How McAfee turned a Disaster Exercise Into a REAL Learning Experience for Our Disaster Team

SANS ^ | 4/22/10 | Deborah Hale

[Battle Hymn of the Republic]

interesting follow-up from yesterday's debacle.

[maine-iac7]

Why ANYONE would still have McAfee on their computer puzzles me.

Way back in the dawn of PC’s, McAfee was about the only one. It ALWAYS messed up my computer. Always locked it up - and never did that good a job protecting either.

I got rid of that thing back in the ‘90’s

[madison10]

Why ANYONE would still have McAfee on their computer puzzles me.

It came free with the computer.

[knittnmom]

Because I had problems with Symantec on a previous computer.

[AnotherUnixGeek]

Why ANYONE would still have McAfee on their computer puzzles me.

Our corporate IT pushes various McAfee crap onto my work machines. I shut down the McAfee services and processes each morning, and turn them back on before leaving in the evening. It's the only way I can get any work done.

[sig226]

I wouldn’t call it a debacle at all. I’d call it an excellent example of real world action. And the director of the exercise should be commended for continuing it, providing that he dismissed anyone who was needed to deal with the actual computer crash. Real world problems are often made worse by unforseen complications. Somebody who could engineer a biologic attack at a concert could also cause the 911 system to crash.

[Billthedrill]

Lemons, lemonade. Shouldn't have happened but anything that encourages improvisation is money made.

I still have McAfee on one old laptop in a closet. Before it hits the network again, McAfee's toast. Too bad, too - once upon a time it was a great product, but that was when it was distributed on five-inch floppy disks.

[Tarpon]

Linux can prevent most disasters, just use 64 bit processors with the hardware ‘no execute’(NX bit) enabled — This segregates code from data automatically. About 95-98% of all of the virus code, due to buffer overruns, is prevented by this simple act. The big boy computers have known this for 30 years, all separate out data from code with hardware fencing.

The best is due April 29, Ubuntu 10.04.

What is left is easily fended off with proper computer management, things such as never run your computer in Admin mode, always use standard user mode, for users, as it was designed to do.

[stayathomemom]

This shut down the computer system at the major teaching hospital where my husband works. I haven’t heard yet how things are going today.

[justlurking]

McAfee is toast.

After this debacle, any IT administrator that doesn't immediately start a plan to migrate away from McAfee products should be fired.

[Lurker]

It came free with the computer.

And it's worth exactly what you paid for it.

[arthurus]

I paid for McAfee for years and thought I was doing pretty well, only getting about one virus a year. Then, in a short period of relative poverty I switched to the free AVG. That was a maybe 6 years ago and I have not had a virus since.

[Grumpybutt]

We had McAfee installed on our pc’s at home. All was fine until we upgraded to 2010. Big mistake. Needless to say, I uninstalled and went with Kaspersky and it seems to be much better.

[maine-iac7]

smart plan

[agere_contra]

I don’t hold a brief for McAfee but we have used it for years in our 10,000 strong company without noticeable issue. It’s supposed to generate its own random update intervals - obviously that didn’t happen in this case. Maybe an admin’s mistake, not the software itself.

[maine-iac7]

There are plenty of GOOD programs available FREE - of course, one would have to bestir themselves for a minute or two to install them.

And we have become a society that likes everything done for us and given to us - no matter how destructive it is in the long run

[Terabitten]

So you may assume that the loss of the 911 Center caused the Disaster Exercise to be called. After all, how can you have a Disaster without your 911 Operators, Right? Not us. When the 911 Center went offline at 9:05am we had to decide if we were to continue the exercise or call it due to the loss of 911. Our EMS Director for the County decided to continue the exercise. He began to do dispatch and communication using our 800Mhz shared radio system. We continued the exercise, decontaminated and transported roughly 120 people to the local hospitals. We successfully completed the exercise at 11 am

EMS Director made exactly the right call. You don't get to plan the date and/or time of an emergency. You also don't get to plan the *other* failures that inevitably follow.

The only way he could've done it any better is to say that 2 of the top 3 people in the system were out of town or at the concert and presumed dead.

[Goldsborough]

The most effective plan would be to migrate away from Windows.

[maine-iac7]

AVG is EXcellent. It catches bugs and chews them up for lunch.

Kaspersky is good also

[maine-iac7]

Yes - Kaspersky is great - I use both it and AVG