Very valuable viruses

Instead of just selling traditional antivirus software, resellers can now offer advice on how to stop the next big attack.

In the ever-competitive antivirus software market, resellers need to offer their customers that little bit extra if they are to maintain and win new business.

The 800 or so new viruses being discovered each month now offer resellers a great opportunity to sell a new kind of value-added service.

Instead of just selling traditional antivirus software, which detects and protects against known viruses, resellers can now offer advice on how to stop the next big attack.

One threat-reduction feature blocks potentially dangerous executable code at the email gateway. This will not only bar known viruses, but will prevent new ones from reaching company desktops.

For example, blocking files with more than one file extension could have prevented infection from infamous viruses such as the Love Bug, Badtrans and Sircam.

Many viruses arrive as an attachment with a double extension (for instance, ANNAKOURNIKOVA.JPG.VBS) to try to convince users that they are harmless.

Users are unlikely to need files with double extensions, so blocking them is unlikely to restrict everyday business activities. Files with double extensions can always be quarantined, so they can be examined first and released if required.

Other means of threat reduction include creating a list of disallowed file types. Viruses use a number of file extensions to spread and, depending on the needs of an individual organisation, some or all of them can be blocked.

Clearly, there needs to be a balance between security and functionality, but depending on the size and nature of a business, measures such as stopping all executable content - regardless of extension - may be appropriate.

Threat reduction is beneficial to both resellers and their customers. It not only helps stop the most widespread viruses, but it helps to enforce a policy within businesses that will ensure all new code gets onto desktops via the company's IT department.

As a direct result of this, there is no chance of games, screensavers or even pirated material clashing with existing software.

This value-added service gives resellers the chance to use their expertise to educate customers, and for customers to have an extra layer of protection from viruses. The result: safer computing all round.

Graham Cluley is senior technology consultant at Sophos Anti-Virus.