Sound far-fetched?
It's not that improbable. Recently, a National Computer Security Association (NCSA) client spent three weeks "disinfecting" thousands of PCs and diskettes throughout its wide-area network -- all due to one virus-infected diskette brought from home -- before it could get its 2,000 employees back into full production.
Between down time and recovery of lost data and applications, we estimate a cost of up to $1,200 per computer virus encounter," says Jon Wheat, NCSA technology analyst. Those encounters, according to NCSA statistics, cost the average American corporation with 1,000 PCs nearly $300,000 in 1994. When multiplied by the number of such companies in the United States, the cost of computer viruses soars to a staggering $1.9 billion annually.
The impact on end users is also great. "I call it a dual disruption -- because you have to recover from both the virus and the disruption caused by the virus," says Bob Armstrong, vice president of finance and operations at Datasonix Corp., developer of leading-edge mobile computing solutions. "One small virus eruption took an entire day away from our development process. It's almost like contracting a fatal disease -- except, in this case, it's the information that dies."
Why are computer viruses so rampant?
According to John Dunkle, president of
Workgroup Technologies, a consulting firm
based in Hampton, NH, "Typically, customers
are unprepared for computer viruses. And as
long as there is 'sneakernet,' there will be
no real prevention and no real cure."
"Unfortunately, what encourages virus writers is the notoriety they achieve from all the media hype -- which, at the same time, also increases awareness of the problem," says Germaine Ward, senior product manager for Anti-Virus and Security Products at Symantec Corp., a manufacturer of anti-viral software. "Anti-viral software has grown up with the viruses. Now, it's become one big cat-and-mouse game. As soon as we trap one problem, they manage to build a new one."
The very real risk of infection has spurred the development of many anti-viral products. It's also led to the formation of several forums, where anti-viral software vendors put aside proprietary interests and exchange research findings. One of the most popular virus forums is that held by NCSA, designed to help educate and unite the technical community.
"We acquire up to three new viruses per day from virus collectors, which we share with other anti-virus vendors," says Jeff Kephart, manager of Anti-Virus Science and Technology in the High Integrity Computing Laboratory (HICL) at IBM Research Division's Thomas J. Watson Research Center, Hawthorne, NY. "We may be in competition with each other, but our main competitors are the virus writers."
"We have to develop an automated system like this; it's the only way to keep up with the virus writers," says Kephart.
The concept is an outgrowth of anti-viral research that has been under way at IBM since 1989. "We developed the anti-virus lab to protect IBM's internal systems," says Alan Fedeli, manager of AntiVirus and Phone Fraud for IBM's Business Recovery Services. "At the time, we chose not to participate in public anti-virus efforts, because we didn't want to encourage virus writers."
IBM reversed its policy and developed a suite of anti-virus products for the personal computer industry in 1991, at the urging of customers and government agencies, which considered the efforts of IBM's Computer Emergency Response Team (CERT) one of the best methods of dealing with harmful-code products. The CERT approach combines highly reliable technology and a recovery process that reports every virus incident throughout a corporation to a central location.
"We measure our success on a machines-per-incident ratio," says Fedeli. "We've been able to keep the rate under three machines per incident, for the entire IBM corporation. The success of that effort reflects the reliability of the technology coming out of IBM Research. It's also kept our cost-per-incident under $500, less than half the NCSA estimated industry average."
In many cases, reliability is the deciding factor for consumers choosing an anti-virus product. While some identification methods increase the likelihood of detecting new viruses, they also greatly increase the likelihood of "false positives," or false alarms. Reacting to false positives can damage productivity as much as an actual virus.
To eliminate any uncertainty about a false positive, the Automated Immune System under development will employ decoy programs. If a decoy becomes infected, the captured virus is analyzed to permit recognition and removal of all copies of the virus in the system. Just as in the human immune system, this information is stored to protect the system from any future exposures.
Another very effective technique for reducing the spread of computer viruses within an organization is to establish a CERT that helps manage "infection" incidents. IBM's CERT has resulted in a measurable reduction in the number of machines that are involved in a typical virus incident. For this reason, the IBM anti-virus product includes a message that will appear on the screen whenever a user's machine is infected. The message can be tailored to instruct the user how to contact the organization's CERT. The CERT can ensure that neighboring machines are checked for viruses and can monitor and control outbreaks more easily. IBM Anti-Virus Services can help organizations establish a CERT.
John Morar, manager of AntiVirus Technology and Systems at the HICL, says: "In a sense, it's almost like a technological arms race. We must continue to come out with newer and better releases of the product if we want to stay in the war."
The advanced methods employed by the HICL will be integrated into the commercial version of the product over the next couple of years. The HICL included automatically derived virus signatures in the last several releases of IBM AntiVirus; the latest version, released in December, contains some automatically derived virus removal information.
But no defense can possibly succeed if it isn't used. The NCSA estimates that the cost of battling computer virus encounters could be reduced by 96 percent if readily available anti-virus software were employed.
A strong offense -- which is the best defense -- begins with a comprehensive strategy to deal with the computer-virus issue. In a local area network (LAN) environment, for example, that means developing a layered approach, similar to constructing fire walls in a building. By protecting the server with virus scanners and PCs with current anti-virus software -- and by educating users and guarding access to networks by regularly changing passwords -- organizations can eliminate most of their system's vulnerability.
For peer-to-peer environments and individual computers, the most important consideration is consistency. For instance, users should write-protect diskettes that are "clean," or virus free, and aren't subject to frequent updates. And users should always scan suspicious diskettes and files downloaded from bulletin board services before such files can interact with the rest of the system's files.
With the stakes so high, many choose to get professional assistance. Says Dunkle: "Smart companies know the power of a complete solution -- and use it. They're the ones talking to vendors that provide services above and beyond the benefits seen in stand-alone software packages." These services include prevention plans and recovery programs that are provided on-site or maintained from a remote, centralized location.
Combining advanced technology with both a high level of knowledge and experience has become the most powerful weapon in the anti-virus arsenal that a company can draw on.
Marcy B. Present is a senior account manager for Leopard Communications, a marketing and communications firm, located in Boulder, CO, and specializing in computers and advanced technology. She holds a bachelor's in communications and a master's in advertising, both from the University of Illinois-Urbana/Champaign.
See also:
How Much is Enough?
Stealth Bomber: The Computer Virus Writer
A Virus by Any Other Name...
Common Viruses
And Still More Viruses