Microsoft, users cope with worms' chaos

Top execs, rank and file pitch in to handle onslaught of calls
Carol Sliwa
 

August 25, 2003 (Computerworld) REDMOND, Wash.—The voice you heard at the other end of a customer service call to Microsoft Corp. during the past two weeks may not have belonged to one of the 4,500 specialists who are paid to do that job.

Even top executives pitched in to answer phones after an "all hands on deck" call went out to product teams on Aug. 12, a day after the W32.Blaster worm began afflicting the computers of companies and home users that hadn't applied a patch for the Windows vulnerability being exploited.


Microsoft's Product Support Services group kicked into emergency response mode as more than 40,000 calls flooded the company's support lines during each of the first four days of the assault. Company officials said the Blaster worm caused the largest spike in call volume that Microsoft has ever encountered as a result of any virus or worm.


To reach out to more customers, Microsoft last week took out full-page ads in newspapers to spread the message: "Protect your PC." In the ads, Microsoft advised users to install a firewall, use the Windows Update service to get the latest security patches and make sure they install up-to-date antivirus software.


"The idea is to make sure that consumers aren't just protected from this particular worm, but are better protected on an ongoing basis," said Eric Rudder, senior vice president of servers and tools. He also said the company conducted a telephone conference call Aug. 21 to update corporate customers.


But that prescriptive guidance marks only the initial steps of Microsoft's latest efforts to help customers protect their systems, according to Vice President Jim Allchin. He told Computerworld last week that a team is working on new approaches that will involve a combination of existing and new technology to help IT professionals protect their systems by default.


Allchin said he analyzed how Blaster got into systems, and his group has been "really tearing apart the issues about how we can prevent this." As head of Microsoft's platforms group, Allchin has overall responsibility for the product delivery, engineering and technical architecture of the Windows operating system, server products, .Net tools and new-media technology.


"I've had enough, and I'm going to do something about it," he said. But Allchin declined to provide specific details and said simply, "It's technology. It's a way that they can choose to run their systems."


Allchin said that although Microsoft will supply effective patch-distribution tools, it can't expect perfect distribution to ever be achieved. So the company plans to give IT professionals "some facilities" that will be "a weapon in their arsenal to protect themselves," he said. "Stay tuned."


Help on the Way


Another forthcoming mechanism that's expected to help users protect their PCs is a combined hardware and software initiative known as the Next-Generation Secure Computing Base (NGSCB), formerly called Palladium. Allchin disclosed last week that Microsoft has seen NGSCB work on hardware, rather than merely on simulators. "We think that's pretty amazing," he said.


In the meantime, Microsoft employees at all levels have been focusing their attention on coping with the latest vulnerability. During a meeting last week, a concerned Chairman Bill Gates was trying to find out why it was taking 40 minutes for a customer to get help over the telephone, according to Lori Moore, vice president of product support services.


And the 1,500 Microsoft employees who volunteered for an hour's worth of training so they could take customer calls at the company's satellite campus in Issaquah, Wash., included Rudder and Brian Valentine, senior vice president of the Windows division.


But Rudder, who took time out from his vacation to man the phones, downplayed his involvement and asked that the focus be "the real folks who were the heroes of customer support." He also lauded key antivirus vendors that pitched in, such as Network Associates Inc., Symantec Corp., Computer Associates International Inc. and Trend Micro Inc.


"People have been living on adrenaline, and they're still really jazzed about working these long hours," Moore said late last week, as the call volume finally subsided to 25,000 per day. She said most customers have been sympathetic to Microsoft and have directed their anger at the virus writers who created Blaster.


"It's no excuse for having the problem," Moore said. "But I think there's great intention and great enthusiasm on the development side and in the company overall in really fixing and addressing these issues."















Emergency Response

Microsoft made changes to its emergency response processes in the aftermath of Nimda, which hit in Sept. 2001. Improvements included:



Requiring the emergency response process to be tested at least monthly and improved as necessary.


Establishing a 24-hour Microsoft Watch team to track potential new attacks.


Defining and documenting on-call procedures.


Mandating that all response leaders carry emergency contact cards.