Lessons Learned from Virus Infections

There are so many vulnerability scanners and penetration testing services or utilities available that many organizations use at least one of them gauge their security posture. Each tool has its own strengths and weaknesses and generally does a fair job at assessing an organization's network defense.
Viruses, including network worms, Trojans, and more can provide equally good, and often times better, views of the network in a true production environment -- and there is quite a bit an administrator can learn from a security compromise. This article does not intend for security administrators to intentionally infect machines; instead it is a guide to what an unintended infection can uncover about a network. With security companies such as Symantec reporting that 40% of Fortune 100 companies have been infected with viruses over a period of six months, it is well worth the exercise to see what can be learned from these infections. Specifically, after an infection is a time to evaluate the technical pieces of the defense perimeter (including firewalls, ACLs, etc.) and the non-technical pieces (continuity plans, emergency response, etc.).