Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Rhymenoserous
May 23, 2008

Mustache Ride posted:

Netflix is dumping their AV: http://www.forbes.com/sites/thomasbrewster/2015/08/26/netflix-and-death-of-anti-virus/


And where Netflix goes the rest are soon to follow. Bye bye lovely AV!

Honestly as much as I hate AV, we're not there yet. But I eagerly await some C level exec at Netflix taking half the network down because he browsed the wrong porn site.

Adbot
ADBOT LOVES YOU

Rhymenoserous
May 23, 2008

OSI bean dip posted:

Not really. The big problem with SSDs is that internally they have their own software to manage the flash memory--IE: block off writes to specific places, et cetera. If the software stack is somehow infected, there is probably no real reliable way to fix it short of getting friendly with JTAG then praying that you don't brick your drive in the process.

For those of us who end up dealing with forensics, write blockers are sort of ineffective with SSDs because while the OS we're using cannot write to the drive, it doesn't mean that the drive isn't writing at all as the built-in software may be doing its usual maintenance.

SSDs are going to be interesting from a malware perspective as they become more popular.

For people like most of those that post in this subforum, until we can get viable action items from security vendors on theoretical SSD malware, it's all just farting in the wind however. SSD's in laptops are becoming pretty ubiquitous, and the best way to guard against data loss is to treat the laptop as a "Portal to work" rather than the place work itself happens.

If one of our managers dumped his laptop in the pond/got it infected with the nasties our net loss here would be the laptop itself. The data's all going on a network drive that gets snapshotted on a fairly consistent basis to the point where I can walk back to minutes before the infection while simultaneously flattening the laptop. Net loss of work is at most what was done between infection and flatten process (And even then you probably won't lose much).

I generally flatten any virus laden PC, nine times out of ten it will take far more effort for me to dig down and see what's going on and I don't have the resources. But I also recognize that I created an environment that is suited to this methodology and solutions like this are expensive, or can be at any rate.

EDIT: I do have to say I'm entertained whenever someone has a horror story about Crypto*, because in my environment that poo poo was the biggest damp squib ever. Flatten PC, roll back shares from immutable snapshot, take nap.

Rhymenoserous
May 23, 2008

Notorious R.I.M. posted:

I still don't get why we're nitpicking over whether a bunch of heuristic-based tools will happen to detect a rootkit when we can fix the problem by formatting and reloading from a recent backup. If this is any harder than running X, Y, Z, A, B, C, C# D, E, and F virus scanning tools that you use, maybe you should work on unfucking your / your client's awful IT structure instead of hoping that the 95% fix works 100 times in a row.

Yeah running 300+ cleaners sounds like a time sucking pain in the dick.

  • Locked thread