News yesterday that several London hospitals had been shutdown because of the outbreak of a virus would perhaps make you pause briefly and think of MRSA or some new anti-biotic resistant strain of Staph. So far, so not news – although, thankfully, far less common recently because of, I imagine, Herculean efforts by hospital staff. To hear that it was actually a computer virus makes you pause longer.
The mytob virus, apparently responsible for the shutdown, is more than 3 years old. It’s easy to protect against and well understood. Symantec describe it’s threat level as:
When was the last time you heard of a computer network being shut down by a virus? Well, not that long ago. Along with the hospitals, we have this news today
It seems we’re approaching the annual peak for computer virus infection
Computer users have been warned to take extra special care next Monday as it has been predicted to be the worst day of the year for computer viruses. Security experts PC Tools has forecast the bleak outlook for computer fans on November 24th, as figures from 2007 show that it was the peak for malicious software last year.
But seriously … an entire network shutdown now? In late 2008?
Shortly after I started work in UK government, a series of departments were shutdown for 2 or 3 days, some longer, because the Melissa virus infected their email system. Chaos reined as all email servers were shutdown and nothing could be sent or received. How quickly we had come to be reliant on email. In a hospital where it wasn’t just email but seemingly everything, it must be much worse.
Not long after that, the OGC piloted an anti-virus solution that was hosted “in the cloud” – i.e. was not on local PCs but that filtered every incoming (and later outgoing) email from any government email address that was set up. We took that pilot on, probably mid-2002, and extended it to every single government email address that wanted to use. It wasn’t cheap – but measure that cheapness against the cost of an infection, whether in clean-up time, risk to the operation or any other metric you care to use. Since then, as far as I know, there hasn’t been a single virus infection in a government department using the service. The company, MessageLabs, at the time a tiny company, has since gone on to be a world-leader in anti-virus (and was then bought by Symantec for some $700 million)
What’s my point? I guess it’s the frustration that these lessons have been learned already – and the solution is available at a relatively nominal fee. It’s been well tested and well used for 5 or even 6 years. And hundreds of thousands of email accounts across government are already protected.
For a hospital to be exposed to this kind of risk, with everything else that they have to deal with on a day to day basis, is just shocking.
And, as for the Pentagon, they should already know better – but they should also be reading my blog. Ban USB sticks now.
