Effective response Through coordination and cooperation, the international incident response community, the anti-virus vendors, and the media played major roles in limiting the spread and impact of the Melissa virus. The timeline covers the period from the Melissa virus release on Friday, March 26, through the response efforts over the following weekend. They did this to ensure that the virus analysis was complete and that details from as many anti-virus vendors as possible could be included in the CERT advisory on the Melissa virus. The anti-virus community has a long history of collaboration and prompt response. This approach facilitates its response as it shares virus exploits and analyses to ensure that each vendor can implement its own identification and eradication techniques.
CERT advisories reach a vast number of system and network administrators on the Internet.
But given the timing of the virus release and of the advisory, there was concern that many people would be enjoying their weekend and would be oblivious to the growing threat from the Melissa virus. The role of the media Many incident response and security teams are wary of working with the media as part of their incident response strategy. Internet security topics greatly interest the media, but unless the quality of the reporting of these events is high, there is always a possibility that the technical information reported could be incorrect and that the coverage might do more harm than good. In the case of the Melissa virus, though, the media reported the story accurately and effectively. This good reporting dramatically increased the world's awareness of the threat and the availability of appropriate countermeasures.