BLOG

Antivirus software is often overlooked in cybersecurity courses today because it has become so common a tool that it tends to fall down the list of important topics to discuss in the classroom. Windows comes pre-bundled with Microsoft Defender, which was not significantly capable in its early iterations, but has now become a top-tier option for users and easily beats out many of the well-known antivirus vendors year after year. So, for the average user utilizing a modern version of Windows, one is already well protected without installing any additional applications. This is likely the main reason antivirus tends to be overlooked by professors, apart from a cursory reminder to keep it running on all systems. But there are other antivirus elements a professor should discuss in the classroom because cybersecurity students need to understand how vendors analyze malicious applications and develop signatures that hopefully catch all forms of malware in the wild. 

During my days in cybersecurity investigation, our organization regularly sent copies of malware caught in the wild to the major antivirus vendors so they could quickly develop new signatures. This greatly benefited our operations by ensuring up-to-date protection against the latest attempts of hackers, and it also provided a secondary benefit to anyone else in the world who used those particular antivirus applications. It is valuable for students to understand the process by which antivirus vendors produce signatures because professional cybersecurity defenders can insert themselves into the loop and provide vendors with valuable information about newly discovered viruses. This shortens the development loop considerably. With this in mind, there are three areas professors should cover on the antivirus signature development process. First, we should teach our students about the components of an antivirus signature and how those components identify malware on a computer. Second, we should be teaching about the process of determining what information to include in an antivirus signature. And third, we should inform students about actions to take when malware is discovered and how to handle false positives. 

How Antivirus Signatures Detect Malware 

A typical antivirus signature contains a small amount of data that is common in a particular virus or piece of malware. This can be a distinctive string pattern, the location of that pattern, and sometimes a cryptographic hash of the malicious file if the malware is something that never changes. The antivirus application uses this information when monitoring system activity or running a scan of all files. It is essentially looking for a match to what is included in the signature, and if a match is found, the application takes action by moving the file to quarantine and notifying the user. A cybersecurity student should understand this level of detail because it is possible to create custom signatures, to varying degrees, within some antivirus applications. Professors should show that this gives defenders a greater granularity of detection if their systems are commonly targeted by a specific type of malware that is less common in the wild. It is also valuable to understand this if one wants to send new virus information to vendors to include in their next round of signature updates.  

Teaching Students How Antivirus Signatures Are Created 

Once students understand what goes into an antivirus signature, they should then be taught about the common methods used to locate distinctive elements of malware to include in the signatures. The process typically involves loading the malware into software capable of disassembling and debugging programs, examining line by line to determine what the malware accomplishes, and looking for unique strings of text that can be used to easily identify the malware in the future. A signature can then be built around that string of text so antivirus programs can look for it in files and applications on individual computers. Professors do not need to go into great detail in this section, as learning to disassemble programs is a specific skill most cybersecurity students learn later in their careers. But it is valuable to have a basic understanding of the process so that students are aware of the level of detail involved in antivirus detection. 

Responding to Malware Detections and False Positives 

The third thing professors should be teaching about antivirus is what actions to take when malware is discovered and how to handle false positives. Typically, a file containing a real virus is sent to quarantine by the antivirus application, and administrators can conduct a quick review and then delete those files. In some cases, it is also necessary to look at system backups to find out if the backup file is also infected, and if not, to restore a clean version of the file back to the system. A second level of research a student should learn to conduct is to determine when the file became infected and how it arrived on the system. One should not simply delete the suspect file and forget about it. We need to know if there is a larger problem that allowed the virus to infiltrate a system. Cybersecurity professionals should also take the action of running a full system scan whenever a virus is identified to ensure other viruses are not hiding elsewhere. The final piece in this section is that students should know that sometimes antivirus makes mistakes and files are actually legitimate. Determining this often requires deeper investigation and special exceptions within the software to prevent it from reoccurring.  

Bringing Antivirus Instruction Back Into the Cybersecurity Classroom 

Antivirus applications have become quite adept at locating and eradicating malware. They were marginally effective 20-years ago, but today’s version is significantly better. Even Microsoft Defender, which was known to be subpar in its infancy, is now considered one of the best antivirus applications on the market, and it is free for anyone operating a modern version of Windows. The challenge is that antivirus has become so common on computers that it is often overlooked or glossed over in the classroom. This should not be the case. Students should be aware of its capabilities and understand how to navigate the administrative functions of these tools to conduct small investigations when viruses pop up. This is a layer of defense-in-depth we cannot afford to lose.