I read GP's post to mean that if you take a step back, Windows' history of (in)security is what has led us to an environment where CrowdStrike is used / needed.
Also if you are a small business and are required to have cybersecurity liability insurance, the underwriter will require such sensors to be in place or you will get no policy.
People coming from Microsoft systems just expect it to be required, so there's demand for it (demand != need). And in hybrid environments it may remove a weak link: e.g. a Linux mailserver that serves mail to Windows users best has virus detection for windows viruses.
If your use case has a lesser need for antimalware you might still deploy CrowdStrike to achieve those ends. Which help to lessen reliance on antimalware as a singular defense (which of course it shouldn’t be).
Because they can also get malware or could use the extra control CS provides, and the "I'm not a significant target so I'm safe" is not really a solid defense? Bad quality protection (as exemplified by the present CS issues) isn't a justification for no protection at all.
Would you ignore the principle of least privilege (least user access) and walk around with all the keys to the kingdom just because you're savvier than most at detecting an attack and anyway you're only one person, what are the chances you're targeted? You're the Linux/MacOS of the user world, and "everyone knows those principles are only for the Windows equivalent of users".
There are serious threats to any Linux machine. And if you include Android, there are probably far more Linux machines out there. Hell, including their navigation, router, NAS, TV, and car, my 70+ yo mom runs at least 5 Linux machines at her home. It's a significant target. And Mac is quite obviously a neat target, if only because the demographic usually has higher income (hardly any Bangladeshi sweatshop worker will put down the cash to buy a MacBook or iphone. But might just own an Android or windows laptop)
I'm arguing that viruses aren't a threat, generally. Partly due to the architecture, partly due to their useage.
Any OS deployed on a user device needs some form of malware protection unless the device is blocked from doing anything interesting. You can generally forgo anti-malware on servers that are doing one thing that requires a smaller set of permissions (e.g., serving a website), but that's not because of the OS they are running.
You can’t run ClamAV on iPhone, can you?
Sure, “AVG Mobile Security” is available, but nobody needs it, and it isn’t anything like antivirus software on a computer. It provides... a photo vault, a VPN, and “identity protection.”
To tell people that they are vulnerable without something like this on their iPhone is ludicrous.
Nobody meeds antivirus software or malware protection like this on their iPhone, unless they like just giving money away.
Your mobile device is a Turing machine, and as such it is vulnerable to malware. However, the built-in protections are probably sufficient unless you have a specific reason to believe they are not.
The only AV software for mobile devices that I have seen used is bundled with corporate "endpoint management" features like a VPN, patch and policy management, and remote wipe support. It's for enterprise customers that provision phones for their employees.
> You can generally forgo anti-malware on servers that are doing one thing that requires a smaller set of permissions (e.g., serving a website), but that's not because of the OS they are running.
It seems to me like you’re trying to have it both ways.
It really is because of the OS that one doesn’t need to run anti-malware software on those servers and also on the iPhone, which you seem to have admitted.
The distinction I was trying to make is that the anti-malware strategy used by servers (restrict what the user can do, use formal change control processes, monitor performance trends and compare resource utilization against a baseline and expectations inferred from incoming work metrics) is different from the anti malware strategy used by "endpoints" (scanning binaries and running processes for suspicious patterns).
Remember NSO Group? Or the campaign Kaspersky exposed last year? Apple successfully made malware on iOS very rare unless you are targeted. But right now, it is impossible for these targeted people to get any kind of protection. Even forensics after being compromised is extremely difficult thanks to Apple's walled garden approach.
The usefulness of a theoretical app that might be able to stop high-power exploits isn’t being debated. The claim I’m objecting to is that everybody should be running (available) antivirus software on their phone.
But if you mean that these highly targeted people would have been helped by running “AVG Mobile Security” or one of the other available so-called “antivirus” apps, then I’ve got an enterprise security contract to sell you. :)
You're objecting to the (much more specific) claim that everybody should be running 3P antivirus software on their phone. Nobody made this claim. You are already running AV software on your phone, and whatever is built into the platform is more than sufficient for most users.
Why does it justify running antiviri on Linux is beyond my understanding.
Weak, impotent, speechless IT personnel that can not face off incompetence?
Shit like today is precisely why Apple kicked Mac developers out of kernel-space for the most part.
The amount of Windows centric IT that gets pushed to Linux/Mac is crazy. I’ve been in meeting where using Windows based file storage was discussed at a possibility for an HPC compute cluster (Linux). And they were being serious. This was in theory so that central IT could manage backups.
a) slowed down the performance of my machine to a crawl in a NodeJS project
b) had my laptop fans spinning at full blast 24/7, even waking up the laptop overnight to do it
It was purely for compliance, but I also got the impression that it was a bloated enterprise solution for the problem.
Fun fact: they’ve recommended we don’t install the latest kernel updates since they usually lag a bit with support. We’re running Ubuntu LTS, not some bleeding edge arch. It now supports using ebpf so it’s somewhat better.
Windows does have a history of insecurity, but it is no different from any other software in this regard. The environment would be the same in the absence of Windows.
Attacks are developed for Windows because attacks against Windows are more valuable -- they have a large number of potential targets -- not because they're easier to develop.