A senior Microsoft New Zealand executive, Terry Allen, confirmed this month that the company’s antivirus plan includes “behavioural” strategies, monitoring the kind of actions viruses attempt to perform on a computer system, rather than relying wholly on signatures. The conventional strategy of regular updates to a database of malware signatures is becoming more and more difficult to sustain as the lag between Microsoft’s notifying an exploitable bug in its software and the first hacker exploitation of it becomes shorter, says Allen, the manager of Microsoft's enterprise sales and partner group. With Nimda, three years ago, the interval was almost a year; for the recent Sasser worm, it was 18 days.
|