Watch Out: Viruses Will Only Worsen

Corporations were hit with a monthly average of 113 virus infections for every 1000 PCs they owned in 2001, according to the seventh annual survey of virus prevalence in the enterprise conducted by ICSA Labs, a division of security services firm TruSecure.

"Every year it seems like the percentage of coverage [of antivirus tools] gets better, and every year it seems like the virus problem gets worse," says Larry Bridwell, content security programs manager at the ICSA Labs, discussing the results of the survey.

The survey took place over the course of 20 months from January 2000 to August 2001. It surveyed 300 companies that each had at least 500 PCs, two local area networks, and two remote workers. The survey focused primarily on machines running on Intel chips with Microsoft operating systems.

Over the course of the survey, 666,327 desktop PCs and workstations were infected with viruses, along with 26,492 file or print servers, Bridwell says. Those figures translate to the 113 infections per 1000 PCs per month figure, he says. The majority of the viruses spread through e-mail, Bridwell says, noting that mass mailers accounted for around 80 percent of the viruses identified in the survey.

Expect More DOA PCs

The most common effect of a virus infection, reported by 70 percent of respondents, was rendering a PC unavailable to the user, the study found. Sixty-nine percent of respondents said that viruses had cost productivity, while 37 percent reported loss of data due to viruses.

Twenty-eight to thirty percent of respondents said they had experienced a virus disaster, defined by ICSA as any event in which a single virus infects more than 25 machines, files, or pieces of storage media in roughly the same time. That figure was slightly down from previous surveys, Bridwell says.

And the virus picture doesn't look to brighten much in the future, he says.

"The virus problem continues to worsen," Bridwell says, adding that the likelihood of disasters will also increase as more worms like Code Red and Nimda, which spread through multiple methods, are released.

Because the problem will get worse, "there's going to be an increase in protection and recovery costs," he says.

Tips Offered

Bridwell identifies a number of steps that companies can take to avoid these pitfalls. Network perimeter protection, desktop antivirus, and good policy development and enforcement are all key, he says.

"Perimeter protection can arguably be one of the most important assets in the corporate security strategy," he says. But "perimeter protection is not a replacement for desktop and server protection."

Perimeter protection involves scanning for viruses as they enter the corporate network from the public Internet.

"The value of desktop protection can't be overemphasized," he says.

Bridwell also urges companies to filter attachments, especially those with files types that are frequently used in viruses, such as .exe, .vbs, and .pif, and to subscribe to a security alert service to receive early warnings of possible trouble.