Every three minutes an intranet is under siege. Consider the IT employee at a Fortune 1000 company who knew he was about to get fired. He rigged the payroll server to send a nasty virus networkwide on the first payday the server didn't cut him a check. That day comes, and the entire network goes down, bringing the whole corporation to a screeching halt. It looked like a spontaneous virus, with no source.
Scary part is that it was really easy for the guy to rig.
Hancock said he had to look through audit logs on the network and essentially retrace all network activity for months before. The key to the mystery was hidden in that electronic paper trail. For starters, that means setting up firewalls to control the flow of information into and out of your network. Also, turn on the audit logs feature in your operating system. In Windows NT, you'll find it under the Configuration Options menu.