What is Antivirus?
Antivirus is software that protects computer systems, devices and networks from malware threats. These include viruses, worms, Trojans, spyware, adware, rootkits and other malicious code. Antivirus programs typically use multiple protective layers to detect, prevent, and remove cyber attacks. The MITRE ATT&CK framework and principles like least privilege and zero trust often drive antivirus designs and capabilities.
The term “antivirus” was first coined in 1988 by Ahn Cheol-Soo in South Korea while working on his AV-FAST program. It was one of the earliest virus scanners to employ heuristic detection and file analysis. Heuristics examine the structure of files, detecting patterns and anomalies that indicate the presence of malicious code. In addition to analyzing file structures, many modern antivirus programs use heuristics and other machine learning techniques to identify new types of malware.
Other technologies and protective layers typically found in antivirus solutions are firewall protection, phishing detection, and secure web gateways (SWG). Some antivirus software also uses cloud-based threat intelligence to scan for and analyze malware using a broader set of definitions and resources.
Antivirus is a crucial component of many information security frameworks and standards, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Payment Card Industry Data Security Standard (5 CFR Part 314), and ISO/IEC 27001. It is also an important element of overall cybersecurity best practices, such as avoiding untrusted websites and downloads and practicing safe online behaviors. A robust antivirus solution, combined with safe online practices, can significantly reduce the risk of malware infections and the impact of cyberattacks.