Feds avoid Blaster

FedCIRC Patch Authentication and Dissemination Capability

The Internet worm snarling computers nationwide last week amounted to much ado about nothing for federal agencies.

That was largely because most of them applied the necessary software fix when alerted to the problem by the Homeland Security Department's National Cyber Security Division, officials said.

The Blaster worm, also known as Lovesan, spread rapidly, taking advantage of a vulnerability in versions of Microsoft Corp.'s Windows operating system.

Experts discovered the vulnerability in July. DHS' cybersecurity division, through the Federal Computer Incident Response Center (FedCIRC), warned of the susceptibility July 17 and provided information about Microsoft's patch.

"Our patch rates were quite good, as evidenced by the fact that...we've had only sporadic reports of impact at federal agencies," said David Wray, a spokesman for the department. "We appear to have done our job."

At the Navy, some old systems were hit, but none of the systems installed as part of the Navy Marine Corps Intranet, according to a spokesman for the lead NMCI contractor, EDS.

FedCIRC has long pushed to get agency officials to report on the application of patches. The organization recently rolled out its Patch Authentication and Dissemination Capability service, which lets systems administrators get information only on patches that are relevant to the organization's networks. That effort appears to be paying off, Wray said.

Many agencies have signed up for the service, and the Office of Management and Budget has been promoting it as a cost-effective way to protect systems.

The office also has a rapid response procedure by which FedCIRC keeps in touch with agency IT officials via e-mail and phone.

Between the July alert and the rapid response activity last week, "we were in very good shape," said Mark Forman, before leaving his job as administrator of OMB's Office of E-Government and Information Technology Aug. 15.

At the state government level, several agencies were not as lucky. Such lack of preparation came as a surprise because "on this one, people were aware [an attack] was coming their way," said Don Heiman, former Kansas chief information officer and cybersecurity leader for the National Association of State CIOs.

NASCIO and DHS officials are considering creating a center where state and federal agencies could exchange information on alerts and coordinate their responses. Steve Cooper, DHS' CIO, is looking into federal funding for that project, but the details are still not firm, said Chris Dixon, digital government issues coordinator for NASCIO.

Matthew French and Dibya Sarkar contributed to this story.