A Special Kind of Love
Scan was used to remove the worm from the
Sometimes, love can suffocate you. Just ask Fran
Wood. Wood is the chief operations officer (COO)
of the New Mexico State Highway Department. On
May 4, 2000, he was sitting in a meeting in
Albuquerque when he received an urgent
telephone call from his Santa Fe office. He couldn’t
believe his ears. All the computers of his
department had been flooded with e-mail
messages bearing subject “I Love You.” The “I Love
You” worm, a virus multiplying and spreading in
networks, had destroyed text files and JPEG
(Image) files all over is system. And it was still
attacking.
The State Highway Department uses many
JPEG files. JPEG is a standard for graphics files
commonly used in Web Pages. The unit hit hardest
was the engineering department. Wood estimated
the number of files to be affected to be 50,000 to
60,000. In its engineering design process, the
department uses many JPEG files, including those
taken with digital cameras and scanned into digital
documents. The destruction came at the worst
time possible. Wood’s organization was in the
midst of integrating Microsoft Exchange and
Microsoft Outlook into a single e-mail program. It
did not have an emergency plan to deal with virus
attacks and other security threats.
Wood’s first instruction was to shut down
every computer and piece of peripheral
equipment. The equipment was unplugged for two
days. Everything on computers, from design
processes to communications, was shut down.
During these two days, all employees went back to
using paper and pencils.
The next step Wood took was the
establishment of IT crisis management team. The
team included employees from his own
organization as well as members of several
consulting firms and equipment vendors. To check
whether the virus was still spreading, the team
turned on several computers less than 24 hours
after the attack, only to shut them down
immediately; the virus was still spreading. The
source, it was determined, was outside computers
linked to those of Wood’s organization.
An application called Microsoft Information
Exchange e-mail application. Then, an antivirus
program called Trend Micro Scan Mail was
deployed to stop the virus from entering any
computers linked to an outside network. Wood
scanned all his 100 servers and 1,750 desktop
computers in 128 locations throughout New
Mexico to locate infected systems and clean them.
Next, new software was installed to ensure that no
unknown machine could log into his organization’s
network until its ‘identity” was established. Finally,
another antivirus application called Sophos was
distributed and installed on each of the
organization’s computers from a single central
computer.
In addition to the software solution, a new
policy was established and distributed. The policy
now requires that employees take precautions with
suspect files such as Script files, ZIP files, and .exe
(executable) file when receiving e-mail.
It took one week to bring 90 to 99 percent
of the computers and peripheral equipment back
to good working condition and free to any virus.
Fortunately, not a single project was jeopardized
and no federal appropriation was denied as a result
of this terrible experience. Wood admitted he was
totally surprised by the sophistication of the virus
and the speed at which it spread and destroyed
files.
Now, security technology is playing more
important role at the New Mexico Highway
Department. Both software and policies work
together to minimize the chances of another such
attack.
Thinking about the case
1. What caused the paralysis of computers at
Wood’s organization?
2. Why is the type of virus mentioned in this case
more dangerous than some others?
3. If you were in charge of the information systems
of an organization, what would you do to minimize
the chances of a virus attack?