Viruses - Fending Off Viruses

By the early 2000s, virus attacks, or threats thereof, were so frequent that businesses were hard pressed to be prepared in advance for all potential attacks. Since predicting when or how a virus would occur was nearly impossible, most businesses, governments, and organizations devoted their efforts to detection, containment, and disinfection programs.

Scores of antivirus vendors specialize in software designed to detect incoming viruses and deflect them from their targets. Since viruses are constantly evolving, so are the programs designed to thwart them, and many organizations, particularly IT-intensive businesses, must make frequent online trips to those vendors' sites to acquire the latest virus patches and other updates. Once these fortifications are acquired, IT security personnel must allocate all the updates to their proper locations, which can be a tedious and time-consuming process.

Antivirus programs typically work by scanning all incoming information for known viruses by seeking out virus "signatures," or tell-tale signs of previously detected viruses. Such signatures generally include known programming patterns and codes, as well as more overt characteristics such as file names or types of e-mail attachments. But by its nature, this method forces antivirus vendors to continually play catch-up with viruses, and vendors are judged not only by the success of their products in fortifying systems against viruses, but also by how proactive they are in anticipating new virus strains. At any rate, IT security staffs are compelled to continually download the latest signature updates. With dozens of vendors issuing such updates, the task of regularly allocating the fortifications to their proper locations was increasingly costly, provoking many analysts to begin calling for more effective and user-friendly methods.

To make such tasks more manageable, antivirus vendors increasingly designed products for the server level, rather than the computer level. Not only were server-level virus screens easier to implement, they were increasingly practical as viruses were spread over server-based vehicles like e-mail. In addition, this provided multiple layers of security so that if an antivirus program failed to stop a virus at one level, it might still be thwarted at another level.

The emerging generation of antivirus programs may render obsolete the daunting task of updating signatures at the desktop level. Increasingly sophisticated programs were aimed at identifying and thwarting viruses based not on comparing their characteristics to lists of previous viruses, but by seeking out malicious behavior. This would be a huge step in the virus-antivirus arms race, allowing antivirus vendors to stop playing catch-up with virus programmers.

One obstacle to virus detection and eradication, according to some analysts, was the propensity of firms to keep internal virus damage quiet so as to avoid compromise of their stock prices or to otherwise try to circumvent financial or competitive disadvantage. While such practices can save a business from short-term headaches, it could also prove an obstacle to broader virus response techniques, since information sharing is so essential in order to get a handle on viruses.