Security threats Toolkit
Story: Virus downs systems at three London hospitals
and don't forget to manage the vulnerabilities.....
I wondered how a virus could cause such a major issue.
I discovered that W32.Mytob.@mm is a mass-mailing worm that uses it own SMTP engine to send an email to addresses that it gathers from the Windows Address Book on the compromised computer. The worm also has the ability to open a back door and spread through the network by exploiting vulnerabilities.
So the problem spreads due to known vulnerabilities.
Managing vulnerablities is multi-faceted. It is not just about patching them, but it is about identifying and managing risk in a timely and cost-effective manner.
To be effective, there are a number of phases to vulnerability management.
Phases of vulnerability management:
- Discovering assets
- Assessing vulnerabilities and misconfigurations and prioritizing risks
- Mitigating non-patchable risks
- Remediating vulnerabilities
- Reporting and monitoring
Once vulnerabilities are known, the need to prioritise them and know where they need to be deployed is paramount. If all we do is identify that we have thne but are slow to do something about it, then we leave ourselves open to potential exploitation.
Once we have resolved the vulnerability, it is essential to continously monitor for those vulnerablities, since all it takes is for a user to reinstall their system from their CD and they are back to where they started. A comprehensive monitoring and reporting system rounds out a true vulnerability system.
By looking at risk and management of vulnerabilities in this way, IT managers can begin to take control of their environments, and not be laid open to potential chaos that arises when someone takes advantage of them.
Full Talkback thread
