Spyware 'standards' set by security consortium

At a time when the number of spyware applications doubles each year, security companies -- including Symantec, McAfee, Trend Micro and ICSA Labs -- have banded together to find ways to eliminate confusion about how to test security products.

"Few product testers currently document their test samples or methodology," the companies said in a statement. "Many use very small sample sets in their testing environments. As a result, there is no distinguishable benchmark for comparison."

The software makers are part of a larger organisation, called the Anti-Spyware Coalition, which is working to standardise industry terms and technology for battling spyware.

The coalition will also provide its members with some protection over legal issues surrounding applications that are created to monitor users' activities and could be defined as spyware -- but only if they were installed without the system administrator's knowledge or permission.

Adam Biviano, premium services manager at Trend Micro told ZDNet Australia that one of the most contentious issues for security companies is defining exactly what can be defined as spyware: "You end up circumventing the legal problems by some degree by not calling everything spyware -- really it is categorising software."

According to Biviano, one of the biggest benefits of standardising spyware categorisation will be to let customers decide which applications can run.

"It gives the customers the choice of detecting and/or blocking certain [applications]. If the user decides to allow something to run because they have agreed to the terms of that software they can simply add it to the exceptions list," he said.

Next on the group's agenda: Defining threat-naming conventions, intelligence-sharing best practices, and emergency information distribution guidelines. The group said it will use definitions already created by the Anti-Spyware Coalition.

In September, the US Computer Emergency Readiness Team launched the Common Malware Enumeration initiative, a similar scheme also supported by Symantec, McAfee and Trend Micro aimed at standardising the names of new malware (malicious software) threats.