Project Scenario # 3 Daniel Gomez

I am the Information Systems Security Manager at Western Technical College. A virus has penetrated the network firewall and infected the school’s web server. As the ISS Manager, it is my duty to repair the virus attack, find out what the source of the virus was, figure out why the firewall did not block the attack, and to prevent an attack from happening again.

Monday, Jan 10, 2011, 7 am: I receive a call that Western Technical College has experienced a virus that has penetrated the server’s firewall.

Monday, Jan 10, 2011, 8 am: As the ISS Manager, I immediately ask the IT security team for copies of any data logs available, including the web server, database, and firewall.

Monday, Jan 10, 2011, 9 am: The Director of the school calls me into his office and asks me why this attack has occurred with the purchase of a new firewall. I inform him that the firewall had been installed but failed to prevent the attack. At this time, I do not know why this happened but I submit a proposal to the Director stating what I plan to do to repair the server.

Monday, Jan 10, 2011, 10 am: I advise the ISS staff to examine the web server. The web server is temporarily taken off line and a “closed for essential maintenance” message is posted on the website. I instruct the team to run a full anti-virus and malware check on the web server. I instruct the team to use the previous day’s back-up disk to verify that nothing on the server has been added or deleted.

Monday, Jan 10, 2011, 11 am: After examining the logs, the ISS team discovers that an employee had opened an attachment called “seemybits.jpg.vbs” from his laptop. This attachment was the source of the virus. The laptop was connected briefly to a wi-fi access point.

Monday, Jan 10, 2011, 12 pm: I contacted the firewall vendor’s tech support representative through . The tech support specialist replied that the firewall will not protect a computer from being infected while in use at a wi-fi hotspot. The firewall vendor offers to replace the existing firewall model with another version that provides secure wi-fi access.

Monday, Jan 10, 2011, 1 pm: I sent out a memo to all Western Technical College employees stating that it is safe to connect to the server. However, I also state that they can not use wi-fi access on their computers until the required firewall security patches have been installed.

Tuesday, Jan 11, 2011, 8 am: I write an incident report to the Director of the school. I gave details on how we were able to remove the virus and get the server back on line without any traces of the virus. I explained how the virus managed to penetrate the firewall and informed about the replacement.