Despite some similarities, each of the recent attacks is very different in its makeup, method of attack, and potential damage. Generally, Code Red and Code Red II are both “worms,” which are attacks that propagate themselves through networks without any user intervention or interaction. They both take advantage of a flaw in a component of versions 4.0 and 5.0 of Microsoft’s Internet Information Services (IIS) Web server software. Code Red originally sought to do damage by defacing Web pages and by denying access to a specific Web site by sending it massive amounts of data, which essentially would shut it down. This is known as a denial-of- service (DoS) attack. Code Red II is much more discreet and potentially more damaging. Other than sharing the name of the original worm, the only similarity Code Red II has with Code Red is that it exploits the same IIS vulnerability to propagate itself. Code Red II installs “backdoors” on infected Web servers, making them vulnerable to hijacking by any attacker who knows how to exploit the backdoor. It also spreads faster than Code Red. Both attacks have the potential to decrease the speed of the Internet and cause service disruptions. More importantly, these worms broadcast to the Internet the servers that are vulnerable to this flaw, which allows others to attack the servers and perform other actions that are not related to Code Red. SirCam is a malicious computer virus that spreads primarily through E- mail. Once activated on an infected computer, the virus searches through a select folder and mails user files acting as a “Trojan horse” to E-mail addresses in the user’s address book. A Trojan horse, or Trojan, is a program containing hidden code allowing the unauthorized collection, falsification, or destruction of information. If the user’s files are sensitive in nature, then SirCam not only succeeds in compromising the user’s computer, but also succeeds in breaching the data’s confidentiality. In addition to spreading, the virus can attempt to delete a victim’s hard drive or fill the remaining free space on the hard drive making it impossible to perform common tasks such as saving files or printing. This form of attack is extremely serious since it is one from which it is very difficult to recover. SirCam is much more stealthy than the Melissa and ILOVEYOU viruses because it does not need to use the victim’s E-mail program to replicate. It has its own internal capabilities to mail itself to other computers. SirCam also can spread through another method. It can copy itself to other unsuspecting computers connected through a Windows network (commonly referred to as Windows network computers) that has granted read/write access to the infected computer. Like Code Red and Code Red II, SirCam can slow the Internet. However, SirCam poses a greater threat to the home PC user than that of the Code Red worms. Table 1 provides a high-level comparison of the attacks. The attachment to this testimony answers the questions in the table in greater detail. Systems infected by Code Red and SirCam can be fixed relatively easily. A patch made available by Microsoft can remove the vulnerability exploited by Code Red and rebooting the infected computer removes the worm itself. Updating and using antivirus software can help detect and partially recover from SirCam. Patching and rebooting an infected server is not enough when a system is hit by Code Red II. Instead, the system’s hard drive should be reformatted, and all software should be reinstalled to ensure that the system is free of other backdoor vulnerabilities. Of course, there are a number of other immediate actions organizations can take to ward off attacks. These include: using strong passwords, verifying software security settings, backing up files early and often, ensuring that known software vulnerabilities are reduced by promptly implementing software patches available from vendors, ensuring that policies and controls already implemented are operating as using scanners that automatically search for system vulnerabilities, using password-cracking tools to assess the password strength of the using network monitoring tools to identify suspicious network activity, developing and distributing lists of the most common types of vulnerabilities and suggested corrective actions. Reports from various media and computer security experts indicate that the impact of these viruses has been extensive. On July 19, the Code Red worm infected more than 250,000 systems in just 9 hours, according to the National Infrastructure Protection Center (NIPC). An estimated 975,000 servers have been infected in total, according to Computer Economics, Inc. Code Red and Code Red II have also reportedly disrupted both government and business operations, principally by slowing Internet service and forcing some organizations to disconnect themselves from the Internet. For example, reports have noted that (1) the White House had to change the numerical Internet address that identifies its Web site to the public, and (2) the Department of Defense was forced to briefly shut down its public Web sites. Treasury’s Financial Management Service was infected and also had to disconnect itself from the Internet. Code Red worms also reportedly hit Microsoft’s popular free E-mail service, Hotmail; caused outages for users of Qwest’s high-speed Internet service nationwide; and caused delays in package deliveries by infecting systems belonging to FedEx Corp. There are also numerous reports of infections in other countries. The economic costs resulting from Code Red attacks are already estimated to be over $2.4 billion. These involve costs associated with cleaning infected systems and returning them to normal service, inspecting servers to determine the need for software patches, patching and testing services as well as the negative impact on the productivity of system users and technical staff. Although Code Red’s reported costs have not yet surpassed damages estimated for last year’s ILOVEYOU virus, which is now estimated to be more than $8 billion, the Code Red attacks are reportedly more costly than 1988’s Morris worm. This particular worm exploited a flaw in the Unix operating system and affected VAX computers from Digital Equipment Corp. and Sun 3 computers from Sun Microsystems, Inc. It was intended to only infect each computer once, but a bug allowed it to replicate hundreds of times, crashing computers in the process. Approximately 10 percent of the U.S. computers connected to the Internet effectively stopped at the same time. At that time, the network had grown to more than 88,000 computers and was a primary means of communication among computer security experts. SirCam has also reportedly caused some havoc. It is allegedly responsible for the leaking of secret documents from the government of Ukraine. And it reportedly infected a computer at the Federal Bureau of Investigation (FBI) late last month and sent some private, but not sensitive or classified, documents out in an E-mail. There are reports that SirCam has surfaced in more than 100 countries. GAO has identified information security as a governmentwide high risk issue since 1997. As these incidents continue, the federal government continues to face formidable challenges in protecting its information systems assets and sensitive data. These include not only an ever changing and growing sophistication in the nature of attacks but also an urgent need to strengthen agency security controls as well as a need for a more concerted and effective governmentwide coordination, guidance, and oversight. Today, I would like to briefly discuss these challenges. I would also like to discuss progress that has been made in addressing them, including improvements in agency controls, actions to strengthen warning and crisis management capabilities, and new legislation to provide a comprehensive framework for establishing and ensuring effectiveness of information security controls over information resources that support federal government operations and assets. These are positive steps toward taking a proactive stand in protecting sensitive data and assets. First, these latest incidents again show that computer attack tools and techniques are becoming increasingly sophisticated. The Code Red attack was more sophisticated than those experienced in the past because the attack combined a worm with a denial-of-service attack. Further, with some reprogramming, each variant of Code Red got smarter in terms of identifying vulnerable systems. Code Red II exploited the same vulnerability to spread itself as the original Code Red. However instead of launching a DoS attack against a specific victim, it gives an attacker complete control over the infected system, thereby letting the attacker perform any number of undesirable actions. SirCam was a more sophisticated version of the ILOVEYOU virus, no longer needing the victim’s E-mail program to spread. In the long run, it is likely that hackers will find ways to attack more critical components of the Internet, such as routers and network equipment, rather than just Web site servers or individual computers. Further, it is likely that viruses will continue to spread faster as a result of the increasing connectivity of today’s networks and the growing use of commercial-off-the-shelf (COTS) products, which, once a vulnerability is discovered, can be easily exploited for attack by all their users because of the widespread use of the products. Second, the recent attacks foreshadow much more devastating Internet threats to come. According to official estimates, over 100 countries already have or are developing computer attack capabilities. Further, the National Security Agency has determined that potential adversaries are developing a body of knowledge about U.S. systems and methods to attack them. Meanwhile, our government and our nation have become increasingly reliant on interconnected computer systems to support critical operations and infrastructures, including telecommunications, finance, power distribution, emergency services, law enforcement, national defense, and other government services. As a result, there is a growing risk that terrorists or hostile foreign states could severely damage or disrupt national defense or vital public operations through computer-based attacks on the nation’s critical infrastructures. Third, agencies do not have an effective information security program to prevent and respond to attacks—both external attacks, like Code Red, Code Red II, and SirCam, and internal attempts to manipulate or damage systems and data. More specifically, we continue to find that poor security planning and management are the rule rather than the exception.