State of Texas
Department of Information Resources
Leadership for Texas Government Technology

IT Security
	Emergency Alerts
	IT Security Services
	Monthly Incident Reports
	Reading Room
	Policies, Standards & Guidelines
	Continuity & Contingency Planning
	IT Security Training
	IT Security Contacts

Related Resources

Monthly Incident Summary Reports: March 2004 - May 2004

Links to other reports are available on the Security Reports Homepage.

Section 1: March 2004 - May 2004
Number of Agencies and Universities Reporting:

March 2004
OrganizationType	Incidents	No Incidents	Total
Universities	37	16	53
Agencies	40	34	74

April 2004
OrganizationType	Incidents	No Incidents	Total
Universities	41	16	57
Agencies	43	41	84

May 2004
OrganizationType	Incidents	No Incidents	Total
Universities	40	15	55
Agencies	46	42	88

Types of Incidents:

Types of Incidents	March 2004	April 2004	May 2004
Actual Infections	10632	2498	3347
Unauthorized Physical Access	3	3	23
Unauthorized Information Access	7	5	44
Web Site Defacement	3	1	0
Theft of Equipment	3	11	30
Theft of Information	1	3	21
Unauthorized Use/Misuse	79	65	460
Accident/Planned Disruption	5	12	21
Disruption or Denial of Services (DOS)	5	41	12
Other	50627	43623	25978
Total	61365	46262	29936

Impact of Incidents:

Month	Total Hours	Downtime Hours	Total Costs	Lost Data
March 2004	6275	2735	290382	-
April 2004	3764	951	174291	-
May 2004	9487	2342	394753	2

Incident Profiles:

Month	Detected with IDS	Internal Source	External Source
March 2004	4216105	5192	4184151
April 2004	4571305	7057	4585731
May 2004	7937679	4895	7887010

Malicious Code:

Malicious Code	March 2004	April 2004	May 2004
Viruses/Worms	2942596	4932748	5960763
Logic Bombs	139	-	-
Back Doors	6425	4448	3580
Other Malicious Code	213040	441868	366653
Actual Infections	March 2004	April 2004	May 2004
Total Workstations/Hard Drives Infected	10371	2467	3327
Total Servers Infected	209	31	21

Server Types (Number of Systems):

Type of Systems	March 2004	April 2004	May 2004
Critical production applications and/or data	20	8	9
Critical administrative/support applications and/or data	8	8	60
Research applications and/or data	2	2	4
Academic applications and/or data	9	5	4
External use web servers	7	7	6
Internal use web servers	6	5	6
FTP Servers	797	1982	2441
Email Servers	40851	491573	55854
Print Servers	-	3	5
Other Servers	4457	63908	33577
Total	46157	557501	91966

Response Activities and General Information:

Question	March 2004	April 2004	May 2004
1. Number of times were incident response plans activated	4330	425	210
2. Number of times disaster recovery plans activated due to security incident	62	11	0
3. Average hours from detection to containment	413	357	390
4. Incidents with response activity logs kept	1040	709	867
5. Damage to agency/university IR assets	90	239	42
5a. Number of Assets restored	94	239	58
6. Number of incidents needed outside assistance	6	6	32
7. Number of incidents resulted in new security measures	214	269	312
7a. Number of patches installed	651	549	1088
7b. Number security software installed	31	1027	412
7c. Number of additional policies developed	12	5	27
7d. Number other	12	3	3
8. Number incidents resulted in proliferation	98	122	286
8a. Internal Systems	76	103	122
8b. External Systems	24	19	159
9. Incidents resulted in external public awareness	43	12	1
10. Number Incidents reported to law enforcement	1	3	3




	Department of Information Resources 300 West 15th St., Suite 1300 Austin, TX 78701 (Map & Directions) 1-512-475-4700		Privacy & Security Policy Accessibility \| Open Records Policy Link Policy \| Compact with Texans DIR Contacts \| dirinfo@dir.state.tx.us

Last updated November 18, 2005