SECURITY
Virus writing course attracts criticism
29-05-2003
by Andrew McLindon
Plans by a Canadian university to offer a course in virus writing have not been warmly received by Irish security and IT experts.
According to reports, the University of Calgary is set to give its fourth-year computer science students the opportunity to take a module called "Computer Viruses and Malware." Those taking the course will be taught how to write and test their own viruses.
Ken Barker, head of the University's computer science department, said that such a class is needed to better understand what motivates those who write malicious software, which he says is a growing problem.
"Somebody who is suggesting we are doing enough really has their head in the sand," Barker told CNET. University officials also noted that information on how to write viruses is already easily accessible.
However, at a time when viruses are rampant and are causing increasing damage, the move has not gone down well in some quarters.
UCD's Chair of Computer Science, Professor Mark Keane, said the initiative was "not helpful." He added, "It is a bit like attempting to stop people taking hard drugs by teaching them all about them, how to take them and then giving them the drugs," he commented. Professor Keane laughed off the idea of UCD offering a similar course in the next college year. "I don't think we will be," he insisted.
Dermot Williams, managing director of IT security firm Systemhouse Technologies, was not as critical about the idea, but added that he wasn't comfortable with it either.
"I am glad to see that the classes will take place in a closed lab, which will hopefully mean that the viruses cooked-up there don't escape. However, I would be more reassured if the students were also being taught about digital ethics. If they aren't, and I do not know if they are or not, then those who have had the thrill of creating their first virus and watching it spread in a safe environment might be tempted to continue their studies in the real world," commented Williams. "If I was teaching an IT security course, I would not be teaching this subject in this manner," he added.
However, some anti-virus companies have been extremely critical about the idea. For instance, the joint chief executive of Sophos, one of the world's leading developers of anti-virus software, said the firm will not employ people who have taken such a course.
"Don't bother applying for a job at Sophos if you have written viruses because you will be turned away," said Dr Jan Hruska. "You are of no use to us. The skills required to write good anti-virus software are far removed from those needed to write a virus. With 80,000 viruses in existence there can be no excuse for teaching students on how to create more."
The plan has though been defended by Fred Cohen, a computer virus expert. He told CNET that it makes sense to let students interact with and create viruses, as long as there are safeguards in place.
Cohen, who allowed his students in the University of New Haven to do something similar during the previous college year, said that pupils can learn about viruses and how they spread by creating them. He didn't believe, however, that the University of Calgary course would enable its takers to get into the mindset of virus writers.
Caped Koala Studios has built a virtual world for kids, combining education and social networking 