--------------------------------------------------------------------------------
The Future of Viruses on the Internet
Lots of Little Tremors, a Few Big Quakes
There are many different phenomena, both natural and man-made, that come in different sizes. In many cases, the small things come quite often, and the big things only rarely. Small earth tremors are much more common than large earthquakes. Slight rises in the level of a river are much more common than floods. Virus incidents that involve only a few machines are much more common than major outbreaks involving hundreds of systems.
When the distribution of incidents is skewed in this way, we tend to get good at handling the small incidents; they become routine and expected, and our solutions will be efficient and well-tested. Large incidents, since they happen rarely, are handled on a more ad hoc basis; maybe we know who will be on the Crisis Team (assuming that someone's remembered to update the list as people changed jobs), but exactly what the team will do once it's assembled will be determined on the fly to fit the case. That's why the Crisis Team has to contain some of the best people we have available.
Conditions change. If the probability of a large incident increases rapidly, we can be caught unawares, and the number of large incidents can easily overwhelm an ad hoc crisis-based approach that depends on large problems being few and far between. On the other hand, if we can see the change coming, we have a chance to develop methods that can handle the majority of large incidents as smoothly as we already handle the small ones.
How will the continued growth of the Internet change the pattern of virus spread and similar threats? Is our current paradigm of virus containme ...