CodeRed II: Incident Handling Process and Procedures

CodeRed II was a great primer for most corporations on how their incident response processes and procedures worked. Many corporations had hardened their external web servers but left internal servers and workstations vulnerable. The assumption was that corporate firewalls would stop the spread of viruses such as CodeRed. This was a false assumption because a single laptop taken home by an employee and infected outside of the corporate enterprise would circumvent the corporate firewalls. The laptop may have virus protection loaded on it but if the most recent virus definition files loaded on the laptop did not recognize the new virus the laptop would be infected. When it was brought back to work and plugged into the corporate enterprise it would infect machines that resided inside the firewalls. The 6-step method for incident handling is to prepare, detect, contain, eradicate, recover, and lessons learned. This paper uses the CodeRed II virus as a template to generate questions to help you better prepare for the next virus outbreak. We will use lessons learned in each of the steps to better prepare for future virus infections.