VBA Virus Rapid Response Team VRRT

1
VBAVirus Rapid Response Team(VRRT)
2
WHY A FIRE TEAM?

• VBA CIRCLE MEETING
• MARCH 2001
• BILOXI, MISSISSIPPI

A national crisis team should be organized to
combat viruses. They should be prepared to
assist a station in need based on the hours the
station is able and willing to work to correct
the situation.
Fred King and Tom Wagner, VARO Directors
3
VBAs Experience

• Seattle - ( 1 week of lost production)
• Cleveland - (1 week of lost production)
• Houston - (2 days of lost production)
• Little Rock - (3 days of lost Production)
• Reno - (E-Mail loss)
• Winston-Salem - (E-Mail loss)
• () Virus Suspected but not confirmed

4
DOWNTIME COSTS

• 1 hour of downtime in an medium sized Regional
  Office costs VBA 3300.00 ( 4950.00) in lost
  computer production salary hours.
• 1 day 26,400.00 (39,600)
• 1 week 132,000.00 (198,000)
• Since VBA already works maximum OT to maintain
  its current workload these lost production hours
  can never be recouped.

5
Description

• The Virus Rapid Response Team (VRRT) is
  specifically set up for virus outbreaks. The
  team is deployed when all other alternatives have
  been exhausted.

6
Team Matrix

• Command and Control Team -provides funding, rapid
  deployment approval, administrative services and
  top management guidance and support.
• Ground Team - Provides on site incident handling
  and reporting, virus detection and removal.

7
Team/Resources

• Team Members
• Elaine Anderson, Manager of Team (SIO Office)
• Annette Mitchell, NSC Coordinator
• Ground Team
• Jose Martinez, Chuck Hantz, Tami Folkenflik (St.
  Pete)
• Marc Rivard, Mike Boggs (St. Paul)
• Wilfredo Maldonado, Bob Adams, Dave Linares (San
  Diego)
• Dolores Ryan, Jim Nolan (ITSC)
• Norm Carlson, Elton King, Rich Freeman (HINES)
• Command and Control Team
• Luigi Tenore (SIPO)
• John Muenzen (Field Liaison)
• Mike Schiebel, (OFO)
• NSC Directors (St. Pete, St. Paul, San Diego)

8
VRRT TEAM DISTIBUTION
NSC
ITSC
HINES
VACO
NSC
NSC
9
Procedures

• RO IRM staff detects a virus
• Eradicate it
• Yes Report to CIRC/ITSC/NSC
• No Report virus to CIRC/ITSC/NSC
• ITSC
• Check History Logs for Solution
• Yes Work with IRM on solution/close out
• No Report the virus problem to Hines

10
Procedures Contd

• HINES
• Hines Investigates
• Yes Work with ITSC, VRRT IRM on
  solution/close out
• No Contact NAI Support Staff for possible
  solution. If solution found, contact ITSC,VRRT
  RO IRM and close out.
• If Hines, NAI, ITSC and RO IRM cannot determine a
  solution then
• DEPLOY VRRT FOR ERADICATION w/ support from Hines
  and NAI by whatever means possible.

11
Current Status

• Continuing to formulate teams strategy, policy,
  procedures and provide training.
• Bi-monthly teleconferences held to discuss virus
  issues.
• VRRT monitors virus detection and early warning
  WWW sites and reports to Hines and ITSC.

12
VRRT Training

• Virus and ePolicy Orchestrator Training
  conducted onsite at Hines October 2001
• Virus and Security Training SANS Conference
  Track 1 SANS Security Essentials January 2002
  thru April 2002
• Additional Security Training will be conducted
  during the ISWG Meeting March 2002
• Other Virus/Security Training - Upcoming

13
Viruses the VRRT Have Successfully Fought

• WORM_MYPARTY.A January 2002
• W32/GONER December 2001
• TROJ_NIMDA.A September 2001
• W32/SIRCAM July 2001
• CODE RED ALERT July 2001
• W32/FUNLOVE July 2001

14
Future

• With the ever increasing virus threats and
  intrusion attempts into the VBA IT environment,
  VBA intends to merge both virus and intrusion
  security into one Rapid Response Team. In doing
  so, VBA will have the experienced technicians in
  place who are critical to maintaining and
  restoring VBAs systems in todays hostile IT
  environment.