According to blogger Dizzy Thinks, the UK Parliament has become the latest institution to fall victim to the spread of Downad/Conficker. In an internal memo, which was subsequently leaked, network users were advised the following:

To: All users connecting directly to the Parliamentary Network

The Parliamentary Network has been affected by a virus known as conficker. This virus affects users by slowing down the Network and by locking out some accounts. We are continuining [sic] to work with our third party partners to manage its removal and we need to act swiftly to clean computers that are infected.

 

We are scanning the Network and if we identify any equipment which we believe is infected with the virus then we will contact you to ensure that the device is either removed from the Network or cleaned and loaded with the correct software to prevent this infection reoccurring.

You can help us to contain this problem and prevent new infection by adhering to the following advice:

• We are unable to clean PCs and portable computers which are either not switched on or which are not authorised devices. We therefore ask that if you are running a PC or portable computer not authorised to be on the Network that you take it off immediately.
• An additional characteristic of this virus is that for some types of files it can skip direct to the Network from a USB memory stick or other portable storage device (e.g. mp3 players) without hitting the virus checker software. We ask that for the time being you do not use memory sticks or any other portable storage devices on the Parliamentary Network.
• If you do identify a problem with the equipment you are running, please contact the PICT Service Desk on 020 xxxx 200x when it reopens on Wednesday 25 March from 8am.
• If you are connecting using one of our remote access services, from a Constituency Office for example, a separate communication will be sent to you.

Director of Parliamentary ICT.

 

This raises several salient questions in my mind…

1- What the expletive are “unauthorised devices” doing on the Parliamentary network in the first place? Of all the organisations in the country you would expect the UK parliament to be using Network Access Control technology to keep the wrong ‘uns out!

2- What kind of anti-malware solution are they running there that allows a worm to “skip direct to the Network from a USB memory stick or other portable storage device (e.g. mp3 players) without hitting the virus checker software” and also, one that doesn’t detect the worm itself?

3- Where’s the port control or DLP solution?Tthe memo itself being made public amply demonstrates (if any proof were needed) that the potential for data leakage exists, and this is Parliament.

4- What kind of message is this “We are unable to clean PCs and portable computers which are not switched on“? Surely this could be interpreted as “We are experiencing an outbreak, please make sure all computers are switched on“. That doesn’t sound like good containment policy to me.

I don’t want this post to be entirely negative though, so, Dear Parliament, if you are having trouble cleaning this up, give us a call we’ll come and do it for nothing.