What is the primary drawback of using only signature-based detection for malware protection?

• A. It can quickly identify known threats
• B. It cannot defend against new or unknown threats
• C. It is costly to implement
• D. It requires manual updates from users

Answer: (B)

Signature-based detection identifies malware by looking for specific patterns or signatures within files. This approach is effective for recognizing known threats, which allows for quick identification and responses to established malware. However, the primary drawback lies in its reliance on a database of known signatures; therefore, any new or unknown threats that lack a corresponding signature will evade detection. This limitation means that a signature-based detection system could leave a network vulnerable to novel malware strains or variations that have not yet been documented or included in its database. Thus, organizations solely reliant on this method are at significant risk of malware infections from emerging threats that have not been previously identified.