieves. Including encryption routines on all mobile devices will limit the availability of shared information only to the parties who are authorized to send and receive it.

Unfortunately for organizations that maintain and operate computer networks, there is no golden sword that will stop every malware threat. Much like the Hydra survives as a constellation in the night skies, computer viruses and malware will likely continue to live on in the cloud.

In view of this, every organization should adopt a thorough cybersecurity strategy that includes antivirus software and other tools and techniques. A cyberattack that overwhelms those tools and techniques can result in direct and third-party financial liability that can cripple even the most thriving business. To protect against those financial losses, every business should procure network security insurance that can provide a source of reimbursement for those losses. That insurance is the last line of defense against the multi-headed malware monster.