Explaining the Anti-Malware Testing Blog

I did think of making this post ‘sticky’ so that it remains at the top of the list of articles, but I’ve decided to reproduce it on the About page instead. Still, it seems appropriate to make it the first (new) post for this blog. Though it’s by no means literally the first post: the preceding articles have, in some cases, been available for years. They’re reproduced here because they became unavailable a couple of months ago.

Back in the Dark Ages (well, between 1989 and 2006), I was much involved in an informal sort of way with testing and evaluating security products – especially anti-virus products – mostly on behalf of the organizations for which I was working: Imperial Cancer Research Fund and, later, the NHS Information Authority. When I left the National Health Service, I started to provide authoring and consultancy services to the security industry, so you might say I became a gamekeeper turned poacher.

For nearly three years I was one of the directors of the Anti-Malware Testing Organization (AMTSO), and was heavily involved with the organization going right back to its formative meeting in Bilbao. Early in 2012, I stepped down from the Board since Righard Zwienenberg had just joined ESET, the AV company I represented within the organization, and two representatives of the same company cannot be on the Board of Directors at the same time.

For much of the time that I was on the Board, I was (somewhat reluctantly) involved in much of the PR for the organization (such as it was) and set up (among other things) the AMTSO blog and twitter account. While any member of the AMTSO board (and a few other people) could have contributed to either account, in practice no-one else did. In October 2012 the AMTSO executive team made it clear that neither the blog nor the twitter account were required any longer,. The official AMTSO blog is the one here though at the time of writing, there are no entries more recent than April 2012, and none of the articles I published on the WordPress blog are available there. (Which is why some of them are now here.)

So, in case it isn’t already obvious, NONE of the commentary here is (or ever was) made on behalf of AMTSO: my opinions are my own. And views expressed here are not necessarily shared by ESET or any other company with whom I work as a consultant.

Over that time, some 110 blog articles were posted on the WordPress blog. While a few official announcements were made on behalf of the AMTSO Board, the rest were my own opinion pieces and (hopefully) it was clear that they were not official statements on behalf of AMTSO: they were published on that web page in the interests of promoting independent discussion. So some of my articles are reproduced here for their historical interest, such as it may be. Material that was published on behalf of the Board of Directors (such as meeting agendas) will not be re-posted here. Other posts require minor editing to make it clear that this site no longer has any official connection with AMTSO, but may become available later.

Primarily, this site was originally intended to allow me to continue commenting in an independent capacity on the testing scene in general. However, one or two other people in the testing and anti-malware industries have expressed an interest in contributing commentary and discussion, and I’ll be happy to publish knowledgeable (or at least interesting) and responsible commentary, if it comes my way. (Please, no product pitches…)

Tip of the hat here to Andrew Hayter, who has agreed to help with reviewing content if it catches on, and suggested some examples of the sort of content likely to be seen as appropriate:

• ‘apples and oranges’ products and test sets
• who tests the testers?
• maintaining consistency in test sets
• test frequency (I’d add longitudinal testing there)
• real-time testing (I’d add whole product testing there)

But there are plenty of other relevant topics. If you have something to say on the topic of AMTSO, that’s certainly a legitimate topic of discussion, but I’d encourage you to visit (and register with) AMTSO’s own forum in order to get your voice heard.

I don’t intend to implement a formal review process for the moment, but reserve the right to require edits to be made or to decline to accept an article. (Or, of course, comments.) You can send blog posts as Word docs or ASCII to [antimalware.testing] [at] [gmail] [dot] [com]

David Harley CITP FBCS CISSP
Small Blue-Green World
ESET Senior Research Fellow (but not speaking on behalf of ESET)