You are the chief security officer of Anywhere Hospital. You just received a frantic email from one of your help desk employees in the Information Technology department. There is a suspected malware infection that is spreading across your computer network. You ask your staff member whether there has been data loss or corruption. Your team member responds by saying that she does not know yet; the security team has been called and will begin the investigation process, starting with the origin of the malware. A quick and thorough response to this incident is of the utmost importance and is crucial to avoid disrupting patient care systems.

A little while later, you discover that the malware was launched from within the network via email; specifically, the malware was launched on the vice presidents workstation in his office when he opened an email containing the malware. The hospitals Network Intrusion Detection System did not pick up abnormal traffic coming through the firewall.

Please answer the following questions?

1. What are the obvious dangers that occurred in this case?

2. What could the hospital have done to keep this breach from occuring? Name at least two things that could have happened to avoid the breach.

3. Do you think the CIO ensured systems were consistently monitored, but yet, the breach still occurred and was not detected? Why or why not?