Get a third-party AV: Windows Defender is not enough

“I won’t,” my husband said, seemingly out of the blue, while looking at his screen. I looked at him questioningly.

“I will not get anti-virus software,” he said. “I have a Windows computer. Defender does a pretty good job for me. I’m not going to bother to pay for something I know I don’t need.

Usually, I nod in vague agreement to this software-related explosion and get on with my day. However, I decided to take my spouse’s statement with PCMag’s Senior Security Analyst, Neil J. Rubenking, and get his opinion on the matter.

The Windows Defender of the past was not very efficient and managed to score below zero in some independent lab tests, according to Rubenking. That said, in recent years Microsoft has made some improvements to Windows’ built-in security system. It’s now called Microsoft Windows Defender Security Center. The software has simple protection against ransomware, malware and its lab results are more than acceptable. Defender is a powerful antivirus solution, obtaining an efficiency score of 3.5 out of 5 from Neil, and it does not require any installation or additional costs.

But what about the limitations of Microsoft Windows Defender Security Center? It received low scores for phishing, a scam that exploded while people were at home during the early days of the COVID-19 pandemic. In addition, the software’s SmartScreen malware filter only works for Microsoft browsers. Most third-party antivirus products apply malicious download protection to all popular browsers, including Google Chrome and Firefox.

For me, the most telling aspect of Defender is that its developers seem to see it as a fallback. When you install third-party antivirus software on your Windows computer, Windows Defender does not interfere with it. However, if you uninstall your third-party protection, Windows Defender will activate again. There’s also the simple fact that the best antivirus tools, even the best free antivirus programs, perform better in tests and offer more features than Defender.

I presented all of the above information to my spouse, and he complained about not playing with “dodgy websites” and walked away. I couldn’t change my mind, but I know he practices diligent security habits like avoiding malware infested websites and refusing to open links sent by email, so I can assume that his computer remains secure.

Install the third-party antivirus on your Windows computer and while you’re at it, also think about the antivirus for your Android devices. iOS is tight as a drum, so you don’t need a lot of help, but macOS malware does exist, and it’s a good idea to protect yourself against it with virus protection for Mac.

Do you like what you read ? You’ll love getting it delivered to your inbox every week. Sign up for the SecurityWatch newsletter.

We test the best security keys

We talk a lot about password health here at PCMag. Yet the point is, effective password protection of your online accounts with unique and complex credentials is only part of the fight against attackers taking control of your online life. The rest comes down to smart browsing habits like avoiding suspicious email links and using multi-factor authentication (MFA).

Multi-factor authentication uses multiple authentication factors for account logins. One of these factors might be a password, for which you need to use a password manager, but the other might be something you have with you, such as a hardware security key. Since outsiders are unlikely to get hold of both forms of authentication, MFA makes it more difficult for attackers to take control of accounts.

As PCMag security analyst Max Eddy writes, hardware security keys can take many forms and are effective in solving many of the problems other MFA configurations face. For example, a problem with one-time passcodes sent via SMS is that attackers can intercept them via SIM-jacking. Additionally, authenticator apps require a working mobile device, and if anything happens to your phone, whether due to an attack or your own human error, you lose your authenticator device.

Security keys are usually small devices that you can keep handy – on a keychain, for example – and they plug into your USB ports on your computer, or they have USB-C or Lightning connectors for them. Android or iOS devices. Hardware security keys are difficult to break, do not have batteries, and do not require a network connection. Keep in mind that if you lose the security key, you lose one of your authentication methods, so keep it in a safe and secure place.

When looking for a hardware security key, you should choose one with at least FIDO U2F certification so that it will work in almost any basic security key situation. Budget and ease of use are also factors to consider when choosing the right security key for you.

The best security is useless if you don’t implement it. Choose an MFA scheme that works for you and stick to it.

What else is happening in the online security world this week?