While organizations around the world this week scrambled to disinfect and patch systems that had been hit by the dangerous new W32.Blaster Internet worm, John Halamka could sit back and relax.

"I'm proud to say we don't have a single copy (of Blaster) in the hospital," said Halamka, CIO of Beth Israel Deaconess Medical Center (BIDMC) in Boston, a Harvard University research institution.

BIDMC's good news on Blaster came amid reports of the new worm's continued spread on Wednesday and the appearance of new worm variants on the Internet.

It was also a marked contrast to the scene at BIDMC in January after the SQL Slammer worm crippled the hospital's computer systems for about six hours, forcing medical staff to resort to paper-based records to track patients.

With Slammer, Halamka's staff patched their Microsoft SQL Server software prior to the worm's release. However, like many Microsoft customers, BIDMC was blindsided by an overlooked component on Windows XP desktop machines called the Microsoft Data Engine 2000 (MSDE). MSDE was also vulnerable to SQL Slammer and the worm was able to infect computers in the hospital's research labs and private offices. It then flooded the rest of the network with traffic, according to Halamka.

So when Microsoft warned customers in July of the RPC (Remote Procedure Call) vulnerability - the one later exploited by W32.Blaster - Halamka and his staff weren't taking any chances.

BIDMC staff updated their network firewall configurations to block the ports, such as 135 and 4444, which were identified by Microsoft as avenues that could be used to exploit the new vulnerability, according to Halamka.

The hospital also promptly updated its intrusion detection systems with the appropriate signatures to detect and warn about traffic associated with scans for vulnerable systems, according to Kristofer Karas, senior security engineer at BIDMC.

Then came the patching.

Not wanting to fall into the same trap as with the Slammer worm, Halamka developed an aggressive schedule for patching servers and desktop machines at BIDMC.

On the server side, the IT staff held what Halamka called an "all nightmare-athon" patching session in late July, applying the relevant Microsoft patches to the hospital's 130 Windows servers.

The IDG News Service is a Network World affiliate.