MSSP Challenge#3:Live Testing Our Endpoint Solution

Avast (Soulja Boy Voice Saying Drake) And SEO Poisoning Attacks

Now that our PCs are reporting into Elastic, protected with Endpoint agents and VPNs; let’s dive into why Avast business security is the perfect tool for us.

Avast's reputation as an antivirus tool left a meh feeling in the cyber community. Back then it was an annoying antivirus that offered free protection, but at a cost. The cost wasn’t $$$ but came in the form of performance issues.

At this point, you are wondering “Weren’t you explaining reasons to use Avast?” Wait a minute, let me cook 👨🏽‍🍳.

This is my thought process as I went into my evaluation of the tool. Expecting performance issues; I decided to give it a performance test, and I had the perfect use case.

My test machine has Filebeat Logs Agent, VPNs, Aurora Agent, and Avast. So I decided to see how they would impact my instructing over Zoom for a week. While instructing, I also run Opera Browser, which is heavy on memory. I click a ton of links throughout the week in an attempt to always provide the most up-to-date information and to collect references for attendees. I also run labs locally using a kali Virtual Machine on my local PC. I run some of my favorite tools like the curl data transfer tool. It’s a pretty common and highly flexible tool so if I were a part of Information Security org reading this I’d look into this vulnerability (https://www.intruder.io/blog/curl-high-rated-cve-2023-38545).

Long story short I put that machine and its resources through the paces.

The results were in my favor. Let me explain, to set up my evaluation I became an Avast Reseller and MSP. This got me a better price on their best tools. I had a chance to chat with a couple of the reps at GEN and see how serious they were about the mission of making Avast a light in the dark sea that is small business security. Taking into account the family of consumer tools GEN has I figured let me throw in the CCleaner Cloud Agent and count it against the Avast Agent in a handicap, sense I stand to gain something as an MSP let’s test the tools. I had no intention of attempting to equip Netizen Watch’s tool suite with a tool I don’t believe in. If you know me personally you know I only change my mind if it makes sense to. Call it a lifelong objective to avoid dummy missions. Being raised in Bajan (Barbados/Barbadian) Culture there is a very high emphasis on learning the skill of common sense. When you fall and hurt yourself if you were climbing on something no one said “Are you Ok?” They said “Did that make sense?” (Actually they said “Dat mekkin sense?”, but I wasn’t sure if you read patois)

Avast is now a dope tool. Truth is all of the other tools that I’m stacking it against do and manage less than Avast does, especially when partnered with this current version of CCleaner. Aurora Agent was the worst-performing of the management tools. This is understandable with the build coming with web GUI on your local machine. You have to expect drawbacks from free tools. I’m still evaluating Aurora so the jury is still out. It may be better used in enterprises, niches, and lab builds. Many teams can attest to the lightweight nature of the Filebeat Log Agent, so the fact that the Avast + CCleaner matched the resources used by the Filebeat Log Agent is good news for Netizen Watch. Not only did it not affect performance, but it also stopped an SEO Poisoning Attack. 🤔

An SEO Poisoning attack was something that my habit of clicking on links I searched puts my machine at risk of. You read that right, clicking on a link that Google provides you could infect your machine if you don’t have protection. Here is how it works:

After successfully blocking 2 threats created by my web surfing habits I’m confident that this tool is one I can rely on in our suite. I’d recommend it to any consumer, live streamer, entrepreneur doing webinars, or small business owner.

I have to give big tech their credit. They are stopping a lot. This proves that even though they are successful in providing support as we have always known the attackers evolve and find new ways to launch old attacks. Cybersecurity leaders always say, “Everyone is responsible for cyber security.” Well let us all bear witness to the test of that; Are you willing to take some responsibility for cybersecurity?