6
$\begingroup$

As part of my class, pupils have to learn what a virus is.

I am looking for a better way to explain viruses or a better metaphor than the biological virus. The problem with a biological virus as a metaphor is that if we follow it to its logical conclusion, then if there is even the slightest problem in the metaphor, it will interfere with students reasoning down the line, which could lead to false conclusions and confusion.

When I was at university in (1991), we were told some simple rules for the computer lab:

  • No drinking or eating in the lab.
  • Don't hit the computers, poke anything into them, or try to take them apart.
  • Don't switch them off (someone else may be using it).
  • Don't worry, if you tell it to do something and it breaks then it is our fault not yours. Our job is to keep them from breaking, we do this by using good quality software. These is security to stop you from breaking it for any one else. If you break it for you, then come and see us, and we will fix it. If you break the security, and we encourage you to try, then do not do anything malicious as this is immoral and criminal, just come and see us and tell us, so we can fix the software bug, and give you your prize.

We are now telling students that they can easily break the computer by clicking the wrong button. This includes infecting a computer with a virus.

I am not happy with the normal descriptions of a virus, as these put all of the blame onto the virus writers, and all of the responsibility onto the user/children.

Some descriptions that I have seen.

  • “each requiring a different cure” Why? There are thousands of viruses, but only a small number of vulnerabilities. Viruses take advantage of vulnerabilities. Would it not be easier to fix the vulnerabilities.

  • “prevention better than cure” (true). But goes on about how a virus scanner can check programs before you run them. This is putting the blame on to the viruses, and the responsibility on to the children.

A better description?

Does anyone have a better way to describe a virus. How can we link it to real life; what the pupils already know.

Improve this question
$\endgroup$
3
  • $\begingroup$ A metaphor is by definition not a literal representation of the concept. That's why, it will be very difficult to find a metaphor that explains everything perfectly. That being said, I do like the "virus" metaphor because it can help us focus on teaching students better computing hygiene. When germ theory first became an accepted part of science, it still took us multiple generations to get people to make health hygiene or food hygiene a daily part of their daily routine, and even today, it's something that we must constantly educate and remind people/workers about. $\endgroup$ – Stephan Branczyk Aug 25 '17 at 0:25
  • $\begingroup$ Also, putting the burden on the student to protect himself is key here. Because that student won't always be using computers in a controlled and well-protected computer lab environment. He won't always have knowledgeable staff that he can call upon. At some point, he will be purchasing and using his own computer and other electronics. And/or at some point, he may also start using internet cafes in sketchy areas. $\endgroup$ – Stephan Branczyk Aug 25 '17 at 1:22
  • $\begingroup$ @StephanBranczyk yes at some point the student will be purchasing their own computer, so we need to teach them about systems that will minimise pilot error (see comment in section on vampires bellow). In the UK/EU up to the early 1970s we used to teach don't fall into the spinning blades. After this time, we started teaching about machine guards, and hazard protective equipment. It seems we are still catching up in our teaching of computing. $\endgroup$ – ctrl-alt-delor Aug 25 '17 at 10:32
7
$\begingroup$

Viruses, worms and other malware are actually just like physical infections in enough ways that I still think metaphors are the best way to educate from a basic level. Even the average home user knows that a virus scanner stops a large number of infections from ruining their PC.

The challenge comes with explaining why virus scanners are so limited - most up until now only catch what they know about. So I like to use the following:

  • Malware is written to control your PC or to steal your login information for online banking etc.
  • Your virus scanner will protect from tens of thousands of pieces of malicious software that it knows about.
  • Behavioural analysis tools will pick up more malware, based on what it appears to do.

But because code is written by humans, there will always be vulnerabilities, and because there are criminals, there will always be malware that will get past these, and this is why layers of security are essential. These include:

  • User awareness (don't visit dodgy sites, don't click on suspect emails etc)
  • Secure architecture (secure by design)
  • Extensive monitoring and logging
  • Understanding the threat environment
  • etc.
Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ I have never ran a virus scanner on my PC. I just follow the other thinks in your bullet list. My dad just does Secure architecture, as he is a complete novice. I phoned me the other day to tell me that his computer was infected with a virus. I asked him how he knew. He told me that the virus scanner told him (interesting as there is not one installed). I tracked the problem down in his web-browser history. He said that is it but I can get the “cleaner” to work, he had downloaded it, but because he did not know how to make it executable, it could not infect his machine. It defaulted safe. $\endgroup$ – ctrl-alt-delor Aug 2 '17 at 12:13
  • $\begingroup$ Well, we already know that people will be able to cause havoc like that. Every car system that gets connected to the internet, or has wireless connectivity at all is vulnerable, and folks like Ken Munro regularly demonstrate this. $\endgroup$ – Rory Alsop Aug 2 '17 at 17:22
6
$\begingroup$

The concept of a "computer virus" IS already a metaphor: a metaphor for how human bodies are infected with malicious entities which contain instructions to cause our cells to make innumerable copies of... The virus! We don't need a metaphor to explain the metaphor, if the student knows what a cold is.

You said: fix the few vulnerabilities. If we could prevent the virus from reproducing its RNA (and incorporating it in to our DNA in the case of retroviruses) then all viruses would be impossible. Unfortunately, the normal cells would not be able to do their job if that happened. So we are stuck with either catching all 200 cold viruses, or trying to inoculate against them, but they slowly change over time.

You said: use a virus scanner. The body has antibodies and white blood cells which watch for viruses, but the only way to program them is with a real or fake infection.

I think that if we fully explain the actual metaphor, then common sense will do the rest. This is the idea behind using metaphors to explain things. The real question is why we created such vulnerable systems in the first place, so that you can "get sick" without doing anything wrong, or even being on the same side of the earth with the infecting agent? No biological system could have survived such a poor design. We might not either.

Improve this answer
$\endgroup$
3
  • $\begingroup$ The problem with this metaphor is apparent in your answer. You are doing all of your reasoning in the metaphor. Therefore if there is a problem in the metaphor there will be a problem in your reasoning. This leads to false conclusions. $\endgroup$ – ctrl-alt-delor Aug 2 '17 at 11:00
  • $\begingroup$ the only problem with the (biological virus) metaphor is that it leads to the wrong treatment. I don't like the computer metaphor ether. There primary function is not computing, it is modelling (modelling a calculator, a typewriter, a television, or something new), they do this not by calculating but by pattern matching (yes look at how the control unit, memory unit, ALU, etc. work). $\endgroup$ – ctrl-alt-delor Aug 2 '17 at 12:20
  • $\begingroup$ @richard Perhaps it would be better to un-do the metaphor then. NOT use the word 'virus', say "malicious program" instead. That is what it is. We thought that a metaphor would make things easier or more memorable, but if it gets in the way, rip it out and start with something that is literally true. (That's called an 'analogy', by the way. A metaphor is something that is not literally true. Truth is a good thing.) $\endgroup$ – user737 Aug 25 '17 at 14:24
4
$\begingroup$

I go ahead and use something a little dramatic in my sessions. I use the vampire mythology to explain viruses.

For instance, vampires only come in when invited. Viruses are the same. The user has somehow allowed the virus to be installed on their machine. This 'invitation' part puts an emphasis that viruses entering a machine is almost always a fault of the user.

Then, yes, once the vampire is in, they start sucking up all the life out of everyone in the house. Same thing with viruses. They take up resources, destroy things and completely ruin everything.

I find that this brings out a lot of laughs (what with all the Twilight fans in the audience, and general awareness about vampires) but also allows them to learn the concept.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ I like this metaphor, I will use it in class. Except I do not like to blame the user. This is like blaming it on pilot error. Air crash investigators (we can learn a lot from them), have come to realise that it is rarely pilot error: pilots make mistakes in air-craft that have design faults in the user interaction design. Therefore if we design your computer systems better, then we can, almost, eliminate user error, and therefore eliminate virus infection. $\endgroup$ – ctrl-alt-delor Aug 24 '17 at 9:26
  • $\begingroup$ How do you know if someone is a vampire? see my view on what is a virus scanner? I think I will combine this answer and my answer, when teaching next. $\endgroup$ – ctrl-alt-delor Aug 24 '17 at 9:29
  • 1
    $\begingroup$ glad you like the metaphor. Of course, I take some liberties (like assuming the user is to blame) but I am going with anecdotal evidence. As long as the kids get the point I am putting across, I am happy :) $\endgroup$ – Jay Aug 24 '17 at 9:47
1
$\begingroup$

To explain what a virus is, it is easier to also explain what a virus scanner is.

A virus is malicious software, that takes advantage of bugs in you computer's operating system, and applications. They can combine this with social engineering, to manipulate you into cooperating with the virus. One way to protect yourself is to use a virus scanner.

What is a virus scanner

Let be explain by using an analogy.

Imagine you have a house (computer), and you want to protect its contents from criminals (viruses).

So you come up with the following idea: In front of each door you will put a security camera. It will scan every one that tries to enter the house. This camera is linked to a criminal records database. If it spots someone that is in the database then it will send you a text message, and let them in anyway. Or better it could lock them in a quarantine cell ( Better hope it does not misidentify you, because you could be stuck in there. The control panel to open the cell is on the outside).

What are the problems to this system?

  • You can become disconnected form DB. You could have a local copy of the database.
  • Your local copy could be out of date. Keep you local copy synchronised.
  • If someone has just started their life of crime, and is not on the database, then it lets them in.
  • It treats everyone the same: You your husband/wife, your kids, family, dog, friends, neighbors, random strangers, are all let in (if they are not in the database).
  • Did I mention people with a paper bag over their head, or a mask. They are let in as well.

Why do we not use such a system for our houses?

  • It is too expensive.
  • It does not keep out every one that we want to keep out.

What better system could we use?

  • Instead of a list of people to keep out, have a list of people to let in.
  • have fine grain control, allow some people into my house, fewer in to my private stuff.

What techniques do computers use to improve security?

  1. Patch security vulnerabilities, as soon as possible.
  2. Make it so that files are not executable by default. This stops naive users from running programs, no need to tell them not to run random stuff that they have downloaded, until the lesson on how to make a file executable.
  3. Make it so that users can not make there files executable (at least until they need this ability, and they have been taught about the dangers).
  4. Isolate users from each other and from the system.
  5. Provide a huge repository of trusted programs, and a cryptographicaly secure link to the repository, so that users don't have to download programs from the interweb.
  6. Have users use an immutable revision control system (so they can get stuff back after they mess up).
  7. Provide sandboxes, to run un-trusted programs in.

So why don't all systems do this?

  1. Not all vulnerabilities can be patched on legacy systems. That is some systems evolved from a very insecure system, and for backward compatibility not all vulnerabilities have been patched. It is interesting to note that MacOS X evolved from the insecure MacOS 9, but does not suffer from this problem.
  2. But the OS vendor does not always have the power to do this: most of the programs for the OS are proprietary, so the OS vendor is not allowed to put them into a repository.
  3. Yes you can do this on most OSs. However some OSs choose not to enable this, so as to make it easier to use [cut your own foot off].
  4. Yes you can do sandboxing on most OSs, but if you can't trust the host, then you can't trust the sandbox.

Are there any computer systems that do it a better way?

  • Funny you should ask. Would it surprise you to learn that only one computer system does it so badly that, a virus scanner improves matters?
  • But even MacOS X mentioned above can not do it all right. If the OS Vendor does not have the freedom it needs, then the system can never be secure.
  • Some more secure systems are Debian Gnu/Linux (there are others). Ubuntu, RedHat and SUSE, are also good (but contain proprietary software).

Edit

I will also combine this with the vampire analogy of @Jay (https://cseducators.stackexchange.com/a/3313/204)

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Very well thought out. Nicely worded answer. Too bad that the OS designers were naive or optimistic, but that goes for almost all products and systems in existence. $\endgroup$ – user737 Aug 25 '17 at 14:27
  • $\begingroup$ @nocomprende “Those who do not understand Unix are condemned to reinvent it, poorly.” $\endgroup$ – ctrl-alt-delor Aug 25 '17 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.