Taming the impact of Internet mischief

There are few among us who have not been affected in some way by Blaster, Sobig and the other Internet attacks of the past few weeks. And we certainly hope that you were able to weather these events with minimal negative impact.

There are few among us who have not been affected in some way by Blaster, Sobig and the other Internet attacks of the past few weeks.  And we certainly hope that you were able to weather these events with minimal negative impact.

If your impact was minimal, chances are high that you were a good network citizen and had kept both your operating systems and your antivirus protection up to date. Being a good network citizen is important, because your failure to be one has a profound impact not only on your own operations but also on those of others.

We’re heard numerous stories from manufacturers of their having to bail out large customers who got caught by the latest Internet onslaughts.  In some cases, servers did not have the proper patches applied.  In others, desktop users did not have up-to-date antivirus protection.  When asked how this could possibly be the case for a major corporation, the usual answer was “we didn’t think it mattered” or “we didn’t think this affected us.” 

Of course, one could argue that we shouldn’t have to worry about this because software shouldn’t have vulnerabilities.  And certainly large IT shops have a massive job trying to keep each desktop up to date with the latest patches.  But these are facts of life, and we must learn to cope with them.

The impact on the WAN from these events is that the volume of traffic is greatly increased, so legitimate traffic has a hard time getting through.  Consequently, assuming that more catastrophic events are likely to continue to occur, the task for the WAN manager is to have contingency plans for dealing with these bursts of superfluous traffic. 

A great starting point is with the traffic-shaping/QoS appliances and router software that we’ve discussed several times.  These products have the ability to limit the amount of bandwidth that certain types of traffic – like e-mail – can consume, thus protecting your critical applications.