Pragmatic Anti-Virus Testing

Exec3

Description

Pragmatic Anti-Virus Testing

Sujets

• Arts

Informations

• Publié par: onytodor
• Nombre de lectures: 39
• Langue: Français

Extrait

Reprinted by permission: VIRUS BULLETIN. SEPTEMBER 2001.

Pragmatic Anti-Virus Testing

Joe Wells

AVTestLab.com, USA

If our industry is to follow the pattern of the rest of the computing world, AV companies will

soon become application service providers and, before long, the service capabilities of AV

vendors will become the most important aspect of the industry. It is important that anti-virus test

methodologies are revised to reflect these changes in the use of AV products.

Mass-mailing threats have demonstrated the need to refocus testing. Once these threats appeared,

anti-virus ceased to be simply ‘a product’ and customer service became a critical consideration.

The AV company’s ability to respond rapidly to a time-critical threat has come to the fore.

Pragmatic testing addresses the more important issues relating to AV products, especially where

time and financial constraints play a part. While I believe such testing should include the

traditional issues, it should, in addition, be expanded to include the testing of anti-virus services.

Good Testing Requires Good Input

Companies and testing organizations can access two key resources for input on what needs to be

tested.

We can talk to technical managers in large corporations who deal with AV problems every day.

(Now, there’s a novel idea: ask users what they want to see tested.) This means it’s time to admit

that these people know their jobs and know what they need. In the past, some AV ‘experts’ have

interpreted user requests as ‘wants’ as opposed to ‘needs’. (‘We know better than the users. We’ll

give them what they really need.’) This ideology is wrong. We do not know the users’ situation

and environment better than they do. When they say they need something, they genuinely do need

it. We must listen to them – recognizing them as the professionals they are. Taking their requests

and suggestions into consideration will help us fulfill their needs.

There are resources available to us within our own industry. A testing organization can ask an AV

company how their product should be tested: QA staff should be asked what they test and how

they do it, and technical support staff should be asked what ‘really’ needs to be tested in a

product, based on their experience of the problems they have encountered.

Good Testing Requires Good Testers

What makes for a qualified tester? As in any other field, testing requires knowledge, experience

and meticulous methods. In addition, there are issues unique to the testing of anti-virus products

and services that require a more specialized knowledge.

For example, one critical and often overlooked issue is the tendency to immediately suspect the

AV product when a virus sample is missed. Given the historical quality of viruses and anti-virus

products, it is preferable that the tester should suspect the virus sample immediately, rather than

the product. It is far more likely that the sample is bad, than the product. This leads us to some of

the unique aspects of tester qualifications.