Battling Blaster on a University Campus

When the Blaster worm came knocking, right around the time 6,000 students returned to George Washington University's residential network, the members of the information security group found themselves with a lot of work on their hands.

By Tracy Mayor

August 01, 2004 — CSO — When the Blaster worm came knocking, right around the time 6,000 students returned to George Washington University's residential network, the members of the information security group found themselves with a lot of work on their hands.

Representatives from the university's technical staff (aided by a volunteer army of network-savvy specialists) provided each and every student with a security CD that the university had burned in three days' time to help students scan and clean up their machines. GWU CSO Krizi Trivisani and her staff added extra workers to the help desk and set up three stations around campusat the academic center, the student union, and the Hippodrome, which houses the school's pool tables and bowling alleyfor hundreds of students who didn't feel comfortable doing the cleanup themselves. By the end of the first week, 90 percent of the students had responded to the call for action, which is "pretty good for security compliance," Trivisani points out. But that still left nearly 600 infected machines on the network. As a next step to show that she meant business, infected machines were routed off to a virtual LAN and denied access to the student network until they were given a clean bill of health. "The only thing [students] could get to was a page that helped to clean off their computer," Trivisani explains. Even so, it took two weeks for some student machines to come back online. "Moving people off, cleaning them up, rescanning the machines...the process worked, but it was time-consuming," Trivisani says. "We just weren't set up to handle that kind of volume." She kept the technical staff and volunteers fueled with timely infusions of cola and pizza ("Papa John's was our new best friend," she recalls), and with the knowledge that everything they were enduring would ultimately help design future incident response methods.

Trivisani says the team's efforts paid off; unlike many corporate networks, GWU was able to stay up and running throughout the cleanup process.

Read more about network security in CSOonline's Network Security section.

• Print

• Crash Course: Information Security at Universities