January 11, 2005 Testing Security Software By Tim Klemmer CEO, OnceRed LLCThis is
fourth in a series of articles highlighting reasons why we need a new model for anti-virus and security solutions.
Reason #3: Security Software Testing Ever ask yourself
following question as you’re standing in
aisle at CompUSA or Best Buy: how well will this piece of software work with my other programs? Probably not. There is a high expectation that whatever piece of software you buy will work acceptably on your computer and won’t infringe on other programs.
Games, word processors, spreadsheets, music players are just those types of self-contained software programs that you wouldn’t expect any trouble from. And for
most part, you don’t experience problems.
Security software, on
other hand, by its very nature is more invasive and more likely to intrude on your way of computing. First and foremost, all good anti-virus software packages install on-access/on-demand scanning. This means that every time you start up a program, every time you access a document or spreadsheet, every time you access a directory in Explorer,
anti-virus program will scan it for viruses. Unfortunately,
consequence of this is that it slows down your computer. Unfortunately still, all vendors set on-access/on-demand scanning up as
default when you install
software. They have to.
When you install security software it has to install itself in such a way that it will always have
upper hand when new programs are run on a PC. Why? For
simple reason that you are installing this software to protect you from bad software. Security software tries to analyze anything you do on your computer and decide if it is a good thing or not.
But will
software make good decisions? Will this software cooperate with other programs? Security vendors have spent years perfecting their testing and testing against enormous suites of commercial software. But they can’t test every combination of software, every different version of software (there are still PCs out there running DOS 3.0 programs). They have to concentrate on mainstream. The problem is they may have no idea that your video card in combination with those two older games you installed will wreak havoc with their detection algorithms.