Virus Guy said:
I have.
A computer that has (by intent or design) no internet connection will
have a drastically reduced exposure to malware.
True - and has drastically reduced (but not eliminated) the need for AV.
You can raise the theoretical spectre that the user obtains data files
from external sources on external media and they could be infected,
Not only data files - executables too.
I don't think it is an isolated computer if new executables are brought
in and executed. The OP only said that it had no internet connection.
is most likely used for special purposes and
the files that get transfered to it are most likely going to be
specialized files of some sort and not likely to be "infectable".
True of isolated computers. But the OP's computer isn't isolated.
You
also can't discount that the source computer(s) where the files come
from do run updated AV software and can provide assurance that the
files are not infected.
Trusting the source of files to have such is dangerous securitywise.
Trust yet verify is the way.
The issue of AV protection on an isolated (un-connected) computer is a
circular argument.
Especially if you stipulate that "isolated" = "un-connected" (as in no
internet). There is more to isolation than a pair of diagonal cutters.
Without constant updates, the quality of AV
protection is questionable.
The quality of AV "protection" is 'always' questionable - and is likely
to stay that way.
Constant updates are only needed if your practice is to constantly
expose yourself to new malware. All you really need to do is to make
sure that the update is enough "newer" than the suspected malware is. If
you have had the suspected malware (inactive of course) for two weeks,
then you update and scan with defs that most likely have that malware
known to them by then.
But by being isolated, the entry points
for malware are significantly reduced.
If truly isolated - they're completely gone (assuming the software
already onboard isn't too broken).
The extra resources used by
the AV software, the extra boot-up time, becomes more of a liability
than the benefits confered by the dubious protection.
That is one reason why 'on-demand' AV is superior if you can wield it.
The problem is the difficulty in correctly implementing it (especially
in "connected" computers) - but the OP's (semi-isolated?) case should
make it easier.