Case Study: Poor Network/System Management

• Major worm attack on Super Bowl weekend

  • Starts at about 3AM – lasted at least 18 hours

• NIDS identifies IPs of infected desktops

  • Corporate IT says: IP addresses are meaningless to us - we can't identify computers by IP address
  • Network group says: We can't add firewall rules to routers – we have no tools to do that