Antivirus software is an essential security tool for any computer user in today's digital age. It serves as the first line of defense against malware, viruses, and other cyber threats that can compromise sensitive data. The IRS recognizes the importance of antivirus software as a critical security measure for safeguarding taxpayer information and includes it in publication 4557 as part of the Security Six.

While legacy antivirus is the type most people are familiar with, modern antivirus technology has evolved to include endpoint detection and response (EDR), managed detection and response (MDR), and extended detection and response (XDR) tools. In 2021, Executive Order 14028, Improving the Nation’s Cybersecurity, was issued, which changed the standard for combating the spread of malicious programs. This document outlines that legacy antivirus is no longer sufficient and that federal agencies must use modern tools like EDR for threat detection.

For tax preparers, having proper antivirus software in place is critical for remaining compliant with IRS guidelines and protecting client information. This article aims to provide an overview of modern antivirus technology to bring tax preparers up to speed with the latest cybersecurity measures.

The Differences Between Legacy Antivirus and EDR

While legacy antivirus software has been the go-to security solution for years, the ever-evolving threat landscape has prompted the development of more advanced security solutions, such as Endpoint Detection and Response (EDR).

One of the key differences between legacy antivirus and EDR is their approach to threat detection. Legacy antivirus software uses signature-based detection, which means it relies on a database of known malware to identify threats. This approach can be effective against known threats, but it is limited in its ability to detect unknown threats or zero-day attacks.

On the other hand, EDR uses a behavior-based approach to threat detection. It monitors the behavior of every process and application on a device to identify any suspicious or malicious activity. This allows EDR to detect and respond to previously unknown or zero-day attacks, as well as malware that has been modified to evade signature-based detection.

Another key difference is the level of protection provided. Legacy antivirus software primarily provides protection against malware, while EDR offers more comprehensive protection. EDR not only detects and responds to malware, but it also detects and responds to other types of threats, such as insider threats, fileless attacks, and unauthorized device usage.

Additionally, EDR is often coupled with a team of security experts who can review alerts and respond to threats in real-time. This human component ensures that the program's detection and response capabilities are accurate and effective.

Here are some common use cases for EDR:

1. Identifying and quarantining malicious executables.
2. Monitoring and controlling who can execute scripts.
3. Preventing unauthorized USB device usage.
4. Protecting against malicious email attachments.
5. Predicting and preventing zero-day attacks.

While legacy antivirus software provides some level of protection against known threats, it is limited in its ability to detect and respond to unknown threats. EDR offers a more comprehensive and effective approach to threat detection and response, making it a crucial component of modern cybersecurity.

Antivirus Measures Required by the IRS for Tax Preparers

The IRS has implemented stringent antivirus requirements for tax preparers to protect their clients' sensitive information from cyber threats. Tax preparers are responsible for adhering to these guidelines to ensure the confidentiality and integrity of client data.

To comply with the IRS antivirus requirements, tax preparers should consult Publication 4557 and Publication 1075 for guidelines and best practices. These publications provide detailed information on how to safeguard systems and protect client data. In addition, the National Institute of Standards and Technology (NIST) offers comprehensive documentation on antivirus measures for tax preparers to follow.

Tax preparers must use up-to-date antivirus software to protect their systems from malicious software, such as viruses and malware. The software must be updated regularly and monitored to ensure that it is functioning correctly. To secure client data from unauthorized access or disclosure, tax preparers should take appropriate steps.

To meet the IRS antivirus requirements and NIST guidelines, tax preparers should implement EDR/MDR protection and hire a Managed Security Service Provider (MSSP) to monitor and maintain their systems. Legacy antivirus solutions are not sufficient for devices containing client tax data and Personally Identifiable Information (PII). Therefore, tax preparers must implement adequate protection measures, including EDR/MDR, to protect against advanced cyber threats.

By following the IRS antivirus requirements and guidelines, tax preparers can safeguard their clients' sensitive information from cybercriminals. As a result, tax preparers can maintain their clients' trust and reputation while avoiding legal repercussions.

What is a Computer Virus?

A computer virus is a type of malware that is designed to replicate itself and spread from one computer to another, often with the intention of causing damage or stealing data. A virus can attach itself to a program or file and execute its code when that program or file is opened or run, allowing it to spread to other files and potentially infect other computers.

Computer viruses can be transmitted in various ways, including through email attachments, downloads from the internet, and infected removable storage devices such as USB drives. It is important to always exercise caution when downloading or opening files, especially if they are from unknown sources. It is recommended to scan all downloaded files and email attachments with antivirus software to help prevent infection.

Once a virus has infected a computer, it can cause a variety of problems. Some viruses may simply slow down the system, while others can corrupt or delete files, steal personal information, or allow unauthorized access to the infected computer. In order to protect against viruses, it is important to use reputable antivirus software and keep it updated with the latest virus definitions.

Phishing attacks are a common method used by cybercriminals to distribute ransomware. Phishing involves sending deceptive emails or messages that trick individuals into providing sensitive information, such as login credentials or financial information. These phishing emails often appear to be legitimate and may include links to fake websites that look identical to legitimate ones.

If a user clicks on the link provided in the phishing email, it can lead to the download of malware onto their computer, which can then infect their system with ransomware. Once the ransomware infects a system, it can encrypt files and demand a ransom payment to restore access to the data.

Therefore, it is important to be vigilant when receiving emails or messages that ask for personal information or contain suspicious links. It is recommended to verify the sender's identity and the legitimacy of the email or message before clicking on any links or downloading any attachments. Additionally, having up-to-date antivirus and anti-malware software can help prevent ransomware infections caused by phishing attacks.

Adware is a type of software that displays advertisements on a user's device, typically in a more obtrusive and intrusive manner than standard web ads. Unlike viruses or malware, adware is not intended to harm a user's computer system. However, it can slow down the computer and use up resources while running in the background.

Adware is often bundled with other software downloads or can be installed without the user's knowledge. It displays ads in the user's default browser, often in the form of pop-ups, banner ads, or other types of ad formats. In some cases, adware can replace some website content with advertisements. While not necessarily harmful, adware can be annoying and intrusive, and some types may collect personal information or browsing data to display targeted ads.

A worm is a self-replicating and standalone malicious program that can spread from one computer to another without the need for human interaction. It can exploit vulnerabilities in computer systems and networks to propagate itself and may cause harm to the infected devices by consuming their resources or disrupting their operations.

Unlike viruses, which rely on infecting other programs to spread, worms can function independently and spread through various channels, such as email attachments, network connections, or removable storage devices.

While worms and viruses share some similarities, such as their ability to replicate and cause harm to computer systems, worms are considered more dangerous due to their ability to spread rapidly and autonomously, making them harder to contain and control.