Xref: utzoo news.sysadmin:1534 comp.misc:4092 Path: utzoo!attcan!uunet!peregrine!elroy!ames!mailrus!tut.cis.ohio-state.edu!bloom-beacon!bu-cs!purdue!spaf From: spaf@cs.purdue.EDU (Gene Spafford) Newsgroups: news.sysadmin,comp.misc Subject: A survey: forwarded by request Message-ID: <5449@medusa.cs.purdue.edu> Date: 16 Nov 88 23:15:18 GMT Expires: 30 Nov 88 23:15:18 GMT Sender: news@cs.purdue.EDU Reply-To: RBMCKINN@cc.utah.edu Organization: Department of Computer Science, Purdue University Lines: 233 The following is posted as per the enclosed request. --spaf I understand from our system administrator that you are collecting some data on the recent computer virus. I am part of a student team here at the Univ. of Utah that has put together the enclosed survey on computer viruses, that we would like to disseminate and get responses to. We thought that using the NEWS network would be a good way to get responses from a wide variety of sites. Unfortunately, we don't really have a posting program here. Can you help? We would like to post this to the comp.sys groups, and invite responses from the readers, but can only post to moderated groups. Thank you very much for your time and consideration. Yours truly, Robert McKinnon = RBMCKINN@cc.utah.edu COMPUTER VIRUS SURVEY We need your opinion! Computer Viruses are becoming painfully apparent now days. In the past month a serious attack by a virus created by a Cornell University student disrupted the use of over 6000 computer systems. Some authorities have suggested that these viruses have reached "epidemic" levels. Yet, there seems to be no clear idea as to what should be done about them; both the viruses, and their creators. This is where we need your opinion. What do you think of the situation, and what do you think ought to be done? The National Security Agency (NSA) has suggested that by publicizing virus attacks we give incentive to more hackers to try their hand at writing one, and that educating the public on viruses would only result in more "virulent strains" being produced. They encourage repression of virus information. Others, notably Harold Highland-editor of "Computers & Security", have encouraged public awareness and education on the issue, and particularly the training of systems ops and managers in the methods of preventing, recognizing and dealing with virus attacks. Which approach should be followed? Let us know what you think by sending us EMAIL through the mail address given below. We will compile the data, and report on it later. We can only hold this survey open for a week to 10 days, so please respond early. SEND RESPONSES VIA EMAIL TO: rbmckinn@cc.utah.edu ============================================================== VIRUS SURVEY QUESTIONNAIRE 1. Occupation: with regard to your current (or most recent) occupation, which of the following phrases best completes the following sentence? "In my current (or most recent) job/career I ... a. am (was) heavily involved with computers." b. am (was) not directly involved with computers, other than an occasional use for word-processing, etc." c. am (was) not really involved with computers at all." d. may (did) not use computers, but I manage(d) a company/office that does (did)." e. don't (didn't) use computers, but I use(d) one at home." 2. If your answer to question 1 was "a", please pick the title below that best defines your job: (you may select more than one.) a. Systems Analyst. b. Systems/LAN manager. c. Computer equipment purchasing agent. d. Computer Operator. e. Senior Programmer. f. Junior Programmer. g. Other. (Please describe.) 3. Which age group do you belong to: a. 11 - 20 b. 21 - 25 c. 26 - 30 d. 31 - 35 e. 36 - 40 f. 41 - 45 g. 46 - 50 h. 51 - 55 i. 56 and over. 4. Gender? Male Female 5. Do you own a personal computer? Yes No a. If you do, do you also own a modem? Yes No 6. Do you use any anti-virus programs? Yes No a. If so, please list their names, cost, and describe their effectiveness. -------------------------------------------- A. The media has exaggerated the seriousness of the computer virus threat. 1 --------- 2 ---------- 3 ----------- 4 ----------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree B. Since most virus programs are benign and generally are just meant as harmless pranks, we should not be overly concerned about them. 1 --------- 2 ---------- 3 ----------- 4 ---------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree C. Computer viruses are a real threat to our national security. We should take severe steps against those who create them. 1 --------- 2 --------- 3 ---------- 4 ----------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree D. It is impossible to adequately protect a system from infection by a virus, so it is not worth the effort and expense of trying. 1 --------- 2 --------- 3 --------- 4 ---------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree E. Current computer crime laws do not serve as a good deterrant to discourage virus creators. 1 --------- 2 --------- 3 ---------- 4 ----------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree F. I believe that the existing "vaccine" programs, which claim to "inocculate" against viruses, are effective to about the following degee: 1 2 3 4 5 0 - 20% 20 - 40% 40 - 60% 60 - 80% 80 - 100% Effective Effective Effective Effective Effective G. Extremely strict laws specifically designed to punish and deter the writing and use of virus programs should be created and enforced without delay. 1 ----------- 2 ---------- 3 ---------- 4 ---------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree H. I believe that the computer system I use or manage is adequately protected against virus attack. I do not plan any further protection. 1 ---------- 2 ---------- 3 ---------- 4 ---------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree I. The National Security Agency has the right idea, the less said about computer viruses, the less likely we are to see more of them. 1 --------- 2 ---------- 3 ---------- 4 ---------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree J. Not only should we do more to educate the public, but every school that offers computer courses should include a course specifically about the detection and handling of computer viruses. 1 -------- 2 ---------- 3 ---------- 4 ----------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree K. The Cornell Student who recently messed up so many systems recently with what he calls an "accidental" virus, should be prosecuted to the full extent of the law. 1 -------- 2 --------- 3 ---------- 4 ---------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree I. There is currently no single good source for information on computer viruses. Someone should create one. 1 ---------- 2 --------- 3 ----------- 4 ---------- 5 Strongly Somewhat No Somewhat Strongly Agree Agree Opinion Disagree Disagree =============================================================== Finally, please tell us your war stories! If you have ever had an experience with a virus, please tell us about it. You may of course comment on anything else you think we ought to know. THANK YOU VERY MUCH FOR YOUR COOPERATION! Robert B. McKinnon Dan Gill Computer Science, U of U Elect. Eng., U of U Bill Shunn Thomas Vu Computer Science, U of U Elect. Eng., U of U -- Gene Spafford NSF/Purdue/U of Florida Software Engineering Research Center, Dept. of Computer Sciences, Purdue University, W. Lafayette IN 47907-2004 Internet: spaf@cs.purdue.edu uucp: ...!{decwrl,gatech,ucbvax}!purdue!spaf