In an IT World article, Tom Henderson gives many details about a US-government-led CDC-like organisation to fight malware. In summary, he states that companies and consultants providing security and prevention around operating systems don’t have any real motivation to eradicate malware. And in case of an “outbreak” of these malware, he added one needs a US government body to look after every computer “health”, coordinate the surveillance and the response. He even pushes the comparison with the human medical system by introducing a Hippocratic Oath for computer healthcare.
With all the respect I have for someone I’ve never heard of before, I think Tom Henderson misses one crucial point that make his flight of lyricism totally irrelevant. The missed point is that human beings (as well as every animal species and especially vertebrates) have a immune system. It’s our immune system that gives the first answer to any external “invasion”, it’s our immune system that can adapt to the diversity of threats out there, it’s our immune system that allow our body to recover.
Today computers have a nice body, nice mechanics. Operating systems are behaving like we tell them, not as separate entities. We constantly add foreign bodies (software) and they are constantly in contact with potential external aggressions (via file exchanges, media insertion, network connections). What we begin to give them are sentinels monitoring critical parts of the system, a kind of basic neural system. We invented the body-in-the-body (virtualization) to prevent one failing organ (software) to contaminate the remaining parts of the body (a.o.). We also give some vitamins (firewalls e.g.), strengthening some defences. And finally we think that “anti-virus software” are enough while it’s only some kind of very basic, un-natural innate immune system.
Before thinking of a CDC-like body for our computers security, one should maybe think of adding a immune system to our computers. At least a basic one, where there is a response even to currently unknown threats. Then we might think of something more sophisticated, with memory and specific response. Look, there was no network, no communication outside: the body/computer can easily cope with the threat by itself. Research is already looking at such applications. And, yes, finally, if you insist, bring your CDC-like organism.
Jean-Etienne's blog 