Entry detected

The attack could begin not with a bang but a whimsy: a simple 'hi' in an e-mail message or, in a famous come-on, 'ILOVEYOU.'Or it could arrive unannounced and unseen through a system's back door and leave the same way with agency data or, perhaps, make a splashy appearance in the form of a defaced Web site.Computer criminals have devised many ways, from viruses to data theft, to invade government PCs and servers. Their threats also vary by degree, from nuisance attacks to intrusions that can shut down Web sites or networks, or compromise their data.It's not hard to know which type of attack represents the most serious crisis; the trick is to recognize it early and be ready to respond.'In a generic sense, an attack that cripples mission-critical information systems in an agency is the type to be most concerned about,' said Lawrence Hale, director of the Federal Computer Incident Response Center.Anyone who suspects a system intrusion should report the incident to FedCIRC or its counterparts in the Defense and intelligence communities, and then execute the agency's contingency plan for hack attacks, Hale said.Notifying FedCIRC 'provides a method for recognizing whether an incident is actually an attack,' Hale said. A central group such as FedCIRC can spot cyberattacks through patterns in incident reports in the same way that regional health agencies might detect a bioterrorism attack by tracking emergency room visits. Collecting reports also helps experts identify the nature of an attack'whether it's a virus spreading throughout the Internet, or an attack specifically against the government.An emergency checklist in Stephen Northcutt's book, Computer Security Incident Handling Step by Step, published by the SANS Institute of Bethesda, Md., advises managers to stay calm and take good notes.'Often it's the split-second decisions that are made as the information is pouring in that can make or break the organization,' said Terence M. Rice, a project manager in the information assurance division of CACI International Inc. of Arlington, Va.Agencies need a plan in place to help managers decide whether it's more important to preserve forensic evidence or just patch the security flaw and get the hacked system running, Rice said.'I'm not saying both strategies can't be pursued, but usually one has to take priority over the other,' Rice said.Hale advised taking steps to isolate the intrusive code and prevent its spread to other agency systems.'Sometimes, by shutting down the systems, you're doing exactly what the attacker wants you to do,' Hale said.After figuring out the nature of the malicious code, administrators might block certain ports to keep critical systems going.But if files are disappearing, just pull the server plug, Hale said. Later, forensic experts can analyze the hard drive with a sterile machine.Other tactics Northcutt recommends include enforcing a need-to-know communications policy and avoiding the use of compromised computer systems for discussions of incident handling.But depending on the situation'such as the crash of a highly visible e-government portal''getting the information out is usually the best practice' when dealing with customers, employees and contractors, Rice said. Having a preset communications strategy helps here, too.The immediate crisis is over when the agency restores its mission-critical operations, Hale said. But workers still need to clean up the infected machines, reboot the mail servers and perform other chores.Logs from the server or the agency's intrusion detection system might give clues to law enforcers. Sophisticated attackers know how to erase their tracks from server logs, but a little creativity in setting up the logging functions might trip them up, Hale said.After immediate repairs are made, agencies need to stay in maintenance mode because viruses stay in circulation for years, said David Perry, global director of education for antivirus software vendor Trend Micro Inc. of Cupertino, Calif. Managers also should do a post-attack analysis to identify vulnerabilities.Agency officials are often reluctant to talk about their security strategies for fear of tipping off intruders. But last summer's Code Red incident spotlighted several management tactics.The worm exploited a vulnerability in Microsoft's Internet Information Server, a popular application for running Web sites. The crew of www.whitehouse.gov sidestepped what would have been a massive denial-of-service attack by changing the IP address by one digit.Code Red highlighted the importance of configuration management, Hale said. Most agencies applied the IIS patch in time to avoid the worm. On request, FedCIRC provides civilian agencies with a vulnerability notification service for managing patches.Experts agree that advance planning is the single best defense against cyberattacks. First, agencies need to identify their mission-critical systems, Hale said.With slight modifications for technology updates, contingency plans drawn up for the year 2000 rollover could serve agencies. 'That planning was absolutely not wasted,' Hale said.An evidence preservation plan should be worked out in advance with the agency's law enforcement entity, Hale said.'If nothing else, if management can plan ahead, it can lead to a lot better ability to recover,' Rice said.Experts also recommend rehearsing contingency plans periodically and reminding workers of agency policies governing passwords, e-mail attachments and other issues. 'Lack of user education is half the problem,' Perry said.