January 29, 2004 12:40 PM PST
Computer virus experts may learn from disease
Few, if any, biological diseases come close to that description, but many computer viruses do, said Daniel Geer, chief scientist at security firm Verdasys.
Get Up to Speed on...
Get the latest headlines and
company-specific news in our
expanded GUTS section.
Geer said that computer systems face threats that would be considered unacceptable if analyzed from the standpoint of other fields of study, such as the risk analysis done by insurance companies or the medical establishment's study of diseases and epidemics.
Geer is well-known for co-authoring a paper that outlined the threat Microsoft's dominance poses to critical infrastructure. He is equally famous for subsequently being fired from a security firm that counted Microsoft as a client.
Yet the paper simply repeated ideas that were already known in the security community, he said.
The dangers of a software "monoculture is not a new idea," he said, adding that awareness of the problem is growing. "Nothing is so powerful as an idea whose time has come."
Seeds of destruction
Agriculture epidemics may
hold clues to Net viruses.
Geer said that other industries have already learned the lessons of monocultures. Insurance companies, for example, tend not to insure all the houses on a single street because of the chance for a catastrophe: If one house burns, the others are likely to catch fire as well.
Geer said cross-disciplinary thinking has benefits, because computer security experts invariably come from some other field. As university students begin to graduate with specialized degrees in the subject, it is important to learn from other fields of study, he said.
"We must do our utmost to mine those fields for more information," he said.