Time to change from Eset?

[MrBaker89]

Morning everyone! 

 

At my work place we currently use Eset av, I've built 3 new computers for members of staff using Ryzen and had nothing but issues with Eset causing BSOD crashes, removed Eset and no more crashes. 

 

Can anyone recommend a good security program that doesn't cause system slow downs etc and doesn't bug the user all the time. 

 

TIA

[Dat Guy]

Stop misusing software for security. All "security software" is a potential security risk for your computer, especially as it can contain even more security holes and it usually runs with full system access. Keep your software up-to-date and don't click on everything that looks like a link: Done.

 

If you absolutely refuse to trust yourself and prefer to go the risky way for whatever reason: The Windows Defender is more than good enough.

[Kilrah]

He's building computers for end users in a work environment. Those cannot be trusted.

[Dat Guy]

Windows supports group policies for this very reason.

[MrBaker89]

Just now, Dat Guy said:

Windows supports group policies for this very reason.

We have the group policies set that we want set.

 

What's wrong with having an extra level of security? 

[Dat Guy]

"Security" software removes one layer of security by increasing the potential attack surface. That's why the Windows Defender is probably the least evil thing to recommend: It's on your system anyway.

[MrBaker89]

Just now, Dat Guy said:

"Security" software removes one layer of security by increasing the potential attack surface. That's why the Windows Defender is probably the least evil thing to recommend: It's on your system anyway.

Can you link some proof that using 3rd party security software actually causes more security risks?

[191x7]

28 minutes ago, MrBaker89 said:

Morning everyone! 

 

At my work place we currently use Eset av, I've built 3 new computers for members of staff using Ryzen and had nothing but issues with Eset causing BSOD crashes, removed Eset and no more crashes. 

 

Can anyone recommend a good security program that doesn't cause system slow downs etc and doesn't bug the user all the time. 

 

TIA

For corporate users I always recommend Kaspersky. Eventually Bitdefender or F-secure.

[Dat Guy]

3 minutes ago, MrBaker89 said:

Can you link some proof that using 3rd party security software actually causes more security risks?

1. https://service.mcafee.com/webcenter/portal/oracle/webcenter/page/scopedMD/s55728c97_466d_4ddb_952d_05484ea932c6/Page29.jspx?showFooter=false&locale=en-US&articleId=TS103008&leftWidth=0%&showHeader=false&wc.contextURL=%2Fspaces%2Fcp&rightWidth=0%&centerWidth=100%&_adf.ctrl-state=l5p9dmgak_70&_afrLoop=1496582363055657
2. https://www.zdnet.com/article/trend-micro-antivirus-zero-day-used-in-mitsubishi-electric-hack/
3. https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191112-asa-ftd-lua-rce
4. https://securityaffairs.co/wordpress/92818/hacking/trend-micro-anti-threat-toolkit-flaw.html
5. https://www.bleepingcomputer.com/news/security/hackers-breach-avast-antivirus-network-through-insecure-vpn-profile/
6. https://knowledge.broadcom.com/external/article?legacyId=TECH256643
7. https://www.heise.de/ct/artikel/Kasper-Spy-Kaspersky-Anti-Virus-puts-users-at-risk-4496138.html
8. https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil
9. https://kc.mcafee.com/corporate/index?page=content&id=SB10284
10. https://bugzilla.mozilla.org/show_bug.cgi?id=1558765

How much do you need?

[Neftex]

26 minutes ago, Dat Guy said:

Stop misusing software for security. All "security software" is a potential security risk for your computer, especially as it can contain even more security holes and it usually runs with full system access. Keep your software up-to-date and don't click on everything that looks like a link: Done.

 

If you absolutely refuse to trust yourself and prefer to go the risky way for whatever reason: The Windows Defender is more than good enough.

ok buddy, for one zeroday it brings it could halt 3 others that defender doesnt catch.

 

and correct me if im wrong, defender doesnt update definitions nearly as often and if you pause updates to avoid getting some broken MS update youre even more screwed.

[Dat Guy]

2 minutes ago, Neftex said:

ok buddy

I am not your buddy.

 

2 minutes ago, Neftex said:

for one zeroday it brings it could halt 3 others that defender doesnt catch.

This is why "security" software can never be a replacement for a good security concept.

 

3 minutes ago, Neftex said:

defender doesnt update definitions nearly as often

Definitions don't catch security bugs. All they can do is detect non-polymorphic malware - much later than it appears, anyway. The only way to detect that is behavior detection (and a "virus scanner" is the completely wrong tool for that).

 

4 minutes ago, Neftex said:

if you pause updates

Don't.

[Neftex]

10 minutes ago, Dat Guy said:

I am not your buddy.

 

This is why "security" software can never be a replacement for a good security concept.

 

Definitions don't catch security bugs. All they can do is detect non-polymorphic malware - much later than it appears, anyway. The only way to detect that is behavior detection (and a "virus scanner" is the completely wrong tool for that).

 

Don't.

1) idc

2) were not asking for replacement

3) defender can have bugs too and has worse detections on top of it, so i dont understand why recommend it over 3rd party.

lets go with a general scenario:

you get an email from colleague with infected attachment, you opened it - i think youd rather have the sw with the updated definition

4) ye better brick my OS install because MS cant push proper updates??

[Dat Guy]

Just now, Neftex said:

idc

I can only ask you to stop.

 

1 minute ago, Neftex said:

defender can have bugs too

Yup, which is why it would be the last resort - still less horrible than any other "security software", but not recommended either.

 

1 minute ago, Neftex said:

and has worse detections on top of it

Show me the numbers.

 

2 minutes ago, Neftex said:

i dont understand why recommend it over 3rd party.

Because it doesn't add additional security issues because all of its components are already on your system.

 

2 minutes ago, Neftex said:

ye better brick my OS install because MS cant push proper updates??

Stop trying to establish FUD. Windows updates rarely "brick" anything. (I never had one in 24 years of using Windows.)

3rd-party "security" software can "brick" your Windows though, as linked above.

[Neftex]

28 minutes ago, Dat Guy said:

Show me the numbers.

https://www.av-comparatives.org/tests/real-world-protection-test-july-october-2019/

highest amount of false positives+user dependent infection isnt really the best combination is it. the more it bothers you about actually safe stuff the less likely you are to believe when real shit is about to hit you. on the other hand you have avira and symantec, thats a big difference imo.

31 minutes ago, Dat Guy said:

Because it doesn't add additional security issues because all of its components are already on your system.

correct me if im wrong, installing 3rd party solution disables defender so theoretically also prevents attack from using its vulnerability. and if we assume attackers want their attacks to work on the biggest chunk of users, it could potentially completely save you

35 minutes ago, Dat Guy said:

Stop trying to establish FUD. Windows updates rarely "brick" anything. (I never had one in 24 years of using Windows.)

3rd-party "security" software can "brick" your Windows though, as linked above.

if youre actually trying to deny all the broken updates MS released to public, i think were done here. just google windows broken updates, sure some could be reverted but some could not and im not gonna be the guinea pig for that

[Dat Guy]

Just now, Neftex said:

installing 3rd party solution disables defender

Not necessarily, but (mostly) yes. Note that it does not remove the Defender's components though.

But how does that mitigate the fact that 3rd party "solutions" tend to drill holes into your Windows security as described above?

 

2 minutes ago, Neftex said:

if youre actually trying to deny all the broken updates MS released to public

Please try to read and understand basic English before making accusations. I did not "deny" them. I denied that they're relevant for most people. I, personally, never had a problem. That's all I said.

[Neftex]

2 minutes ago, Dat Guy said:

Not necessarily, but (mostly) yes. Note that it does not remove the Defender's components though.

But how does that mitigate the fact that 3rd party "solutions" tend to drill holes into your Windows security as described above?

it replaces one security solution for another. are you such an expert to find an actual reason why that solution can not be better/equivalent to the original? (you dont need to answer that because we both know, we dont have the details of implementation)

 

2 minutes ago, Dat Guy said:

Please try to read and understand basic English before making accusations. I did not "deny" them. I denied that they're relevant for most people. I, personally, never had a problem. That's all I said.

you called it fud, i call it reasonable expectation at this point

do what you want with your updates, im just not a fan of MS philosophy of making the consumer into a tester