ICSA Labs 10th Annual Virus Prevalence Survey 2004.pdf - Craig ...

More documents

Recommendations

Info

ICSA Labs Virus Prevalence Survey 2004Survey ObjectivesThe objectives of this project are to examine the prevalence of computer viruses in mid- andlarge-sized organizations; describe the computer virus problem in computer networks,including desktop computers, application and file servers, and perimeter devices such asfirewalls, gateways, and proxy servers; and observe trends in computer virus growth,infection methodologies, and attack vectors. The scope of the survey report includes Intelbasedor Intel-compatible PCs 1 at sites with more than 500 PCs, multiple LANs, and two ormore remote connections. We surveyed only the commercial, government, and industrialbusiness sectors.Research MethodologyCONFIDENCEData was collected from 300 qualified respondents. The sample size provided an accuracyrate of ±6 percent with a confidence limit of 94 percent for questions that relate to the entiredata sample.SELECTIONWe selected survey participants from a qualified list of sites with 500 or more PCs, two ormore LANs, and two or more remote connections at that site. We also screened respondentsto insure that they were the persons most responsible for computer virus protection withintheir organizations.ROUNDINGOccasionally percentages will total more than 100 percent because some questions allowedfor multiple responses. In some cases, rows or columns in tables may total either 99 percentor greater than 100 percent due to rounding. Likewise, charts or graphs may show less than100 percent due to the exclusion of Don’t Know, Refused, or Other responses.PREVIOUS WORKSome 2004 survey results will compare directly with the results of five previous surveys 2 :A previous survey conducted for ICSA during January through Feb 2004A previous survey conducted for ICSA during January through Feb 2003A previous survey conducted for ICSA during January through Feb 2002A previous survey conducted for ICSA during May through June 2001A previous survey conducted for ICSA during May through June 20001Data gathered for Macintosh and other non-Intel servers and workstations may be referred to; however, they will only beconsidered anecdotal in this report.2 Data from surveys from 1996, 1997, 1998, and 1999 is considered when applicable.Copyright 2005 ICSA Labs, a division of Cybertrust, Inc. All Rights Reserved.This information may not be incorporated into any other work and may be reproduced only with the express written permission of Cybertrust, Inc.Page 3
ICSA Labs Virus Prevalence Survey 20042004 DEMOGRAPHICSPrincipal FindingsThe 2004 survey represents a total of 947,632 desktops, servers, and perimeter gateways. Theaverage site in the survey had 3,002 PCs (the median was 1,325) and 157 file and applicationservers (median was 59).HOW COMMON ARE VIRUS ENCOUNTERS?All of the companies responding to the survey experienced at least one virus encounterduring the survey period.These organizations experienced more than 3.9 million encounters during the 12 monthperiod from January 2004 through December 2004. This translates to 392 encounters per1,000 machines per month over the survey period, with a rate of 116 infections per site permonth by the end of the survey period. This rate continues the trend of an increase ininfection rate each year. Most noteworthy is the marked increase in encounters versus actualinfections. For the purposes of this survey, an encounter is anytime a virus has beenencountered and dealt with in some fashion, but not necessarily activated. Examples ofencounters may be finding an infected file on a backup diskette or tape, filtering, blocking,otherwise intercepting files at the gateway, or detecting a virus in a downloaded file or anactual activation and propagation.In a comparison of the survey data for 1996 – 2004, Figure 1 shows that from 1996 through1998, virus encounters show a steady rise of approximately 12 virus inflections per 1,000machines per month each year through 1998 and again from 1999 – 2001. The rate spikeanomaly from 1998 to 1999 specifically relates to the Melissa outbreak incident of 1999 andits mass mail payload. From 2001 to 2004, the increase per year remains rather level, with2004 showing the largest increase in infections since 1999. We derived this data bydetermining the average infection rates reported two months immediately before collectionof survey data. The prior two months (i.e., November and December) were used for comparisonbecause, historically, they produce the greatest accuracy in participant responses.Copyright 2005 ICSA Labs, a division of Cybertrust, Inc. All Rights Reserved.This information may not be incorporated into any other work and may be reproduced only with the express written permission of Cybertrust, Inc.Page 4
Page 1 and 2: ICSA Labs 10th AnnualComputer Virus
Page 3 and 4: SILVER LEVELMICROSOFT CORPORATIONFo
Page 5 and 6: Table of ContentsEXECUTIVE OVERVIEW
Page 7 and 8: List of FiguresFigure 1: Infections
Page 9: ICSA Labs Virus Prevalence Survey 2
Page 13 and 14: ICSA Labs Virus Prevalence Survey 2
Page 41: ICSA Labs is the security industry

ICSA Labs 10th Annual Virus Prevalence Survey 2004.pdf - Craig ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?