IT security posse seeks quick fixes

From her kitchen table, Sallie McDonald led the government's response to the MSBlaster worm.'A situation can happen anywhere, at anytime, and we have to get together to spring into action,' said McDonald, a senior executive in the National Cybersecurity Division at the Homeland Security Department.When news of MSBlaster struck, McDonald happened to be at home. She kicked off the first of many teleconferences with other federal officials to make sure the government was protected from the virus, which this month attacked systems running Microsoft Windows.'We started seeing indications at 4 p.m. and within an hour or two, we convened a teleconference to get working on it,' said McDonald, who also runs the Federal Computer Incident Response Center.As the first warnings spread about the worm, FedCIRC sent an e-mail alert to all federal CIOs and select officials in the Office of Management and Budget advising them of the potential for problems.McDonald first called officials at the National Communications System and National Infrastructure Protection Center watch centers, the FBI's Cyber Division, the National Security Agency and industry experts.After the group determined what was happening and how to react to it, McDonald called Mark Forman, who was still on the job but has since stepped down as OMB administrator for e-government and IT; Karen Evans, the Energy Department's CIO and vice chairwoman of the CIO Council; Vance Hitch, the Justice Department CIO and chairman of the Security and Privacy Committee of the CIO Council; and several agency CIOs to figure out how to secure federal systems.'We discussed the incident and where to get the patch, and we set a timeline to assess systems and patch them,' Forman said before leaving government Aug. 15. 'We already had patches deployed to take care of MSBlaster, so we were in pretty good shape. I felt this was a good sign to how much our systems security improved.'OMB implemented the team approach about 18 months ago, during another Internet attack, McDonald said.'Mark said he wanted FedCIRC to tell CIOs how to protect their systems by installing patches or whatever was necessary,' she said. 'Before this, FedCIRC would send out a warning advisory. But agencies did not have to report back to OMB, and no one knew if the systems were really protected.'The rapid response team jumped into action three times in the last two months and six times this year, Forman said.'I have seen that approach in action twice and if the right people are on the call, it is extremely effective,' said Alan Paller, research director for the SANS Institute of Bethesda, Md. 'By right people, I mean people with the technical skills to understand how the vulnerability can be exploited and people who are in a position to amalgamate human resources for rapid action.'By sharing information about software vulnerabilities through the group, agencies have been prepared for most attacks, McDonald said.This was especially true for MSBlaster. Although it infected more than 700,000 computers worldwide, according to industry security analysts, the federal government suffered few disruptions, McDonald said.At the Postal Service, for instance, the worm infected only 300 PCs out of 158,000, a USPS spokesman said. Other agencies also suffered some problems, but it did not shut down networks or systems across an agency.The virus exploits a Microsoft Windows vulnerability in a Distributed Component Object Model interface that handles messages sent using Remote Procedure Call Port 135. It affected PCs running Windows 2000, XP, NT and Server 2003. MSBlaster caused computers to reboot frequently or interrupt users while browsing the Internet. After learning about the problem, Microsoft in July released a patch.After the teleconference with the agencies, CIOs put together mitigation plans and sent them to OMB and FedCIRC. McDonald said each plan detailed how many systems the agency had to secure, how many systems it deemed critical, when the agency would patch critical systems and when all other systems would be secured.Agencies then reported back to OMB and FedCIRC on their progress and sought assistance when necessary, McDonald said.One form of assistance is the Patch Authentication and Dissemination Capability system, which FedCIRC launched in February. McDonald said many agencies have fully implemented the system, but some are unsure how to incorporate it into their processes.When Microsoft released the patch for MSBlaster, FedCIRC alerted agencies signed up for the patch service that they could download it from a dedicated server.'The federal community has made great progress in improving IT security,' McDonald said. 'We are not where we need to be, but these conference calls are extremely helpful in helping the CIOs protect their systems.'