How McAfee turned a Disaster Exercise Into a REAL Learning Experience for Our Disaster Team

SANS ^ | 4/22/10 | Deborah Hale

[FReepaholic]

This is a good example of why a big company needs to not have all their computers on one antivirus software.

It would cost more but if a company could divide up their systems between two or more AV vendors then something like this wouldn't take down the entire enterprise.

[ZX12R]

It’s supposed to generate its own random update intervals - obviously that didn’t happen in this case. Maybe an admin’s mistake, not the software itself.

This event took out my computer yesterday morning. My understanding from our IT guys, is that if you were scheduled for an update of virus definitions yesterday between a certain time period, it got you. Apparently, among the new virus definitions, it listed a critical windows file among them.

[FourPeas]

Kudos to your EMS Director, especially for having a viable backup plan when 911 service goes away. Part of dealing with an emergency is the other failures that occur along the way. It’s what makes it fun, right?

[knittnmom]

I set McAfee to update, then scan, then shutdown if it did not find any virii last night. I have to wait until I get home to find out if my Vista pc still works.

[IndyTiger]

Our corporate IT pushes various McAfee crap onto my work machines.

Same here. At my company, nearly 3,000 computers lost network connections within 30 minutes. People were going around individually this morning with the patch file on a USB drive. McAfee uses up a lot of memory running in the background. Glad I use AVG at home.

[onedoug]

ping

[fremont_steve]

The good news is that I got rid of McCaffee on my home systems a week ago ;-)

I have some experience with creating, running, and participating in emergency drills. This is could have been part of the script of some of the drills - so it was as real as you can get because it WAS. At the same time it goes to show that a mono-culture is just as unhealthy for machines as it is crops. One “virus” can take out 100% of the crops or your computer systems.

Hopefully, part of the lessons learned is to change out half of the McCaffee served machines with a competitors product across the entire computer environment. This way the 100% scenario can’t hit them again.

I run Windows/Linux at home so that I don’t have a single point of failure. (Even have alternate Internet connections available if needed...)

[benjibrowder]

I got to contribute to the list of alternate antiviruses.

NOD32 is a great one.