partial from
http://ledin.cs.sonoma.edu/malware/pdf/ExtraordinaryFailureofAntiViru
sTechnology.pdf

The Extraordinary Failure of Anti-Virus Technology

Whitelisting Succeeds Where AV Has Fail

Anti-virus technology fails to prevent computers from virus
infections. And
because it fails, it inadvertently assists many security woes that
plague the
computer population.

Because viruses spread, hackers find it easier to compromise business
computers, identity theft is better enabled and computer fraud is
easier to
perpetrate. Virus-infected computers become an exploitable resource
for
hackers, who assemble and control networks of thousands of �zombie�
computers, which are used to mount �denial of service� attacks,
distribute
huge volumes of spam and distribute more viruses.
Statistics that demonstrate the ineffectiveness of AV technology are
regularly produced:
�
A recent Yankee Group report stated that 99% of companies had AV
technology installed, yet 62% of companies suffered successful virus
attacks.

� According to AusCERT, Australia�s Computer Emergency Response
Team, the two most popular and deployed AV products fail to prevent
80% of new viruses.

Virus writers test their new viruses against the more popular AV
products
before releasing them. And that is why AV technology is so
ineffective. AV
products have been trying for nearly 20 years to deal with the virus
threat
and have made very little progress. The AV technology vendors have
simply
taken the wrong approach. They have built �burglar alarms� that will
only
alert you if a known burglar tries to enter the house. The real
solution is to
have a �burglar alarm� that sounds when anyone you don�t know tries to
enter the house.

Fortunately, whitelisting technology has emerged in recent years.
Whitelisting technology takes a different approach to the malware
problem,
recording all valid programs and preventing others from executing.
Because
of this approach, it can be and is used to prevent other ills, such
as spyware,
adware, unlicensed software or any other kind of unauthorized
software.
Whitelisting can be applied to device control as well, which prevents
the
attaching of unauthorized devices to corporate PCs and laptop