Antivirus is 'completely wasted money': Cisco CSO


Recommended Posts

ZDNet Australia

Companies are wasting money on security processes ? such as applying patches and using antivirus software ? which just don't work, according to Cisco's chief security officer John Stewart.

Speaking at the AusCERT 2008 conference in the Gold Coast yesterday, Stewart said the malware industry is moving faster than the security industry, making it impossible for users to remain secure.

"If patching and antivirus is where I spend my money, and I'm still getting infected and I still have to clean up computers and I still need to reload them and still have to recover the user's data and I still have to reinstall it, the entire cost equation of that is a waste.

"It's completely wasted money," Stewart told delegates.

He said infections have become so common that most companies have learned to live with them.

/snip

I must agree to an extent.

It would be much more beneficial for companies to invest in something like DeepFreeze.

I think the best approach to these threats is hybrid solution. No one solution is 100% effective.

However, saying that Antivirus is a waste of money is a very brave and IMHO plain silly thing to say.

He's got a point, but saying it's a waste of money is stupid. I can agree that when a PC is infected, it is in most cases best to reinstall it. But antivirus programs also have an importan proactive role. It stops most viruses from infecting and spreading to other corporate computers etc.

i had a virus on my home laptop a little while back.. it somehow managed to get past norton 2008 with all the updates... i contacted norton and they told me i'd have to pay ?70for them to get rid of it...... i told them where to stuff it and just formatted lol...

its bad that because their system which is meant to prevent viruses failed, that they wanted to charge me so much money!

I have to disagree with the statement, although the context in with which it is made, is certainly true.

If i was spending money on Anti-Virus products and still getting infected then yes that would constitute a waste of money, but at the same time, how many issues has that Anti-Virus product protected against.

You have to ask yourself how the machines are being compromised, is it thorugh Malware installing from websites, is it because of an Operating System vulnerability.

Both of these can be countered, using Proxy Servers to filter out those websites that are known to host malicious code, and educate employees on a secure computing policy, secondly ensure that the operating system has the lastest security patches applied to it.

Of course no process is 100% secure, all we can ever do in this game, is to apply best practice and hope for the best.

LOL That's why I use ClamWin on Windows... That way I don't need to pay for virus scanners... As for other malware, I don't do anything that would cause me to get spyware, adware and such. I'm wary of JS, VBS and BAT files in Windows as well as readme HTML files containing JS, so I don't need to worry about those threats because I can dig through things to be sure that it is 100% safe. In fact, the only reason I have a virus scanner is because I use Frostwire from time to time. Otherwise, I don't have issues with torrenting Linux distros, and therefore I have no real need for a virus scanner.

Norton doesn't count as an AV.

Not in my opinion. There are far superior free Programs such as Avast, and AVG. A friend of mine has never used a AV program and he has never been infected. I just use Avast with the Standard Shield only.

:D Neither should McAfee. It's more like malware the way it takes up CPU cycles and resources.

IMHO It's (1)Avast (2)Kaspersky (3)NOD32.

I agree with that first part of your post, but that second part is flatout absurd!

Sould be (1)Kaspersky, (2)NOD32, (3) Avast

Said by Gary7

"Not in my opinion. There are far superior free Programs such as Avast, and AVG. A friend of mine has never used a AV program and he has never been infected. I just use Avast with the Standard Shield only."

How would your friend know if he's ever been infected or not, if he's never used an AV? Those kind of statements are also flat out absurd!

That it's still possible for viruses to corrupt your system doesn't mean that antivirus products are a waste of money, just as how locking the doors of your home won't prevent all robbery attempts but that doesn't mean locking the doors is a waste of time. It truly wouldn't surprise me if John Stewart lost his job because of his patently stupid remark.

Vista is so secure you won't even need to worry about security as Vista protects you well if you LET it and not change silly system settings.

I have not even installed an AV on permanent time since I see them as waste of time and money. I know I am not infected because I install an AV from time to time to check for viruses. At the moment I am setting up a USB stick system maintenance software that will check for viruses as well as cleaning up junk.

Avast is bad. Even though my friend had it installed he still got infected with a virii. When he switched to AVG, he found two worms and a trojan.

And the exact opposite can and has happened for other people. No AV will catch everything and this applies even more so to free solutions. You get what you pay for.

I've always seen people be infected no matter what AV program they are using, most of the time it comes down to user stupidity. I currently don't use an av program but scan online monthly and I have not had a virus in years.

@ Sharad I've never had a very good experience with AVG on many computers I have used it on it generally doesn't seem to detect nearly as much as Avast! and Avira do, and it gets false positives far too often for my liking. I definitely agree with VRam, no program catches everything, I always have to use a combination of programs or look for manual fixes or specialized programs when I have to clean someones infected computer (And they almost always have an active av running)

Edited by ViperAFK

I will agree partially with the idea that most antivirus programs are a waste of money (I go for the free ones, which can be just as effective), however, claiming that installing patches is ineffective is downright idiotic.

OTOH I'm utterly unimpressed with the state of all antivirus programs. Most of 'em these days are just a tad too paranoid, flagging completely inoffensive items as malware.

I agree with that first part of your post, but that second part is flatout absurd!

Sould be (1)Kaspersky, (2)NOD32, (3) Avast

Said by Gary7

"Not in my opinion. There are far superior free Programs such as Avast, and AVG. A friend of mine has never used a AV program and he has never been infected. I just use Avast with the Standard Shield only."

How would your friend know if he's ever been infected or not, if he's never used an AV? Those kind of statements are also flat out absurd!

No they are not absurd. I guess you have never heard of on-line scanning. Check it out most AV companies have one. That is how he would know!

Well, he is right about the Anti-virus industry not being able to keep up, since Viruses constantly appear, change and evolve.

The problem with his statement is, tons of people don't get infected with the latest and best virus attacks out there, but they pick up all the

trash littering the Internet. You have all these dodgy sites with tons of spyware/malware, you have dodgy files from P2P Software and and whatnot.

All this trash can still effective ruin your Computer and make you waste a lot of time trying to salvage everything, so I still believe a decent Virus scanner is a must to have.

Just too bad so many people tend to use these free alternatives which usually doesn't even find half of what a quality brand would - So they are lured into a false sense of security. The same with On-line scanners, they are pretty much useless in my book, since the most important aspect of Anti-Virus is the proactive defence - Stopping the virus before it enters your PC. As soon as a Virus or Infection has hit your PC, it usually takes a lot more than a simple Virus scan to remove it effectively.

I remember one of my friends always touted what a safe surfer he was, how he never have had a virus. We tried a few On-line scanners which found nothing, totally clean. So I installed a Trial version of NOD32 and it actually found 4 infections, where he was only able to get rid of 3 - We also found out, one of his frequently visited websites had a virus embedded in some flash ad, which he would never really know about if the software hadn't told him.

So he decided to reinstall Windows and start to use Anti-Virus software.

With a bit of knowledge and a decent Anti-virus, It's not wasted money, it can actually save you some time and worry.

Whilst he does have a point, it is a bold claim to make.

You have to think of where does most malware come from. It's from people accepting every single activex control they see, opening every file/running every executable they can get their hands on etc. Yep, people's stupidity. Don't do that, and there is a much much smaller chance you will get malware. Sure it doesn't mean you won't get any, just means the chances of you getting one is a lot less.

Programs like DeepFreeze help a lot too, though can be a pain sometimes but then thats the price of security nowdays.

One word: Linux

Too many companies use Windows for no good reason and it's sad that they don't have better advisers.

I love Linux as much as the next guy... Ok... Perhaps a bit more than the next guy. ;)

But to say that many companies use Windows for "no good reason" overlooks the darn "legacy apps" issue. Some apps (even obscure ones) require Windows to run (not Linux/wine).

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • WhatsApp is getting usernames, and you can reserve your preferred one now by Fiza Ali Sharing your phone number isn't always something you want to do, especially with people you've just met. Whether it's someone from a class, a local community group, or a sports team chat, handing over your number can feel like giving away more personal information than necessary. That's exactly the problem WhatsApp is trying to solve with its upcoming usernames feature. The company has announced that users can now reserve a unique WhatsApp username ahead of the feature's wider rollout later this year. Once usernames become available, they'll let people connect without revealing their phone numbers. It's a change that makes a lot of sense for group chats. Right now, everyone in the group can see your phone number. With usernames enabled, that won't necessarily be the case when someone contacts you for the first time. WhatsApp says it's opening username reservations early because more than three billion people use the app, meaning plenty of people are likely to want the same usernames. Reserving one now gives users a better chance of securing the name they actually want before the feature launches more broadly. If your preferred username is already taken, WhatsApp will also offer a built-in username generator to suggest available alternatives. The feature isn't only aimed at individual users. Creators, businesses, and organisations will be able to claim the same username they already use on Instagram or Facebook, making it easier to keep a consistent identity across Meta's apps. Furthermore, privacy is a big part of how WhatsApp is introducing usernames. There won't be a public directory where people can browse or search for usernames. Instead, people will need to know your exact username before they can start a conversation with you. Additionally, users can also choose to enable a username key, which adds another layer of control by requiring people to enter that key before sending a message. Once the feature rolls out, people who choose to use a username will no longer have their phone number shown when messaging a person or business for the first time. If you want to reserve a username, make sure you're running the latest version of WhatsApp, then head to Settings > Account > Username. The tech giant says usernames will roll out gradually over the coming months, and users will receive an in-app notification when the feature becomes available in their country.
    • When I think about a network, there are really two aspects, the hardware and the wiring. So here is what I would do for both. Wiring: Use Cat6A for the patch panel, outlets, and all structured cables (cables installed in walls). Run plenty of Wireless Access Point (WAP) cables, as a general rule, assume a signal can only pass through 2-3 walls and can't pass through a floor (that is conservative, but trust me on this if you want strong WiFi)  Cat6 patch cables are fine for now if you don't plan to run 10gig, those are easy to replace later if needed. Run OS2 single-mode fiber to anywhere you think you may have a server or sub-switch. (yes, single-mode for everything on a small network, don't mess with multimode unless you have entire racks of servers and that minor module cost and power savings will matter). If you really want to future proof, also run fiber to any high density WAP locations, it is likely that WiFi 8 WAPs will push the limits of 10g. Run 6-12 pairs of single-mode fiber between your MDF and the building's MDF, even if you only need 1 or 2 pairs now, those extra pairs will pay off down the road. Hardware: (its easy to say "get all the features incase you need them", so instead of futureproofing, I am going to take approach of suggesting areas worth investing in, and areas you can save money). Don't overspend thinking you need every feature on every port. You don't need 10g on every port, you don't need PoE on every port. Don't overspend on redundancy either, unless you are ready to buy two of everything, don't waste money buying two of some things and not others. Dual power supplies are worthwhile, but probably not HA or multi-path redundancy.  Get 1 "distribution layer" switch that your router/firewall will connect to as well as all your access layer switches below. This should be a 10g switch with a combination of copper and SPF ports and should be a fully managed switch. Given that you said it is a small network, I suggest also using that distribution layer switch for servers and WAPs, meaning it will need PoE. Speaking of wireless, get good professional tri-band WAPs, and either turn on the band stirring options, or limit 2.4 to an IoT only SSID. This will provide a solid WiFi capable nearly everything but the highest of bandwidth clients...you could even consider skipping wiring workstations depending on usage. Access layer switch for workstations and printers can be cheaper switches, 2.5g is a good sweet spot between price and future proofing, but even 1g is fine for most individual clients (the kind that could probably be fine on WiFi). You can consider saving a little on access layer switches by only getting 1 PoE switch for whatever needs it (remember your WAPs are connecting to the distribution switch, not here), and non-PoE for your workstations, because desk phones are falling out of favor. You can also save money here by not buying managed switches if you don't need them--but really do some soul searching there, if you go this route, then anything that isn't on your workstation VLAN would either need to be connected to the distribution switch, or its own switch. Also, don't feel like you need a fancy fabric stacking switches for your access layer, that is the point of the higher-end distribution layer, to remove the need for things like that at this level. Home Hardware: I'm realizing the above assumed an office setting, if this if for your house and home lab then the above still applies, but you'll probably want everything managed and PoE, just because, but you probably also don't need multiple access layer switches. if your total port count is below 24, just skip separating distribution layer and access layer and just get one nice switch with the features you want. For home use, don't worry about home running every device to the main switch, there is nothing wrong with running sub-switches for your media areas and office, those essentially become your access layer, just look for sub-switches with a 10g uplink so sharing bandwidth isn't an issue.
    • Google Meet brings Gemini note-taking to AI Pro and Ultra subscribers by Karthik Mudaliar Google's Gemini-powered "Take notes for me" feature inside Google Meet is now available to Google AI Pro and Ultra subscribers. The features work on Google Meet for web as well as on mobile, and Google says that subscribers can use it for meetings they host in many supported languages. As the name suggests, "Take notes for me" allows Gemini to listen to a meeting, generate a summary, identify action items, and save the notes as a Google Doc in the user’s Drive. After the meeting, the organizer receives an email recap with the summary and action items, while the notes can also be attached to the related Calendar event depending on the meeting setup and sharing settings. The feature isn't automatically turned on for everyone, though. Google says that all meeting participants are notified when note-taking is turned on, and users can start it from the pencil icon in Meet or enable it for future calls through Meet’s meeting records settings. For work or school accounts, administrators can also control whether the feature is available and may require explicit participant consent for note-taking, recording, or transcription features. The feature first launched back in 2024, when it was available just for selected Workspace users. Over the years, Google added refinements and more options, including the ability to enable it when scheduling meetings via Google Calendar. Google's support docs say that the feature currently supports English, French, German, Italian, Japanese, Korean, Portuguese, and Spanish, but only one language at a time. Meetings with multiple spoken languages are not currently supported, and Google recommends using the tool for meetings between 15 minutes and eight hours. The new feature makes Google Meet closer to its rivals that have AI tools already built in. Microsoft Teams has recently started offering Copilot and intelligent recap features that summarize meetings, surface highlights, and help with follow-ups, while Zoom’s AI Companion can also generate meeting summaries from desktop and mobile meetings.
    • GnuCash 5.16 by Razvan Serea GnuCash is a personal and small business finance application, freely licensed under the GNU GPL and available for GNU/Linux, BSD, Solaris, Mac OS X and Microsoft Windows. It’s designed to be easy to use, yet powerful and flexible. GnuCash allows you to track your income and expenses, reconcile bank accounts, monitor stock portfolios and manage your small business finances. It is based on professional accounting principles to ensure balanced books and accurate reports. GnuCash can keep track of your personal finances in as much detail as you prefer. If you are just starting out, use GnuCash to keep track of your checkbook. You may then decide to track cash as well as credit card purchases to better determine where your money is being spent. When you start investing, you can use GnuCash to help monitor your portfolio. Buying a vehicle or a home? GnuCash will help you plan the investment and track loan payments. If your financial records span the globe, GnuCash provides all the multiple-currency support you need. Between 5.15 and 5.16, the following bugfixes were accomplished: Bug 421610 - RFE: Include logical dates for View->Filter by "date range"The Select Range section of the Date tab of the register's Filter By dialog box is changed to provide relative, specific date, or days ago options for the start and end of the filter range. The Show number of days item label is changed to Show from days ago to better reflect what it does. Bug 436105 - esc key not working as expected in register: Enable the escape key to cancel a field edit. Bug 797384 - Gnucash doesn't handle commodity prices with big numerator/denominator properly. Bug 798004 - Next gen UI for stock transactions Bug 799314 - Add "enter now" option in scheduled transaction editor. tab to allow users to select the scheduled transactions to be included in a “Since Last Run…” window. If there are no instances of a selected transaction triggered by today’s date, the next instance is triggered. Bug 799751 - autocomplete crash Bug 799759 - Users can't Enable entries via Checkboxes on Scheduled Transactions PageAllow the Enabled box in the list of scheduled transactions to be operated instead of having to open the transaction editor dialog and change the Enabled checkbox. Also added use of the Name column as the secondary column sort for all the other columns. Bug 799762 - Poor handling of cases where hidden/placeholder accounts are used in the account register Bug 799766 - Double line preference not respected in search register Bug 799767 - POST /accounts in bindings/python/example_scripts/rest-api is broken Bug 799777 - `xaccSplitSetParent`: reparenting a committed split silently drops its KVP slots (online_id, cap-gains links) Other changes & improvements: Numeric values may now be selected to copy in the Accounts page. Add new Finance::Quote source Finnhub.io: Free API key (personal/non-professional use) available at https://finnhub.io. Set FINNHUB_API_KEY environment variable to API key to use this source. As of June 2026, free tier API limit is 60 API calls/minute. The Investment Lots report has new optional columns for Computed Annual Growth Rate. Python Bindings: Improved translation of primary object (Account, Transaction, Split, etc.) so that they can be treated as normal Python objects. This is accomplished with SWIG magic so no existing code is obsoleted. Python Bindings: Better conversion of GLists to Python lists. Python Bindings: Destroy the QofSession in the Python Session dtor to prevent leaving the database locked. [engine] Add first-class online_id accessors for Split and Account and make them available to Python bindings, removing the unused Transaction online_id property. Improve C++ implementation of QofBook. Correct the Doxygen doc for qof_instance_get/set_kvp. [gnc-log-replay.cpp] fix incorrect guid dump Add some Boost library requirements needed by libgnucash-guile to CMakeLists.txt so that missing feature will fail at configure time. Use Compile-time Regular Expressions instead of std::regex in gnc-filepath-utils.cpp and instead of boost::regex in the CSV importer, with the CTRE v3.11.1 header added to borrowed [gnc-filepath-utils.cpp] null check char* arguments Add ChartJS licenses. Removed AEX from list of commodities. euronext.com is now using JS based anti-webscraping. [report-core] always offer options summary in reports. This is useful to debug reports. The Add options summary option is removed because it's no longer optional. Remove remaining obsolete IMContext from sheet Fix blurry text in HiDPI offscreen-rendered widgets Add port field to database connection dialog: The convention of appending the port number after the host isn't obvious. When editing a split in the register treat the account as being changed only if it isn't the one selected before editing instead of if the user performed an edit Return immediately from qof_book_destroy if hash_of_collections is null. If qof_book_destroy is called on a QofBook* freshly created with qof_book_new (usually because it was used to create a session that now must be destroyed) it would try to empty the non-existent hash tables, crashing. Clean up Flathub metadata to solve warnings at flatpak build time. Be consistent in naming GncPluginPage and GncPluginPageRegister HTML: Remove unimplemented function declarations. [gnc-html.cpp] remove unused buggy string conversion functions Convert libgnc-html to C++ Apply -Wall -Werr -Wmissing-prototypes to C++ compilation on Windows and fix the resulting errors. New and Updated Translations: Arabic, Croatian, Danish, Dutch, German, Finnish, Hungarian, Korean, Norwegian-Bokmal, Spanish Download: GnuCash 5.16 | 176.0 MB (Open Source) Links: GnuCash Home page | Other Operating Systems | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Microsoft finally launches WSL Containers in public preview by David Uzondu Microsoft has announced that WSL containers, a feature that allows developers to run Linux containers natively inside Windows without the need for Docker Desktop, is now available in public preview several weeks after Microsoft previewed it at Build 2026. To use the new container feature, you first have to install the latest pre-release version of the Windows Subsystem for Linux by running a quick update command in your terminal: wsl --update --pre-release After installing, you'd get access to the new Linux container CLI (wslc.exe) and the programmable API. Microsoft said that the CLI has a "familiar format" that matches the toolsets developers already use every day. If you know standard Docker commands, your muscle memory will translate directly to wslc.exe, which even features a built-in alias called container.exe. You can quickly run a full Ubuntu KDE desktop container by exposing ports, or pass your graphics card straight into a machine learning environment to run PyTorch workloads. Passing the --gpus all flag inside the run command instantly links your hardware. Image via Microsoft As for the API, developers can now embed Linux container operations directly inside native Windows applications without exposing the command line to users. The team integrated the API directly into MSBuild and CMake, so developers can define container steps directly in project files. Apart from bringing the CLI and API into public preview, Microsoft also said that it's working on a new default file system called virtiofs to speed up file transfer rates between Windows and Linux. Microsoft also introduced an experimental networking mode named consomme, which resolves compatibility issues with corporate VPNs by routing Linux network traffic straight through Windows. One thing to note about WSL containers is that they don't run in your standard WSL distributions; instead, every application and CLI session spawns its own lightweight Hyper-V utility VM in the background. This basically reduces the chances of one app snooping on the container of another app.
  • Recent Achievements

    • Reacting Well
      NovaEdgeX earned a badge
      Reacting Well
    • Week One Done
      NovaEdgeX earned a badge
      Week One Done
    • One Year In
      BA the Curmudgeon earned a badge
      One Year In
    • Conversation Starter
      rosiecharles earned a badge
      Conversation Starter
    • First Post
      KMilenkoski1202 earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      533
    2. 2
      +Edouard
      269
    3. 3
      PsYcHoKiLLa
      150
    4. 4
      Steven P.
      98
    5. 5
      macoman
      66
  • Tell a friend

    Love Neowin? Tell a friend!