January 29, 2004 12:40 PM PST

Computer virus experts may learn from disease

Related Stories

MyDoom virus declared worst ever

January 29, 2004

MyDoom variant targets Microsoft

January 28, 2004

Seeds of destruction

January 15, 2004

A 20-year plague

November 25, 2003

Damage control

February 6, 2003
SEATTLE--A worst-case disease for humans would have 100 percent chance of transmission, zero incubation time, and leave the host infectious for a long period.

Few, if any, biological diseases come close to that description, but many computer viruses do, said Daniel Geer, chief scientist at security firm Verdasys.


Get Up to Speed on...
Enterprise security
Get the latest headlines and
company-specific news in our
expanded GUTS section.


"A (typical) virus mimics the properties of a worst-case disease," he said during a keynote speech that kicked off the Black Hat Windows security conference here.

Geer said that computer systems face threats that would be considered unacceptable if analyzed from the standpoint of other fields of study, such as the risk analysis done by insurance companies or the medical establishment's study of diseases and epidemics.

Geer is well-known for co-authoring a paper that outlined the threat Microsoft's dominance poses to critical infrastructure. He is equally famous for subsequently being fired from a security firm that counted Microsoft as a client.

Yet the paper simply repeated ideas that were already known in the security community, he said.

The dangers of a software "monoculture is not a new idea," he said, adding that awareness of the problem is growing. "Nothing is so powerful as an idea whose time has come."


Special report
Seeds of destruction
Agriculture epidemics may
hold clues to Net viruses.


A proposal to study so-called monoculture threats was submitted more than a year ago--well before the paper written by Geer and six other security researchers. The study gained funding from the federal government last November. Moreover, a committee of computer science departments from major universities in the United States pointed to computer virus epidemics as a problem that the government should give the most attention to solving.

Geer said that other industries have already learned the lessons of monocultures. Insurance companies, for example, tend not to insure all the houses on a single street because of the chance for a catastrophe: If one house burns, the others are likely to catch fire as well.

Geer said cross-disciplinary thinking has benefits, because computer security experts invariably come from some other field. As university students begin to graduate with specialized degrees in the subject, it is important to learn from other fields of study, he said.

"We must do our utmost to mine those fields for more information," he said.

 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.