Question

DOCK STUDID Turnitin Editor - Chagg Writing . . For each discussion topic, you must make a minimum of three substantive posts: one post that starts a new thread (6 points) and two posts commenting on (in reply to) other students' new threads (2 points cach) for a total of (10 points) Discussions are implemented as “post first discussions. You will not be able to see any other students' posts until you have posted your own new threads, and you may not edit your post once they are submitted • Each original post will be evaluated based on accuracy, relevance to the topic, clarity and level of detail. Significant word, sentence, paragraph, grammatical and punctuation issues will also be evaluated. • A substantive reply is one that contributes meaningfully to the discussion. A reply that says, in essence, little more than "I agree...," or "Good post...," or "Thank you...," will not receive any credit. Posts that stray from the topic also will not receive credit. • Each original post should be at least 100 words and each reply should be at least 50 words. There is no maximum word limit • Failure to meet the above requirements will result in appropriate deductions for each discussion board. On a Sunday afternoon at a hospital in the Pacific Northwest, computers became sluggish, and documents would not print. Monday morning, the situation became worse when employees logged on to their computers. Even stranger things happened- operating-room doors would not open, pagers would not work, and computers in the intensive care unit shut down. By 10:00 A.M., all 50 IT employees were summoned. They discovered that the hospital was under attack by a botnet that exploited a Microsoft operating system flaw and installed pop-up ads on hospital computers. They got access to the first computer on Sunday and used the hospital's network to spread the infection to other computers. Each infected computer became a zombie that scanned the network looking for new victims. With the network clogged with zombie traffic, hospital communications began to break down. The IT staff tried to halt the attack by shutting off the hospital's Internet connection, but it was too late. The bots were inside the hospital's computer system and infecting other computers faster than they could be cleaned. Monday afternoon IT figured out which malware the bots were installing and wrote a script, which was pushed out hourly, directing computers to remove the bad code. The script helped to slow the bots down a bit. (Source: D. Gage, Baseline Security, February 6, 2007.)

Answer 1

The hospital can stop the attack and contain the damage by using the kill switch that comes with their VPN i.e. virtual private network. What the kill switch does is that it immediately stops access to confidential information and ensures that access to private data through a public network is not allowed. The kill switch will stop transfer of data and will hopefully contain the damage at the right time. Also the malware that was used for the attack should be identified and the hospital’s antivirus vendor should be informed about the same so that the antivirus software can then take care of the bots and deal with the malware.

The computer fraud and abuse technique that the hackers used in their attack on the hospital is called “Zero day attack”. This is an advanced cyber-attack that takes advantage of a software vulnerability or operating system vulnerability. Here the vulnerability was present in Microsoft’s operating system.

The hospital should have taken a few steps and measures that could have prevented the damage caused by the attack. Firstly it should have got protection that worked at DNS level. Auto patch management tools are also available and the hospital should have used that. Secondly it should have disabled automatic software installation in its system and instead opted for manual software installation. Thirdly it should have made use of network compartmentalization as it would have helped to put up access controls to limit internal communication. It also monitors tracks of unexpected connections, highlighting the presence of a cyberattack.

(225 words)