The Truth about False Positives
You spent 6-months of your life and $60,000 of your company’s hard earned dollars with a software firm to develop a program that will save your company lots of money. Just as you are ready to roll out to thousands of eager viewers and get a pat on the back from your boss, the head of the IT Department calls and says they’ve detected viruses on the discs you produced and won’t allow them to play on their computers and network.
What? How did that happen? You partnered with professional developers from a top-rated firm. Unlike that sketchy restaurant you had lunch at yesterday, the development facility looked clean, so why is your program dirty?
Well, before IT gives your program the smack-down, pause and ask your development firm to have the “infected” files reviewed by the security software your IT Department uses to ensure that the files are truly a virus. If the files are not infected with a virus, then the alert was a false positive. No, that isn’t some geeky circular-speak. Industry-leading antivirus software company, Kaspersky Lab, defines a false positive as “another way of saying ‘mistake.’ As applied to the field of anti-virus programs, a false positive occurs when the anti-virus program mistakenly flags an innocent file as being infected. This may seem harmless enough, but false positives can be a real nuisance.”
I truly believe it’s the developer’s job to be aware of security issues. What developers can’t do is refer to a crystal ball to see what new definitions will be added to the plethora of anti-virus and security software (see list below). Even when software updates are provided, developers cannot predict all the situations which may trigger an alarm. To further taunt developers, one flavor of anti-virus software detects viruses based on “virus-like behavior” which will undoubtedly reports false positives constantly, because they are only guessing at what “might be” viruses. (www.PCGuide.com)
This is the issue that unhinges your IT Department. If users ignore alarms thinking they are false positives then when a real virus is found, a user will innocently allow it to work its black magic. And, as long as developers develop, hackers hack, and antivirus companies distribute updates there is no panacea to this dog-chasing-tail problem. From a leader who oversees a small business’s network and computers as well as software development, a blend of smart people, common sense, communication, and an ample touch of trepidation is the best formula for us to control the wild beast we call technology. As a marketer, you just need to be aware that issues like this can occur and with the proper balance of questioning, confirmation and patience, development firms can usually resolve the issue for little or no extra money.
Here is a short list of anti-virus software companies. Yes, I said short list, as there are plenty more programs that developers need to be aware of and test against.
- AVAST!
- AVG Anti-Virus
- Avira AntiVir PersonalEdition Premium
- BitDefender
- CA Antivirus
- ESET Nod32
- Ewido Antispyware
- F-Prot
- F-Secure Anti-Virus
- G DATA Antivirus
- Kaspersky
- McAfee VirusScan
- Norman Antivirus and Antispyware
- Norton AntiVirus
- Panda Antivirus
- PC Tools AntiVirus
- PROTEA ANTI-VIRUS - Lotus Domino
- Trend Micro
- ViRobot
- Webroot Antivirus
DISCLAIMER – JPL is not recommending the use or non-use of any product mentioned.
July 11th, 2008 at 11:10 am
As a non-tech who has to explain this to the execs, is this common?
July 15th, 2008 at 4:57 pm
Is it common? Yes and no. Like anything in life, there are no guarantees, especially when it comes to interactive software. A developer can only assure their software will work in regards to the requirements. It is impossible to guarantee software (including websites) can withstand hackers and malicious events. This is very similar to how insurance companies include that bittersweet clause regarding “acts of God.”
Probably one of the most damaging false positive to business occurred in May of 2007 in China, as a virus signature update to Symantec Corp.’s security software mistook critical Windows files for malware which warranted thousands of Chinese PCs unbootable—many of whom were Enterprise users.
Right before the millennium, when I was managing multimedia projects I faced my first annoyance with false positives. Norton Antivirus would send a false-alarm on Macromedia’s Flash Player and any files created by Flash. As soon as the problem was uncovered, Symantec and Macromedia (now Adobe) participated in a joint effort to confirm that these were alerts were false positives. You can still find the release statement if you dig around the Flash website. Norton Antivirus has long since stopped false-alarming on Flash files, however false positives still occur and it is difficult for developers to address and understandable for IT security to panic when an alarm does occur.