Some Incidents Can Make Life Interesting

摘要

No security manager wishes for a security incident. They can be costly, disruptive and a professional black mark. But getting to the bottom of a minor event can make the job more challenging. The author's company just had an incident of that sort, and it's an interesting story. It all started with a call to their HR department from the company that provides their 401(k) services. As happens from time to time, a rogue server had been identified by law enforcement. Within the logs was a reference to ANTIVIRXP08, which is a piece of malware that disguises itself as a virus detection tool. They use Trend Micro's OfficeScan for corporate desktop and server antivirus protection, and it keeps logs for all their machines.