It was not a technologically sophisticated virus, or one that exploited previously undiscovered holes in security. Reportedly taken aback by the devastation his creation had wrought, he turned himself in to police shortly after it had run its course. Like many other virus attacks and cracker exploits in the past, it had as much to do with the successful use of the ancient techniques of hoaxing, impersonation or outright fraud as with technological trickery. The average guy was going to be too tempted not to open it up. Such sentiments would indicate that vulnerability to virus attack is not so much an issue of technology as of institutional culture the soft side of enterprise risk management, rather than the hard side.
Technological fixes are, in any case, difficult and often ineffectual.
Various reasons have been put forward for the vulnerability of modern computer systems to virus attack. Many believe that technology can only change the playing field, not win the game. In many cases, these actually exacerbate the original problem. It is in ensuring that users and administrators do not fall prey to the wiles of social engineers that enterprise risk management comes into play. One of the tenets of ERM is the inculcation of risk awareness throughout an organisation, in the hope of avoiding the unquestioning acceptance of risk that has tripped up many firms in the past.