Virus protectors get a brand new bag

Anti-virus software is quickly going the way of the browser -- soon to be free and ubiquitous, said industry insiders Friday at the Virus Bulletin99 conference in Vancouver, Canada, on Friday.

Soon, every user will get free detection software, with security firms selling updates via the Internet at a monthly fee. Anti-virus services will also be sold to Internet Service Providers for resale to users. "In the future it won't be about protecting computers against viruses, but content security," said Larry Bridwell, program technology manager for security firm International Computer Security Association. With the number of threats against computers increasing -- viruses, hackers, privacy-invading companies, and good old-fashioned bugs, to name a few -- keeping content safe and the computer running is now Job No.1.

Consumers' desire for a single fix-it package is changing the economics of the industry, admitted Carey Nachenberg, chief scientist for the Symantec Anti-virus Research Center. "We're all afraid the retail channel will dry up," he said. An even more important factor: Viruses infecting computers via e-mail move far too quickly for companies to rely on manual updates to their software.

Last spring, for example, the Melissa virus infected hundreds of thousands of computers within 48 hours. "We're at a turning point right now," said Nachenberg in a keynote speech Thursday. "We need to re-examine our anti-virus software, and companies need to re-examine their anti-virus strategies."

Symantec is taking a two-pronged approach to the problem. With partner IBM (the anti-virus software maker is nearing completion of its "Digital Immune System." The technology automatically updates all subscribers over the Internet with virus recognition patterns whenever one of those computers encounters a new virus. Fixes for a new virus can be disseminated to all the machines on the network within as little as 30 minutes of encountering the first virus. The speed of the Internet, which viruses use to spread quickly, can now be used to get the cure out just as fast. "As we distribute information faster and more broadly, we have to be careful," said Steve White, senior manager of IBM's Massively Distributed Systems Research Division, who helped design the new Digital Immune System service. "It becomes much easier to get viruses over the Internet."

Symantec is also preparing to package its anti-virus software into a single integrated security suite that will give home users a firewall, Internet filtering software and anti-virus utilities, said Symantec engineers at the show. The product will be released later this month.

But even that stand-alone product will eventually be connected to the Digital Immune System service, providing virus updates extremely quickly. "The whole industry is going toward automatic fixes and automatic updates," said IBM's White. "The anti-virus vendors are just adopting it faster."

Symantec's rivals are working on similar strategies. "A lot of the basis of value of a stand-alone product in the home is going away," said Crag Kensek, director of product marketing for anti-virus firm Trend Micro. "For the non-technical home user, it's like insurance."

Trend announced in September its new eDoctor strategy, which allows ISPs to protect their customers from viruses by scanning each file downloaded from the Internet. U S West and Sprint Communications have signed on to the service. Rival security software firm Network Associates plans to release a similar technology to Symantec's called the AutoImmune System, early next year, its engineers said.

While finding and fixing viruses faster has piqued the interest of corporate network administrators, an automated system's ability to collect data on the number of virus incidents is equally valuable, said one administrator at the conference, who asked to remain anonymous.

Currently, the best source of such data is the Wildlist, and even that volunteer site would like to see better and more accurate statistics, said Sarah Gordon, one of the directors of the independently maintained Wildlist. "It would be extremely useful to get reports from these systems," she said. "We intend to pursue that in the future."

Take me to Hackers