Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

I work at an insurance company in the U.S. My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the tech department, and they simply told him not to worry about it and continue his work as normal, as they will look at it at the end of the day after he is out of work. I was pretty surprised by this, as I would assume that a virus detection could possibly be any form of malicious code that could potentially infect the network, and compromise my colleague's data. We work as developer's on the company's database. So a virus could potentially be lead to stolen client's data from the database, or even closed source code on the local machine.

Am I missing something here? Do big companies monitor the network in a way that they feel secure about a potential virus on one user's machine.

share|improve this question
7  
There's two possible states I can think of: 1) The AV caught it on 'entry', stopped it, removed it, and logged it, at which point there's nothing else for anybody to really do; and 2) The AV just now noticed something that's been present for a while, so you're already 'compromised'; potentially, any data would have been already exfiltrated, and there's nothing to do but check the logs... – Clockwork-Muse Nov 27 '12 at 0:58
1  
@Clockwork-Muse: you might want to make a full-fledged answer out of that comment; it seems right on spot to me. – Thomas Pornin Nov 27 '12 at 2:11
@Clockwork-Muse I second that, and think a full answer would benefit this site's users – makerofthings7 Nov 27 '12 at 17:42
Fine, twist my arm will you... – Clockwork-Muse Nov 27 '12 at 18:10

2 Answers

up vote 5 down vote accepted

There's two possible states I can think of:

  1. The AV caught it on 'entry', stopped it, removed it, and logged it, at which point there's nothing else for anybody to really do
  2. The AV just now noticed something that's been present for a while, so you're already 'compromised'; potentially, any data could have already been exfiltrated, and there's nothing to do but check the logs. Analysis of the logs could take a while, can be done remotely, and would include checks of other resources (say, network connections) that likely have higher priority.
share|improve this answer
"nothing else for anybody to really do"? I would personally wipe the computer and restore it to a clean image (or restore from backups if there's anything important on the machine itself). – Tom Marthenal Nov 29 '12 at 17:18
@Tom - Depending on how your AV is setup, it'll popup notifications for even (failed) drive-by-downloading attempts, which never make it past the firewall, let alone being able to install. You'd wipe the machine for something like that? – Clockwork-Muse Nov 29 '12 at 17:36
If I'm responsible for ensuring the security of private financial data... probably. Better safe than sorry. I definitely would for anything that actually gets downloaded or installed. I can re-image a computer in 10 minutes of my time (and an hour or so of waiting). I'd guess that my_hourly_rate * 1 > probability_vulnerability_still_exists * cost_of_data_leak. – Tom Marthenal Nov 30 '12 at 3:13
up vote 2 down vote

If the AV is centrally managed using something like ePO (McAfee) the tech support guys probably knew what happened before he called. If the virus/trojan/worm/malware was something that was caught before it ran or is a low-threat file it's not a big deal and waiting a few hours to pick up on it isn't too unusual. Without knowing what was detected it's hard to say what I would do but I wouldn't go running off to the desktop for something that was caught either. Adding to that; there's plenty of things they can do across the network without needing to visit the workstation.

There are quite a few bits of nasty code out there that can be brought down by simply browsing the web that are caught by most up-to-date antivirus solutions. If it was caught and prevented from running then there's really not much to do other than slap the user's hand for browsing unsafe sites.

To address your title question; 'How serious is a local virus in terms of network security?'

The severity depends on what the virus is, how it was caught, where it was caught, and also what it's impact to the network or system would be if executed. For little drive-by downloaders it's really not as scary. If the detection was a rootkit related file in C:\Windows\sytem32 then I'd be more concerned.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.