43
passwords of the administrative accounts and continue your task – cleaning the
network. Shortly after that, you got another message:
“The <server name> is down. If you continue to pursue me – you will lose
<number> servers”.
Now, you realize, that something going wrong, there is something that you did
not count in your plan and you failed to take power from the malware. The
<server name> is down and you must decide what to do next. You still believe in
yourself and you know what to do, but… the boss, your supervisor, even if the
organization has good backups, he is under the stress after the first failed
attempt to clean the network… There are already costs associated with the
incident and now, the manager adds cost of recovery of the <server name>.
Everybody knows (after they saw the NeuroWorm’s power) that if the second
attempt will fail – there are more costs to add, much more. The situation is quite
tough:
-
The incident response plan did not work – it was not build for such
situations.
-
The associated costs are growing and probably will grow exponentially
(according to the last NeuroWorm’s message).
-
There is a great deal of uncertainty, it is hard to predict the consequences
of every failed operation to remove the NeuroWorm. What if the second
attempt will fail also? The organization could “lose” availability of the
<number> of servers, some of them critical. How the NeuroWorm will
respond? With more “costly” threat? Do you give up and leave malware in
your network? Then, what if you somehow accidentally cause the
NeuroWorm to “think” that you still pursue it? On the other hand, do you
know how to clean all of your <1000 or more> computers in the network at
the same time with 100% confidence?
At the end, this organization chooses…
I don’t know what they choose, but it seems either option is not good enough. It
is best not to have such incident at the first place, but who knows what we can
face in the future…
What we can do today, is to prepare for the incident of that kind, but you doesn’t
have to, if you believe that this is the “science fiction” story…
Wait, here is another one…
 |
 |
 |