Computer virus experts may learn from disease

SEATTLE--A worst-case disease for humans would have 100 percent chance of transmission, zero incubation time, and leave the host infectious for a long period.

Few, if any, biological diseases come close to that description, but many computer viruses do, said Daniel Geer, chief scientist at security firm Verdasys.

		Get Up to Speed on... Enterprise security Get the latest headlines and company-specific news in our expanded GUTS section.

"A (typical) virus mimics the properties of a worst-case disease," he said during a keynote speech that kicked off the Black Hat Windows security conference here.

Geer said that computer systems face threats that would be considered unacceptable if analyzed from the standpoint of other fields of study, such as the risk analysis done by insurance companies or the medical establishment's study of diseases and epidemics.

Geer is well-known for co-authoring a paper that outlined the threat Microsoft's dominance poses to critical infrastructure. He is equally famous for subsequently being fired from a security firm that counted Microsoft as a client.

Yet the paper simply repeated ideas that were already known in the security community, he said.

The dangers of a software "monoculture is not a new idea," he said, adding that awareness of the problem is growing. "Nothing is so powerful as an idea whose time has come."

		Special report Seeds of destruction Agriculture epidemics may hold clues to Net viruses.

A proposal to study so-called monoculture threats was submitted more than a year ago--well before the paper written by Geer and six other security researchers. The study gained funding from the federal government last November. Moreover, a committee of computer science departments from major universities in the United States pointed to computer virus epidemics as a problem that the government should give the most attention to solving.

Geer said that other industries have already learned the lessons of monocultures. Insurance companies, for example, tend not to insure all the houses on a single street because of the chance for a catastrophe: If one house burns, the others are likely to catch fire as well.

Geer said cross-disciplinary thinking has benefits, because computer security experts invariably come from some other field. As university students begin to graduate with specialized degrees in the subject, it is important to learn from other fields of study, he said.

"We must do our utmost to mine those fields for more information," he said.