For all of the news they generate, computer viruses today are more of a chimera than a truly destructive beast, if experts are to be believed.
David Ferris, president of San Francisco-based Ferris Research Inc., said computer viruses are becoming “trivial” and more of a technology than a management issue. Ferris Research calculated that a 1,400-employee company could expect about four outbreaks in 2002, affecting only individual users. Each outbreak costs about US$100 per user.
Dealing with the virus scourge is an example of IT and management solving the technical, educational and policy issues in concert. Antivirus software, with its auto-update capabilities matched with almost instantaneous antiviral patches, are now capable of snuffing most virus outbreaks quickly. Those that persist, such as Klez, are more of an irritant than a serious problem.
Companies today are also making sure their own employees are not part of the problem, but rather the solution.
For David Wilson, CIO of the Regional Health Authority Number Four in Regina, user education is of paramount importance.
The Health Authority has a multi-pronged education approach to make sure even those viruses that might get through are not a problem, Wilson said. Since the Health Authority’s employees use specialized, health-related laboratory applications more often than typical office software, they are trained specifically on these applications, with antivirus awareness as part of the training.
Wilson’s team has antivirus software “all over the place.” It runs on the servers, desktops and firewalls, all of it kept up-to-date. There are also internal communications so if an outbreak does occur, everyone is aware without delay, he said.
The viruses that do get through tend to be rather localized, which agrees with Ferris’s statistics.
Wilson’s group has been successful at picking up and filtering out the viruses at the firewall level but those that do make it have been stopped at the desktop.
“We have had a couple of situations where a desktop has gone down, but that is as far as the penetration has gone,” he said.
But Wilson said he knows of other health districts that have been taken down for a day or more by viruses.
Companies also have far better corporate policies, not just technology, in place to deal with the virus problem, Ferris said.
“Organizations are getting better and better at having contingency plans in place,” he said. “As soon as someone finds a virus, tech support is brought in, all users are warned and mail servers are scanned to find those messages that have gone through.”
Corporate policy also makes it more difficult to execute attachments, he added.
No problems here
“From our own internal perspective, I would have to agree with [Ferris Research] because we have not really experienced a lot of internal problems with viruses over the last three or four years,” Wilson said.
Even antivirus guru Symantec Corp. agrees that viruses are under better control now than years gone by.
There have not been a lot of the level four viruses lately, said Michael Murphy general manager Canada Symantec Corp. Toronto. “I can’t even think of a three recently.” Code Red and Nimda were level four viruses. There has never been a level five, Murphy said.
And he has a partial theory as to why – the summer months are slower since kids are not in school with access to networks, he said. “[We] have seen this same pattern for the last 10 years.”
Regardless, everyone agreed companies should not let their guards down assuming the virus plague is vanquished.
“I think it is absolutely clear to everybody…that they have to maintain guard,” Ferris said.
Murphy agrees. “Don’t focus on the number that are created but rather the complexity and damage they can cause…they are getting more virulent.”
