VA scampers to stay ahead of viruses
Connecting state and local government leaders
Veterans Affairs Department networks successfully dodged the latest generation of computer worms that began crawling the Internet last month.'You do it with a lot of hard work,' chief security officer Bruce Brody said. 'A year ago we got hit pretty hard by Code Red and Nimda. We were able to avoid any disruption from MyDoom.'
Veterans Affairs Department networks successfully dodged the latest generation of computer worms that began crawling the Internet last month.'You do it with a lot of hard work,' chief security officer Bruce Brody said. 'A year ago we got hit pretty hard by Code Red and Nimda. We were able to avoid any disruption from MyDoom.'Of course, VA had some help from MyDoom's still unknown authors. They programmed the worm to avoid the .gov and .mil domains, apparently to evade federal attention. But that didn't necessarily make VA immune.'We don't live just in the .gov domain,' said Brody, who is VA's associate deputy assistant secretary for cybersecurity. 'We have a lot of communication with .com and .edu partners.'The department kept those paths open by doing manually what the Security Configuration and Management Program will automate over the next 18 months.SCAMP will be VA's third step in beefing up information security. It follows installation of antivirus software and the upgrade of a departmental Central Incident Response Capability.'We have robust antivirus tools, as well as an army of people'about 1,000 or so'who have to touch every workstation' to make sure patches and updates get installed, Brody said. That is a tall order with 250,000 client systems scattered across the country.The current job is patching the vulnerability reported early this month in Microsoft Corp.'s Abstract Syntax Notation 1 Library in Windows NT, 2000 and XP operating systems.Microsoft rated the vulnerability critical because of the large number of applications and devices that use the library. Code to exploit the vulnerability is now widespread on the Internet, and administrators everywhere have been racing against the clock to get systems patched before attacks begin.'We're scrambling as fast as we can,' Brody said. 'We're on top of it for now.'Analysts said last week that hackers were having a harder time than expected exploiting the vulnerability.The security emphasis grew out of a crisis the department faced in the late 1990s. VA created Brody's position, the first of its kind in the federal government, in 2001 after Congress, the General Accounting Office and the department's own inspector general castigated VA systems security.In the late 1990s, 'VA was one of the largest sources of virus proliferation in the government,' Brody said, because of the department's size and distributed sites as well as numerous connections to university networks with notoriously poor security. 'Our security was very decentralized,' he said.The turnaround began in 2001 with installation of antivirus software from Network Associates Inc. of Santa Clara, Calif., on 220,000 client PCs. At the time, it was the largest antivirus deployment in government.No one antivirus product can fully meet VA's needs, however. At the moment it has standardized on antivirus software from Trend Micro Inc. of Cupertino, Calif., for e-mail servers, and Network Associates' McAfee VirusScan on all other hosts.'We are considering an enterprisewide recompete this year, maybe in late summer,' Brody said.After the antivirus rollout, the next step was strengthening the department's CIRC, located in Silver Spring, Md. Until the summer of 2002, the CIRC operated during business hours, eight hours a day, five days a week. But that became inadequate in a global threat environment with attacks coming thick and fast. In 2002, the CIRC began a 24-by-7 schedule.It works with other agencies and industry sources to identify vulnerabilities and threats, obtain patches and give administrators as much lead time as possible.VA's fixers then go into action, laying hands on workstations and servers as needed.'That's the cumbersome and mechanical way of doing it,' Brody said. 'It works, but you have to stay on top of it. You have to follow up and make them report back to you.'SCAMP will automate this as much as possible. Like the antivirus effort, it will use commercial products, but, also like the antivirus response, no one product can meet all the department's needs.'It turns out to be a number of solutions,' Brody said. He will deploy products as needed on VA's heterogeneous platforms.The support of VA's secretary and CIO was instrumental in making the security improvements, Brody said, and getting that support was not difficult. 'There are certain things you have to do to secure your systems,' he said. 'We were able to justify it.'
Full force
'We're scrambling as fast as we can. We're on top of it for now.'
'VA Security Chief Bruce Brody
Ricky Carioti
Full force
NEXT STORY: NMCI leaders point to progress ...