Menu
New Dell partnership throws doubt on traditional antivirus programs

New Dell partnership throws doubt on traditional antivirus programs

A Dell executive says most AV products aren't effectively stopping attacks

A partnership announced by Dell on Tuesday shows how cybersecurity defenses are evolving, which could have wide-ranging effects on vendors like Symantec, McAfee and Trend Micro.

The PC giant has partnered with Cylance, an Irvine, California-based company that specializes in detecting and blocking attacks on endpoint computers.

Early next year, Dell will wrap Cylance's Protect product in its Data Protection Endpoint Security Suite, said Brett Hansen, Dell's executive director of data security solutions. The suite is an integrated package with encryption capabilities, authentication features and malware detection.

Many antivirus programs still rely in part on systems that require identification of a piece of malware, which is then further identified by security products once a "signature" is pushed to a PC's security application.

But most security experts have agreed that signature-based detection is fairly ineffective these days since what is essentially the same malware can be changed to avoid detection.

Other technologies in antivirus suites can detect strange behavior and block malware, but often only after it has already infected a machine and done something bad.

"Our customers have been telling us the same thing: it is just not working," Hansen said.

Cylance doesn't use signatures. Instead, it uses an algorithm that analyzes seven million characteristics of files and programs and scores those elements on the likelihood of them being malicious, and can block them.

It's a lightweight agent that runs on a computer, and it only occasionally needs updating. Two or three times a year, Cylance send out an update to fine tune the algorithm. 

That also means Protect doesn't need a consistent network connection to work, which is also appealing to those frustrated by daily or even hourly downloads of new signatures.

Finding a satisfactory product took Dell security experts more than a year. There are a lot of new companies that are trying different approaches to stopping malware and advanced attacks, and Dell looked at products from more than 60, Hansen said.

Most were the same, using a combination of cloud computing, heuristics and behavioral analysis. They couldn't guarantee that a computer wouldn't get infected, but did say they could detect and remediate it, Hansen said.

That wasn't good enough, and Dell was looking for something that would prevent machines from getting infected in the first place. One of the common complaints from Dell customers is that they spend an inordinate amount of time answering helpdesk calls about infected computers.

Cylance's Protect was tested by Dell's SecureWorks, the company's crack security division. SecureWorks put about 200 samples of the most effective malware and exploits together on a USB stick and was impressed with how Protect handled it, Hansen said.

Dell used a signature-based antivirus product in the first version of Data Protection Endpoint Security Suite, which Hansen declined to name. The second version of the suite, which will be released early next year, will still have that kind of product, along with Cylance's.

But Hansen said he expects over time that as customers see how Protect works, they'll be "more than happy" to drop signature-based malware detection.

 

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

With New Zealand businesses now open to innovation, the industry sits on the cusp of significant disruption in the data centre. Driven by software-defined networking, the future of the data centre is fast becoming reality, as the channel seeks to keep up, keep innovating and keep growing. APC by Schneider Electric, Lenovo and key partners outlined how the channel can capitalise at The Grill restaurant in Auckland.

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​
Show Comments