Virus Awareness
or
The Computer virus problem is large and growing

The computer virus problem began in the late 1980's when a few computer viruses existed both for DOS and Macintosh microcomputers. At that time computer viruses were a novelty. Technical users and the computer press were full of "what if a virus changed data in a spreadsheet costing the organization millions......" and "wouldn't it be terrible if a virus changed information in a hospital PC causing people to die...." and speculation that a computer virus could damage a computer's monitor or processor or other hardware.... and so on.

But most of our preconceptions were wrong

Now, seven years and thousands of virus strains later, we know quite well the problems that computer viruses create. Every single Fortune 500 organization has experienced computer viruses first hand. Most experience them monthly. Corporations with 1000 PCs currently have about one virus incident every month. If trends continue, the problem will double again within 18 months.

We now know that viruses never physically harm computer hardware, nor is it likely that any have changed spreadsheet data or hospital information in a way that went un-noticed. In fact, it is rare for computer viruses to actually erase or destroy data. Many viruses are capable of destructive activities, but most of the damage that viruses cause, day-in and day-out, relate to the simple fact that contamination by them must be cleaned-up. The problem is that unless you search through all the personal computers at your site, as well as all the diskettes at your site, you can have no assurance that you have found all copies of the virus that may have actually infected only four or five PCs. Since viruses are essentially "invisible" the engineer must actually go looking for them on all 1000 PCs and 35,000 diskettes in an average corporate computer site. And if even a single instance of the virus is missed, then other computers will eventually be re-infected and the whole clean-up process must start again.

We know that viruses are almost never planted in our organizations intentionally. They come to us the same way that human flu virus comes to us -- by normal, non-malicious, interaction of working people. We get the flu by shaking people's hands who have the virus, but who are not yet sick. We get computer viruses by using the same diskette in our computer that a cohort used in her computer though she did not know her computer was incubating a virus either.

Costs -- The costs of computer viruses to society are astounding. A recent NCSA study shows that the world-wide costs of simply detecting and recovering from computer virus incidents (from virus contamination alone - not including any costs of data loss or disaster recovery) amounts to approximately 1 Billion US Dollars yearly. This is an annual cost of about $800 per infected computer per year or an average of about $10 for every computer owner per year, whether they suffer an infection or not.

If the virus issue has generated anything, it has generated misconceptions. Sadly, even most technical computer users and analysts still adhere to many of these. The fact that most organizations who experience computer virus problems will not talk about them for fear of hurting their public image furthers the problem. The result is that most approaches we collectively take to combat the virus problem are based on premises which simply are not true.

Misconception #1) Computer bulletin board software should be avoided because BBSs are a leading source of computer viruses.

The fact is that the most common viruses (the boot track type) could not possibly be either loaded to or down loaded from a bulletin board by any normal or accidental means. Of the computer viruses which could move this way, most simply do not. Bulletin board operators and users are actually a very conscientious lot. This means that any policy against using modems, bulletin boards, public-domain software or shareware, will have no significant benefit in reducing an organization's virus problem.

Misconception #2) Software piracy is the leading cause of virus spread. Viruses travel more with program diskettes than with data only diskettes.

The fact is that boot legged software does contribute to the virus problem, but the much more significant contributor is diskettes which contain only data (or even no data like blank formatted diskettes). Although it is true that computer viruses cannot infect data per-se and survive to reproduce, the most common viruses can and do infect the diskettes carrying only data. And when those diskettes are used, the virus can infect the next computer's hard drive or files.

Misconception #3) Most viruses intentionally cause damage by erasing files, formatting disks, etc.

The fact is that most viruses do not intentionally cause any explicit damage. And even the viruses which are programmed to trigger a damaging activity almost never cause harm by this programmed activity. This is because most virus instances are discovered before the programmed "trigger date." Once discovered, the real costs of computer viruses come into play -- the work in trying to find all instances of them in your computer and at your site, and in trying to remove them and de-contaminate the computers, disks and programs that the viruses have infected.

Misconception #4) There are good viruses and bad ones.

This is a very common misconception. Those who write and distribute computer viruses commonly claim that theirs is a "benign" virus because it has no malicious trigger event and does no intentional harm. They are duped by the same set of misconceptions that have duped the rest of us -- that the problems computer viruses cause are mainly due to the trigger events. In fact, because all viruses replicate without the computer user's or owners' knowledge or consent (by definition), the very act of replicating is an act of contamination and is itself harmful. It is much like cancer. The cancer cells themselves are normally not harmful or poisonous, but the fact that they keep growing and cannot be easily discerned or separated from the non-cancer cells makes finding and getting rid of the invasion particularly difficult.

Misconception #5) The virus problem waxes and wanes every few years.

Despite the fact that the news about computer viruses comes in waves (mainly the Friday the 13th - Columbus day wave in October 1989, and the Michelangelo wave in February / March 1992), the computer virus problem has grown rather steadily and predictably since it began. During the Michelangelo "crisis", 95% of problems that users experienced from computer viruses were actually (and predictably) caused by virus strains other than Michelangelo!

Misconception #6) Computer security is effective against computer viruses

One would think that the reason we have so many computer viruses is that our computers are not "secure". In fact, traditional computer security - that is computer secrecy including access controls and encryption, have almost no effect on computer viruses. During Desert Shield, a significant part of our own command and control network (a quite "secure" network, as you might imagine) was, in fact infected by the then most common computer virus. The virus, called Jerusalem, works quite well in a system where everything is encrypted -- it too becomes encrypted, and only becomes un-encrypted when it needs to infect something.

Nevertheless, the virus problem is exceedingly costly

Despite the fact that viruses don't often cause the kinds of damage we originally feared, they are indeed a very expensive and productivity-draining problem which is only getting worse. NCSA's "Computer Virus Cost Analysis" shows the average computer site (with 1000 PCs) will spend more than $300,000 on computer virus clean-up this year! As a group, computer viruses have conservatively cost US computer users over a Billion dollars in the past two years!

The Data Super Highway could make things considerably worse

Unless we address the right problems, not the misconceived virus, security and system management issues, the increased connectivity that a nationwide data path will provide will inevitably spell total chaos -- not only with regard to computer viruses, but also from other computer security, management and ethical issues. Since computers, televisions, radio, telephone, libraries, money, credit and a host of other things that we think of today as separate entities will soon all converge into the same or co-existing digital systems, the chaos may potentially extend to society-crippling proportions.

Misconception #7) Another common misconception is that the computer hardware manufacturers or the computer operating software vendors ought to provide us with systems which cannot become infected.

The fact is that computer viruses are just computer programs. Computers are designed to run computer programs. And there is nothing universal about computer viruses that would allow them to be distinguished in advance from any other program. Then we arrive at the unfortunate truth that -- computers are made to run computer viruses! Although it is possible to make it more challenging for computer virus creators, it is not possible to make a virus-proof computer (unless we do not let that computer run any new programs).

Win '95, OS/2, DOS and even Windows NT systems are all easily and equally infected by the dozen most common computer viruses. It is true that some of these operating systems inhibit the replication (spread) of some viruses, but many current computer viruses operate "well" in all of these systems. The newest versions of DOS and Windows including Win '95, DOS 7, and Windows NT do not and will not include any anti-virus software or utilities. It will be completely up to the user to deal with the computer viruses problem.

So what are the solutions?

If banning bulletin board use and stopping the use of all pirated software and invoking pentagon-level computer security won't solve the problem, then what will?

The most important reason that computer viruses invade and grow among microcomputers is that microcomputers are not centrally managed. Indeed, microcomputers are inherently very difficult to "manage" in the ways we manage mainframes. It is unlikely that microcomputers will ever be centrally managed in ways sufficient to prevent computer viruses.

Use Anti-Virus Software -- Fortunately controls which effectively protect against all likely computer viruses do currently exist. All anti-virus products which are "NCSA certified" are tested and certified to have virus scanners which detect 100% of all computer viruses which are known have recently infected any computers worldwide. These anti-virus products are generally unobtrusive, easy to use and effective.

However, too few people use anti-virus software regularly or properly. To be effective, anti-virus software must either be used regularly, or installed to offer full-time protection. According to data from NCSA, if just half of the computers world-wide made frequent or automatic use of anti-virus software, the virus problem would decrease by as much as one hundred-fold in less than a year! This means that the problem would decrease from a billion dollar problem yearly, to one which costs the average computer user less than ten cents in time and energy finding and recovering from computer viruses per year!

The root of the problem -- computer ethics & lack of education

Another thing we learned during our virus experience, is that most of those who write and intentionally distribute computer viruses do not think that their particular virus is bad or damaging or harmful. Most think that they are experimenting -- legitimately, and that they are well within their rights to do so. Most are young, and have not yet developed a social conscience or a global awareness or a world-view. Most find the computer and communications medium which insulates them from their "victims" to be intoxicating. (Most don't even know that victims exist.)

The medium allows for anonymity while being a voyeur. It allows one to ignore or even not believe that human beings are the ones who are ultimately harmed. It allows one to tempt fate with a Pandora's box -- and to have the thrill of creation of a self-sustaining organism -- a computer virus. But mostly, it is a medium which provides community -- with the same social pressures, social acceptance, and the need to "belong" that any community has.

Virus exchange bulletin boards

There are dozens of "virus exchange bulletin boards" and virus exchange sites on the internet in the US alone and more in the rest of the world. These are much like the much more pervasive, legitimate bulletin boards, in that users can access them to upload and download programs and messages through the regular telephone system, but the virus exchange BBS system operators knowingly accept and provide viruses for general distribution to those who want them. And many curious teenagers in the world, who have a need to "belong" want them.

These virus BBSs often have a thousands of different viruses available for downloading. But most will not allow just anyone to download a virus. Instead, many require the authorized user to "belong". In order to become part of the "in" group that can share in the viruses, most virus BBSs require the user get points -- most often by uploading some viruses. So a young adult, who has a natural curiosity, and a natural need to belong, and who reads endless message "threads" which expound on the "benign" viruses and how viruses are not illegal, and therefore are OK, sometimes succumbs. But in order to get to the viruses, he must usually provide some. The simplest way to provide one is to create one, then upload it. There are even programs (the "Virus Creation Lab" is one) which allow users to pick various characteristics of their desired virus from a group of menu selections, then the program will automatically create the virus with the desired characteristics for the user. Poof -- no programming needed! Another virus is born.

Ethics

We are in a unique time. Most computer users do not have parents who are also computer users. Therefore, the majority of computer users never got the same kind of sand box training for computing ethics and etiquette from our parents which guides our social interactions in the non-computing world.

In fact, the ethics of computing are no different than the ethics of any other social interaction. The problem is that many young computer users (and some adult one's too) never quite figure out that networked computers are in fact, a community, that this community is composed of people, and that wreaking havoc around the community is harmful to those same people.