A
couple of years ago, the Department of Homeland Security notified NOAA
(the weather agency) and the Economic Development Administration (EDA)
that they had a potential malware problem in their computer systems. The
two agencies reacted in very different ways.
The NOAA isolated and cleaned up the problem within a few weeks.
The
EDA, however, responded by cutting its systems off from the rest of the
world—disabling its enterprise e-mail system and leaving its regional
offices no way of accessing centrally-held databases.
It then
recruited in an outside security contractor to look for malware and
provide assurances that not only were EDA's systems clean, but also that
they were impregnable against malware. The contractor, after some
initial false positives, declared the systems largely clean but was
unable to provide this guarantee. Malware was found on six systems, but
it was easily repaired by re-imaging the affected machines.
EDA's
CIO, fearing that the agency was under attack from a nation-state,
insisted instead on a policy of physical destruction. The EDA destroyed
not only (uninfected) desktop computers but also printers, cameras,
keyboards, and even mice. The destruction only stopped—sparing $3
million of equipment—because the agency had run out of money to pay for
destroying the hardware.
Read more at
Ars Technica.
No comments:
Post a Comment