AMTSO at its most controversial

The last two days have seen me attending the AMTSO members meeting in Prague in the Czech Republic. It has been a good two days with some very vocal discussions.


This meeting has been marked by the acceptance of the most controversial document to date to be produced by AMTSO.

The members voted to accept the document ‘Issues Involved in “Creation” of Samples for Testing’.

This is a really contentious issue. Many years ago when the anti-virus world was black and white, there was no argument – creating malware samples was just plain wrong.

However, the anti-virus world has changed, most anti-malware companies have some form of detection of Potentially Unwanted Applications. Sophos also has their Controlled Applications functionality.

These technologies are all needed because what suits one person does not suit another when it comes to detection and customers want choice.

Add into the mix the sheer number of new samples seen each day plus server side polymorphism and you have a growing band of opinion that to effectively test the proactive nature of a product, testers must do some form of sample ‘creation’ in order to carry out effective tests.

It was a controversial debate but the necessary majority voted in favour of publishing a document which discusses the pros and cons of creating samples. Note that AMTSO itself does not take a position on the subject – chances are we would never agree!

Once various AMTSO members get back to their offices the document will be tidied up and published on the AMTSO website. Do go and read it. It won’t be an easy read but it will highlight the issues and opinions, and help people make up their own minds if creating malware samples for testing purposes is a good thing or not.

I must also add that members additionally approved the document ‘Practices for Testing Network Based Security Products’ but that wasn’t nearly so contentious.

On a personal note I should thank AVG for hosting the event. They chose a nice location with good facilities for such a conference.

My only wish could be that they could control the weather. Yesterday saw sun, rain and snow. Today it’s even colder and I’m off to Stockholm. I checked the weather forecast and I wish I hadn’t.