Interest in securing and protecting the network systems of enterprises from various forms of viruses continues to grow as the threats become more sophisticated, powerful and harmful than ever.

?Securing the basic anti-virus solutions is no longer enough to prevent these new threats from attacking or getting into the network system,? lamented Michael Poyaoan, country manager of network security firm Fortinet in an interview with Computerworld Philippines.

With the evolution and proliferation of viruses, enterprises that have already installed a single layer of security like an anti-virus firewall are still encouraged to deploy additional anti-virus software to lessen the chances of being hit and damaged by these viruses, he said.

A study conducted recently by Trend Micro tallied more than 7,500 viruses and worms in the first quarter of 2005, up a hefty 300 percent from the same period in 2004 and 200 percent more than the previous quarter.

To adequately counter these various threats, more companies are now willing to invest in multilevel protection and not just in gateway or desktop security, Charles Cousins, managing director of anti-virus firm Sophos, told Computerworld Philippines.

Trend Micro?s senior anti-virus consultant Jaime Lyndon Yaneza said the security industry has moved away from product-based solutions to the new business model of services to more efficiently address the security requirements of the enterprise.

?As threats against computers and their underlying online services have grown, so have the features provided by anti-virus vendors,? he noted. Consolidated anti-virus items that include anti-virus, anti-spam and e-mail policy gateway protection were among the most popular products last year.

Unwilling to spend

Cousins, however, observed that although security awareness is quite high in the Philippines and even comparable to western standards, the willingness to spend remains low as many enterprises continue to treat information technology security as a ?nice-to-have? rather than a ?must-have.?

?Currently, multinational corporations and larger companies have keen awareness of the value of security, so do banks, financial services firms, telecommunications companies, the government and the military. But small and medium enterprises (SMEs) may need to take some time before they see the value of good security,? said Poyaoan. A recent Microsoft Corp. survey shows that almost 75 percent of PC consumers still do not deploy up-to-date virus protection.

Peter Firstbrook, senior research analyst at research firm Meta Group Inc., expects anti-virus vendors to expand their detection and repair capability as new profit-motivated threats such as identity theft and spyware dominate in 2005 and beyond.

Spyware is now seen more as a productivity threat than a true security threat as it destabilizes PCs and consumes valuable bandwidth and help desk resources.

A report from security firm Kaspersky Labs stated that classic e-mail worms are on the decline, but spyware, instant messaging, and network worms are taking over.

Last year, spyware infections became a bigger problem than e-mail viruses for most organizations.

Meta Group cited user reports showing that spyware increased from an insignificant help desk issue in 2003 to 20 percent to 40 percent of help desk calls in 2005.

The unwanted programs reportedly generate around US$2 billion a year in revenues for the companies that create them. Spyware is present in 88 percent of consumer PCs and 87 percent of corporate machines.

?We expect virus propagation to continue to be robust in 2005, but see a decline in 2006 as a result of more widespread use and evolution of anti-virus software as well as a shift in focus of budding virus writers,? said Firstbrook.

Mobile phone viruses

Firstbrook also projects a higher incidence of viruses infecting mobile platforms such as smart phones, personal digital assistants, and automobile on-board computers.

Last year, the first virus infecting pocket PCs and cell phones emerged in the country. It included a variation that uses Bluetooth connections to spread itself.

The first Trojan horse infecting mobile phones is also making its presence felt in the Philippines by stealing passwords and confidential data from users.

These viruses pose as downloadable games, programs and content. Once downloaded, they break down mobile phone security programs, immobilizing the functions of the infected handset.

Trend Micro cannot, as yet, gauge the damage being caused by the Trojan horse in the Philippine mobile arena since cell phones are not equipped with automatic virus reporting mechanisms, but Yaneza expects it to be ?really huge.?

Identity theft in corporate networks, through social engineering and phishing e-mails, is also reportedly increasing this year. Identity thieves steal an employee?s LAN (local area network) credentials and log on to networks using legitimate passwords with little fear of setting off alarm bells. To combat this, PCs are beginning to ship units with fingerprint readers, USB keys, and one-time passwords.

By 2008, the Meta Group expects 75 percent of laptops to have full disk encryption.

Internet attacks are also on the rise this year, with the viruses becoming more lethal and more difficult to detect.

Ian Shelmerdine, executive chairman Network Box Corporation Ltd., noted that 92 percent of organizations in the U.S. that conducted their businesses electronically have suffered a breach, with 72 percent experiencing financial losses. He said 82 percent of these organizations suffered from computer viruses. Of the total number of organizations, 98 percent had firewalls in place on their networks and 99 percent used anti-virus software.

Microsoft service

In line with industry efforts to produce anti-virus programs that are powerful enough to combat ever-evolving threats, software giant Microsoft plans to enter the consumer anti-virus business as part of a subscription service it aims to offer next year.

Microsoft has been developing the service for three years and is currently conducting a company-wide trial of the service dubbed Windows OneCare. The service will include virus and spyware protection as well as PC backup and performance-enhancing functions for PCs running on Windows. The Microsoft service is seen directly competing with Symantec and McAfee, the major publishers of anti-virus software and other utilities for Windows PCs.

?We are prepared to compete in a combination of technology and the backend infrastructure to support it,? stated Symantec, whose products include Norton Anti-virus and Norton Utilities.

?By the end of 2005, we expect anti-virus vendors to dominate the enterprise market, while Microsoft will be the predominant choice in the consumer market,? said Firstbrook.

As the evolution of viruses pushes more companies to invest in security, security budgets of local companies are expected to increase from 5% to 8% in 2007.

Research firm Radicati Group expects the global enterprise security market to grow from $3.4 billion in 2005 to $6.6 billion in 2008.

?The global market exceeds $2 billion in annual sales. For the Philippines, it?s up to about $10 million already,? noted Cousins.