Welcome!

@CloudExpo Authors: Pat Romanski, Elizabeth White, Yeshim Deniz, Zakia Bouachraoui, Liz McMillan

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Blog Post

Why Cloud Anti-Virus Engines Are Critical in the Fight Against Malware | @CloudExpo #Cloud

Anti-virus on cloud: how this migration is changing the way computer security works

The next few years could see a paradigm shift in the way anti-virus applications work. A number of businesses have migrated from traditional desktop based anti-virus packages to "lighter" software apps that process desktop security from the cloud. At the outset, this change is not entirely apparent - end users will still need to install software on their local desktop systems. However, the processing of information is now getting ported to the cloud.

What exactly is driving this change? There are primarily two reasons to this. Firstly, internet connectivity is getting faster and more ubiquitous, at least in the west. Secondly, the number of new malware is on the rise. According to a recent report from Symantec, nearly one million new malware threats get released every single day. This means that in the time it took you to read this paragraph, at least a hundred new threats were released.

Anti-virus applications typically work by scanning files on your computer and benchmarking them against "virus definitions" that are stored in their database. This directory of virus definitions is periodically updated in order for the program to effectively block every new threat on the horizon. But with billions of threats released every year, it is simply not possible to house all of these definitions on your local desktop computer. Not only does this require a lot of hardware resources, but it also consumes a lot of processor power. This clearly has a massive impact on a user's experience.

At the same time, advances in distributed computer network systems in the past few years have made it possible for big data processes to be carried out efficiently through the cloud. Thus, a cloud antivirus program is an intelligent way to counter the challenges in local desktop-based software with an alternative that can be processed faster over the cloud.

How does this work? Despite the term, cloud antivirus systems will still require the user to install a local application on their computer to protect from various threats that come in the form of file attachments, browser plug-ins, and extensions. However, instead of updating the virus definitions on your local desktop periodically, this software application will instead only host a smaller cache of the most common virus threats.

This serves as a contingency alternative when the anti-virus software cannot reach out to the cloud for processing. Since the main application is hosted on the cloud, it is possible for the system to be continually updated with the latest definitions in real-time. There is little scope for a malware to get through when it is evaluated with a database of threats updated to the minute.

The cloud anti-virus is not without its share of challenges though. One of the most important concerns is with regards to the effectiveness of the process. Traditional antivirus engines evaluate a suspect file over multiple layers like entry vector, file system and execution. In each of these layers, the file is scanned by multiple systems concerning the anti-virus signature, rules, heuristics, etc. However such detailed analysis, albeit redundant, may not be possible with cloud antivirus engines due to bandwidth constraints. A lot of the present day cloud antivirus engines compare the metadata of the files with those in their virus dictionary to identify potential threats. While they may still be as effective, it remains to be seen if they can continue to perform as well as desktop antivirus software.

The next decade will see enormous changes not just in the way antivirus applications work, but also in the way threats arrive. While a cloud-based system is definitely the future, any chinks in the armor need to be repaired before it is too late. What are your thoughts?

More Stories By Harry Trott

Harry Trott is an IT consultant from Perth, WA. He is currently working on a long term project in Bangalore, India. Harry has over 7 years of work experience on cloud and networking based projects. He is also working on a SaaS based startup which is currently in stealth mode.

CloudEXPO Stories
On-premise or off, you have powerful tools available to maximize the value of your infrastructure and you demand more visibility and operational control. Fortunately, data center management tools keep a vigil on memory contestation, power, thermal consumption, server health, and utilization, allowing better control no matter your cloud's shape. In this session, learn how Intel software tools enable real-time monitoring and precise management to lower operational costs and optimize infrastructure for today even as you're forecasting for tomorrow.
While a hybrid cloud can ease that transition, designing and deploy that hybrid cloud still offers challenges for organizations concerned about lack of available cloud skillsets within their organization. Managed service providers offer a unique opportunity to fill those gaps and get organizations of all sizes on a hybrid cloud that meets their comfort level, while delivering enhanced benefits for cost, efficiency, agility, mobility, and elasticity.
Isomorphic Software is the global leader in high-end, web-based business applications. We develop, market, and support the SmartClient & Smart GWT HTML5/Ajax platform, combining the productivity and performance of traditional desktop software with the simplicity and reach of the open web. With staff in 10 timezones, Isomorphic provides a global network of services related to our technology, with offerings ranging from turnkey application development to SLA-backed enterprise support. Leading global enterprises use Isomorphic technology to reduce costs and improve productivity, developing & deploying sophisticated business applications with unprecedented ease and simplicity.
DevOps has long focused on reinventing the SDLC (e.g. with CI/CD, ARA, pipeline automation etc.), while reinvention of IT Ops has lagged. However, new approaches like Site Reliability Engineering, Observability, Containerization, Operations Analytics, and ML/AI are driving a resurgence of IT Ops. In this session our expert panel will focus on how these new ideas are [putting the Ops back in DevOps orbringing modern IT Ops to DevOps].
Darktrace is the world's leading AI company for cyber security. Created by mathematicians from the University of Cambridge, Darktrace's Enterprise Immune System is the first non-consumer application of machine learning to work at scale, across all network types, from physical, virtualized, and cloud, through to IoT and industrial control systems. Installed as a self-configuring cyber defense platform, Darktrace continuously learns what is ‘normal' for all devices and users, updating its understanding as the environment changes.