Feds avoid Blaster

FedCIRC Patch Authentication and Dissemination Capability

The Internet worm snarling computers nationwide last week amounted to much ado about nothing for federal agencies.

That was largely because most of them applied the necessary software fix when alerted to the problem by the Homeland Security Department's National Cyber Security Division, officials said.

The Blaster worm, also known as Lovesan, spread rapidly, taking advantage of a vulnerability in versions of Microsoft Corp.'s Windows operating system.

Experts discovered the vulnerability in July. DHS' cybersecurity division, through the Federal Computer Incident Response Center (FedCIRC), warned of the susceptibility July 17 and provided information about Microsoft's patch.

"Our patch rates were quite good, as evidenced by the fact that...we've had only sporadic reports of impact at federal agencies," said David Wray, a spokesman for the department. "We appear to have done our job."

At the Navy, some old systems were hit, but none of the systems installed as part of the Navy Marine Corps Intranet, according to a spokesman for the lead NMCI contractor, EDS.

FedCIRC has long pushed to get agency officials to report on the application of patches. The organization recently rolled out its Patch Authentication and Dissemination Capability service, which lets systems administrators get information only on patches that are relevant to the organization's networks. That effort appears to be paying off, Wray said.

Many agencies have signed up for the service, and the Office of Management and Budget has been promoting it as a cost-effective way to protect systems.

The office also has a rapid response procedure by which FedCIRC keeps in touch with agency IT officials via e-mail and phone.

Between the July alert and the rapid response activity last week, "we were in very good shape," said Mark Forman, before leaving his job as administrator of OMB's Office of E-Government and Information Technology Aug. 15.

At the state government level, several agencies were not as lucky. Such lack of preparation came as a surprise because "on this one, people were aware [an attack] was coming their way," said Don Heiman, former Kansas chief information officer and cybersecurity leader for the National Association of State CIOs.

NASCIO and DHS officials are considering creating a center where state and federal agencies could exchange information on alerts and coordinate their responses. Steve Cooper, DHS' CIO, is looking into federal funding for that project, but the details are still not firm, said Chris Dixon, digital government issues coordinator for NASCIO.

Matthew French and Dibya Sarkar contributed to this story.

Rising Stars

Meet 21 early-career leaders who are doing great things in federal IT.

Featured

  • SEC Chairman Jay Clayton

    SEC owns up to 2016 breach

    A key database of financial information was breached in 2016, possibly in support of insider trading, said the Securities and Exchange Commission.

  • Image from Shutterstock.com

    DOD looks to get aggressive about cloud adoption

    Defense leaders and Congress are looking to encourage more aggressive cloud policies and prod reluctant agencies to embrace experimentation and risk-taking.

  • Shutterstock / Pictofigo

    The next big thing in IT procurement

    Steve Kelman talks to the agencies that have embraced tech demos in their acquisition efforts -- and urges others in government to give it a try.

  • broken lock

    DHS bans Kaspersky from federal systems

    The Department of Homeland Security banned the Russian cybersecurity company Kaspersky Lab’s products from federal agencies in a new binding operational directive.

  • man planning layoffs

    USDA looks to cut CIOs as part of reorg

    The Department of Agriculture is looking to cut down on the number of agency CIOs in the name of efficiency and better communication across mission areas.

  • What's next for agency cyber efforts?

    Ninety days after the Trump administration's executive order, FCW sat down with agency cyber leaders to discuss what’s changing.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group