Flood of Virus Alerts Is a Test of Processes

Computerworld - I was working late the other night, trying to clean up some loose ends, when virus alerts filled my e-mail in-box.

The volume of alerts caught my attention. We run a tight ship when it comes to virus protection. Desktops and servers are continually updated. If you were to audit any system at any time of day, you would find it to have the latest virus identity files. Anytime I mouse over the antivirus icon on my screen, I can see that my system automatically checked for updates no more than three minutes earlier.

Its unusual for us to receive even a handful of alerts on any given day. In fact, one or two is the normal volume for an entire workweek. We havent had a virus outbreak in the two and a half years that I have been here.

But why would a manager want to be bothered by virus alerts? Well, Im not bothered by them normally; its only when I see a lot of alerts that I get bothered. If its just the onesies-twosies, I dont pay much attention; staffers can take care of that. But I want to know when we start getting a raft of alerts. Malicious code can travel quickly through a network.

My need to be in the loop was instilled in me when I held a previous management position almost nine years ago. That job kept me busy enough that it was unusual for me to go to lunch. Naturally, the day I did go out was the day our companys data was wiped out by a malicious Trojan horse. A staffer had visited an inappropriate Web site and inadvertently downloaded the Trojan. Since the staffer had domain administrator privileges, the malware had complete access to every server and file system on the network.

We had to cease operations for 48 hours to clean up the mess and restore data. Despite our best efforts, some accounting data was irretrievable. It is my mission now to do all I can to make sure that never happens again in any place where Im responsible for network security.

Not Reportable

The other night, as I glanced through the alerts, I noticed that a temporary employees computer had picked up some malware. The data led me to believe that the temp had visited several Web sites deemed inappropriate by our acceptable-use policy. I also wondered why a temporary employee was working after hours, unsupervised. And I had other questions: Had the employee been advised of our acceptable-use policy and then signed an acknowledgment form? Had he taken the security awareness training? How about training on sexual harassment awareness? Web browsing that violates the acceptable-use policy could well open us up to a lawsuit on sexual harassment grounds.