Security software showdown! 9 antivirus suites empirically tested

If you're like a lot of people, when it comes time to renew your security software, you may ask yourself, "Do I really need to upgrade to the latest version?" The answer is yes. Keeping up-to-date is generally a good idea, as new threats surface constantly. And if you value mobile security or use a social network, this year's crop of security suites is worth paying attention to.

An increasing number of security suites now feature special tools to help protect you on social networks--a growing target for spammers, scammers, and other parties who want to get at your personal information. For example, Trend Micro's Titanium Internet Security suite comes with a handy tool that highlights any possible areas of concern involving your Facebook privacy settings. Various suites also include tools that will scan links on social networks so that you aren't duped into clicking a malicious link hidden behind a URL shortener.

If you own a smartphone or tablet, or both, the security class of 2013 has some new tools for you. And some security packages come with a mobile app that provides protection against mobile malware or includes other features such as GPS tracking to help you find your phone should it go missing. These apps often also include remote-wipe capabilities that let you delete the contents of a missing phone or tablet so your private data doesn't end up falling into the wrong hands.

In addition, Windows 8 has changed the way security software makers design their programs. Many of the suites we looked at this year sport redesigned interfaces that include larger buttons and controls made to be more touch-friendly.

As usual, we teamed up with the fine folks at AV-Test, a respected antivirus testing lab based in Germany. AV-Test ran each suite through a comprehensive battery of tests to find out how well each would stand up to the worst malware currently in existence. AV-Test also performed speed testing to determine whether the suites will slow your PC to a crawl. We analyzed the data that AV-Test provided, and then tried each of the products ourselves to give you an idea of which suites you should go for--and which ones you should pass on.

Here are the suites we tested. You can click on each link to read individual reviews, or simply read this list for quick star ratings and summaries.

1. F-Secure Internet Security 2013 -- 4.5 stars (Superior). F-Secure's latest suite offers excellent protection and a friendly user interface.

2. Norton Internet Security 2013 -- 4.5 stars (Superior). With its great detection rate and Windows 8-ready design, Norton's suite is definitely worth a look.

3. Trend Micro Titanium Internet Security 2013 -- 4.5 stars (Superior). This "titanium" suite earned high marks in almost all our detection tests, and it has a nice interface.

4. Bitdefender Internet Security 2013 -- 4.5 stars (Superior). Bitdefender has a user-friendly interface that will appeal to people of all experience levels.

5. Kaspersky Internet Security 2013 -- 4 stars (Very Good). Kaspersky lets both beginners and advanced users get the most out of its suite, and scored well in our tests.

6. McAfee Internet Security 2013 -- 4 stars (Very Good). McAfee didn't earn top marks, but it's still a proficient, user-friendly antimalware program.

7. G Data InternetSecurity 2013 -- 3.5 stars (Very Good). G Data has an effective suite, but in­­stallation is a hassle, with a settings panel that's more suited to advanced users.

8. AVG Internet Security 2013 -- 3.5 stars (Very Good). AVG's security program is perfectly re­­spectable. But perfectly respectable just doesn't cut it these days.

9. Avira Internet Security 2013 -- 3.5 stars (Very Good). This suite is competent at detecting, disabling, and cleaning up malware, but its user interface is unfriendly.

BEST OVERALL: F-Secure Internet Security 2013 F-Secure's 2013 suite kept our test system free of malware and did a great job of cleaning up infections that made it onto our PC. It's speedy and well designed, too.

BEST PROTECTION: Trend Micro Titanium Internet Security 2013This suite had the most well rounded protection of all the suites we looked at. It proved effective at keeping malware at bay and at cleaning up infected PCs.

BEST SPEED: Norton Internet Security The days of Norton being ridiculed as slow are long gone: Norton's newest suite had lightning-quick scan times, and its impact on overall PC performance was minimal.

BEST INTERFACE: Norton Internet Security We liked Norton's polished, easy-to-use interface and one-click installation process. It's also designed to be Windows 8-friendly.

A competitive field

The security software market is highly competitive and it showed in our test results. In our testing, no suite detected less than 97.8 percent of recent known malware samples, and blocked below around 94.4 percent of new malware in our "real-world" attack-blocking tests. False positives were also largely a non-issue. But if you look closely,there are still some notable differences.We noticed a fairly wide difference in terms of ease of use between the suites we looked at. While some--like Norton and Trend Micro--were very user friendly and polished, others--like Avira and G Data--were less so and seemed to be designed withexpert users in mind.In the end, even the lower-ranked suites performed reasonably well, but simply didn't stand out enough to claim a higher ranking.

What you don't get in these suites

For the sake of this story, we looked at mainstream Internet security suites, but most security companies also sell more feature-complete "advanced" suites. These suites include products like Norton 360, Trend Micro Titanium Maximum Security, and AVGPremium Security.For the most part, these advanced suites feature the same basic antivirus engine as the more basic suites, but will also include PC maintenance tools, online backup, additional parental controls and privacy controls, and more.What comes in the more advanced packages compared to the more basic suites does very between manufacturers, though: Some include a mobile app with the basic suite, while others include it only in their advanced suites. In general, though, the basic suitescontain just about everything you'll need to keep your PC protected.

Threats to watch for in 2013

(by Tony Bradley)

More sophisticated phishing Email and text messages that contain links to malicious websites will improve in quality to the point that they'll be virtually indistinguishable from legitimate communications. The messages will become more polished and professional--no more broken English and poor grammar.

Watering-hole attacks A drive-by download is a twist on the concept of browser-based attacks. In this sort of attack, cybercriminals post malicious content on a Web page, and then try to figure out some way to lure you to visit the website. If the PC you use to visit the website is vulnerable to the exploit used by the attack, malware is downloaded and the system is compromised. In 2013, though, attackers will continue to hone in with more precise attacks known as "watering hole" attacks. Rather than casting a wide net (as attackers do with drive-by downloads), the watering hole attack is more precise.

Data breaches In 2013, attackers will continue to target weak security on Internet-facing database systems to acquire thousands or millions of compromised records at once rather than going after individual users. Unfortunately, there isn't much you can do to prevent this sort of attack, but you can go on the defensive by being vigilant. Monitor your bank and credit card statements and report anything suspicious to your financial institution.

  Note: Click on the chart image below to see a summary of our findings.

Read more »

HP offering data-breach response and remediation services

HP today announced data-breach remediation services intended to help organizations prepare for an incident related to data loss that would require fast response to meet both legal and digital forensics requirements.

"It's not if, it's when a breach occurs," said Andrzej Kawalec, global chief technology officer at HP Enterprise Security.

[ Symantec CEO on reorg: "Our system is just broken" ]

HP's services from consultants include working with internal security and management teams to prepare for regulatory notifications and public response by establishing a clear set of practices and processes for data breach incidents. It also includes the HP Breach Response Service for round-the-clock monitoring to detect and respond to intrusions, with HP on call to dispatch its security team to the client's location to investigate any breach and work through remediation.

Jeremy Ward, manager at HP Security Services in the U.K., said HP can provide digital and computer forensics services to pull together evidence related to a data breach. "The forensics readiness services gets the clients prepared," Ward said. HP anticipates its services, which would cost about $20,000 depending on the size of the business, will have the most initial demand in North America and Europe, though the need could come from "anywhere in the world."

Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security. Twitter: @MessmerE. Email: emessmer@nww.com.

Read more about wide area network in Network World's Wide Area Network section.

Read more »

Logitech introduces Mac-based video surveillance

Logitech on Wednesday introduced new software that turns Mac computers into video surveillance command centers.

Once installed, the Logitech Alert system can be viewed on a variety of devices.

Logitech Alert Commander for Mac allows users to tie six Logitech Alert security cameras into a single HD dashboard, viewed live or in playback, giving them full surveillance over households and small offices. (Users can also set up motion alerts that send text or images to your phone or email.) And once set up, the feed can be viewed privately but remotely at Alert.Logitech.com or via the company's iPad app.

It works with systems including the $350 Logitech Alert 750e Outdoor Master System and the Logitech Alert 700i Indoor Add-On Camera, for either external or internal views of the premises.

Until Wednesday, Logitech's security products had been compatible only with PCs running Windows software.

Logitech Alert Commander for Mac is free; it is compatible for users running Mac OS 10.6.8 and later.

Read more »

Skype disables password reset after security flaw exposed

Microsoft has disabled the option for users to reset their Skype passwords after security experts uncovered a serious flaw in the software that allowed anyone who knows your email address to hack your Skype account.

The vulnerability allowed people to sign up to Skype with email addresses already in use by others and then force password resets for accounts associated with that address in order to gain access to your account. Basically, anyone who knew your email address could sign up for a new Skype account with it and then reset the password for your current account, thus hacking in.

The exploit first appeared on several Russian forums, and has been actively exploited since, Costin Raiu, a senior security researcher at Kaspersky Lab, said in a blog post. To protect against this vulnerability, Raiu advises that users change the email address associated with their Skype account to a new, never-before-used address.

Rik Ferguson, director of security research & communication at Trend Micro, explainedhow easy it was to hack into someone's Skype account: "In essence the procedure is so simple it could be carried out by even the most inexperienced of computer users. [...]This would lock the victim out of their Skype account and allow the hacker to receive and respond to all messages destined for that victim until further notice. I tested the vulnerability and the entire process took only a matter of minutes."

Skype also said in a statement that it is aware of the new security vulnerability issue. "As a precautionary step we have temporarily disabled password reset as we continue to investigate the issue further. We apologize for the inconvenience but user experience and safety is our first priority," the statement said.

Read more »

DHS aims to hire 600 cybersecurity pros -- if it can find them

The Obama administration is hoping to make good on its promise to create new jobs -- in this case, 600 of them in cybersecurity.

Department of Homeland Security (DHS) Secretary Janet Napolitano, acting on the recommendation of the Homeland Security Advisory Council's Task Force on Cyberskills, said at a Washington Postcybersecurity forum that DHS wants to hire at least 600 cyber experts, analysts, IT specialists and people who are familiar with coding.

As a number of cyber experts have noted, however, while this may be a new initiative, it is not a new goal. James Lewis, senior fellow and program director at the Center for Strategic and International Studies, said on a different panel at the same forum that similar hiring efforts have been under way for several years, with limited success.

Federal News Radio's Jason Miller reported that the Government Accountability Office (GAO) "found in November 2011 that nearly every agency experienced difficulty in defining and hiring cyber workers."

There are several reasons for the difficulty, experts say, but none of them have to do with a lack of supply. They say there are talented candidates out there, but DHS has not learned how to attract them. One problem is that DHS still hasn't been able to define the skills needed and job descriptions clearly.

U.S. Army Maj. Gen. John Davis, senior military adviser for cyber to the undersecretary of defense, said recently at the Center for Strategic and International Studies (CSIS) in Washington, "We don't have all the capacity and the right sets of skills that we need to do all that's required. In the department we are still struggling to fully define and empower the cyber workforce."

Beyond that, experts say DHS is likely to continue to have problems recruiting the best and the brightest in cybersecurity until it learns that many do not fit into the standard bureaucratic hiring profile.

[See also: DHS eyes kindergarten for next generation of cybersecurity pros]

In response to a call from Napolitano several weeks ago to begin training the next generation of cyber pros in kindergarten, several experts said there is no need to wait 14 years for those kindergarteners to get out of school. But the talent available now would be unlikely to make it past standard government screening.

As the security consultant Winn Schwartau put it recently at the Hacker Halted conference in Miami, human resources departments "frown on conditions such as attention deficit disorder and autism, or obsessive-compulsive personalities, which are typical of computer geeks willing to focus on an issue through the night."

Government also lacks the so-called "cool factor." Paul Rosenzweig, founder of Red Branch Law & Consulting and a former DHS assistant secretary for policy, said at the time, "It is much more interesting and cool to build new stuff in Silicon Valley than it is to toil doing cybersecurity for DHS."

Bill Pennington, chief strategy officer at WhiteHat Security said that while defending the free world from cyber threats may be pretty cool job description, "sadly I am sure there are a thousand regulations that make the government put out descriptions like Security Analyst Level 1."

Pennington added that standard education requirements might be blocking some of the best talent out there. "What they are teaching at some universities is at least two to three years behind the curve. Why would I go to college and spend $100,000 to $200,000 to learn three-year-old technology?" he asked.

So far, DHS is only getting part of that message. One of the recommendations of the Task Force on Cyberskills is to, "make the hiring process smooth and supportive and make mission critical cybersecurity jobs for the federal civilian workforce enticing in every dimension: in mission and service, skills, growth potential, and 'total value proposition.'"

Mark Weatherford, undersecretary of cybersecurity for DHS, said in September that a lack of a college degree shouldn't be a deal-breaker for a job candidate.

Still, the task force believes in the conventional education approach. Another recommendation calls for "[establishing] a two-year, community-college-based program that identifies and trains large numbers of talented men and women to prepare them for mission-critical jobs in cybersecurity."

Not necessary, says Pennington. "Apprenticeship is a concept that fits this area well," he said. "Once you hire based on attitude the aptitude can come quickly with the proper environment and hands-on training."

He said the WhiteHat hiring process involves giving candidates a week to answer questions about cybersecurity. "It is surprising how many people this process weeds out,"Ã'Â he said.Ã'Â "Those who pass then come in for interviews, mostly around team chemistry. Our retention rate is about 95% over the past four years."

Read more about security career/staffing in CSOonline's Security Career/Staffing section.

Read more »

Shareholders kept in the dark on data breaches

It happened more than three and a half years ago. So it presumably would be old news that Chinese hackers broke into soft drink behemoth Coca-Cola's computer systems and stole confidential files relating to its effort to acquire the China Huiyuan Juice Group for $2.4 billion.

But it is just coming to light now, through a report earlier this week in Bloomberg Businessweek. The story said the FBI contacted Coke executives on March 15, 2009, and told them hackers had been inside their system for a month. The attempted deal for Huiyuan collapsed three days later.

The U.S. Securities and Exchange Commission (SEC) requires companies to report to its shareholders any "material losses" from attacks, plus any information, "a reasonable investor would consider important to an investment decision."

Meredith Cross, director of the SEC's division of corporation finance, told Businessweek, "We think reasonable investors could care, depending on the specific facts and circumstances."

But Coca-Cola never disclosed the breach to its investors. Most companies don't. Bloomberg reported on breaches of the British energy company BG Group, the Chesapeake Energy and others that were never disclosed to investors.

When questioned about it, most company officials or representatives either declined to comment, or declared that they were in full compliance with all applicable laws.

The response of Coca-Cola spokesman Kent Landers was typical. "We make disclosures in our public filings when we believe they are appropriate and in accordance with the requirements of the federal securities laws," he told Businessweek.

One reason for the lack of transparency may be that Coca-Cola didn't discover the breach itself. It took notification from the FBI. That is common. Security experts regularly point out that many companies don't know they have been hacked until a third party tells them.

Breach victims also frequently don't know what was taken, who took it and how it is being used. So, since it is difficult to put a value on the loss, they argue that it is not a material event, and therefore not subject to that SEC regulation.

David C. Vladeck, director of the Federal Trade Commission's (FTC) Bureau of Consumer Protection, made that point at a recent press conference, saying that the question of when major data breaches should be reported is "difficult. We don't necessarily have the right answers."

Stewart Baker, a partner at Steptoe & Johnson LLP and former assistant secretary for policy at the Department of Homeland Security, told Businessweek, "All of the ambiguities stack the deck against disclosure."

[See related: EPA data breach highlights worrying trend]

Read more »