State of Texas
Department of Information Resources
Leadership for Texas Government Technology

DIR Home | Store | Document Library | Education & Training | DIR Overview | Site Map

IT Security
	Emergency Alerts
	IT Security Services
	Monthly Incident Reports
	Reading Room
	Policies, Standards & Guidelines
	Continuity & Contingency Planning
	IT Security Training
	IT Security Contacts

Related Resources

SecureTexas - the online security resource for Texas citizens

Monthly Incident Summary Reports: March - May 2005

Links to other reports are available on the Security Reports Homepage.

Number of Agencies/Universities Reporting
Types of Incidents
Impact of Incidents
Incident Profiles
Malicious Code
Server Types (Number of Systems)
Response Activities and General Information
Top Ten Viruses

Number of Agencies/Universities Reporting:

March 2005
Organization Type	Incidents	No Incidents	No Report	Total
Universities	35	17	4	56
Agencies	41	38	15	94

April 2005
Organization Type	Incidents	No Incidents	No Report	Total
Universities	35	18	3	56
Agencies	35	42	17	94

May 2005
Organization Type	Incidents	No Incidents	No Report	Total
Universities	34	21	6	61
Agencies	39	39	10	88

Types of Incidents:

**Types of Incidents**
Types of Incidents	March 2005	April 2005	May 2005
Actual Infections	5,967	7,283	5,032
Unauthorized Physical Access	18	1	2
Unauthorized Information Access	11	6	3
Web Site Defacement	10	7	6
Theft of Equipment	2	6	7
Theft of Information	0	2	1
Unauthorized Use/Misuse	69	276	65
Accidental Disruption	37	31	269
Disruption or Denial of Services (DOS)	14	71	5
Other	451	28,343	6,337
Total	6,579	36,025	11,727

Impact of Incidents:

**Impact of Incidents**
Month	Total Hours	Downtime Hours	Total Costs	Lost Data
March 2005	3,845	598	$163,493	1
April 2005	2,647	208	$110,419	0
May 2005	4,308	484	$150.227	1

Incident Profiles:

**Incident Profiles**
Month	Detected with IDS	Internal Source	External Source
March 2005	13,590,416	119,999	792,653
April 2005	9,025,002	25,092	1,150,681
May 2005	11,718,191	1,788,622	548,798

Malicious Code:

**Malicious Code**
Malicious Code	March 2005	April 2005	May 2005
Viruses/Worms	2,137,280	1,235,021	10,438,755
Logic Bombs	93	18,730	127
Back Doors	4,696	7,582	35,695
Other Malicious Code	226,507	933,845	264,141
Actual Infections	March 2005	April 2005	May 2005
Total Workstations/Hard Drives Infected	5,686	7,270	5,015
Total Servers Infected	281	13	17

Server Types (Number of Systems):

**Server Types (Number of Systems)**
Type of Systems	March 2005	April 2005	May 2005
Critical production applications and/or data	20	519	7
Critical administrative/support applications and/or data	5	7	17
Research applications and/or data	15	1	0
Academic applications and/or data	25	7	27
External use web servers	336	2,271	8,176
Internal use web servers	6	8	13
FTP Servers	331	10,129	481
Email Servers	46,895	40,353	651,892
Print Servers	5	27	2
Other Servers	255	29	55
Total	47,893	53,351	73,967

Response Activities and General Information:

**Response Activities and General information**
Question	March 2005	April 2005	May 2005
1. Number of times were incident response plans activated	354	121	74
2. Number of times disaster recovery plans activated due to security incident	2	0	0
3. Average hours from detection to containment	558	281	283
4. Incidents with response activity logs kept	699	327	2,165
5. Damage to agency/university IR assets	21	11	62
5a. Number of Assets restored	21	8	59
6. Number of incidents needed outside assistance	11	4	11
7. Number of incidents resulted in new security measures	421	283	39
7a. Number of patches installed	433	264	54
7b. Number security software installed	91	44	82
7c. Number of additional policies developed	6	5	9
7d. Number other	4	0	2
8. Number incidents resulted in proliferation	63	32	44
8a. Internal Systems	290	2	490
8b. External Systems	9	30	11
9. Incidents resulted in external public awareness	12	8	4
10. Number Incidents reported to law enforcement	2	4	3

Top Ten Viruses:

**Top 10 Viruses**
March 2005	April 2005	May 2005
Slammer	Adware	Slammer
Netsky	Erkez	Sober
Erkez	Netsky	Netsky
Zafi-D	Mytob	Mytob
MyDoom	Zafi	Sobig
Beagle	MyDoom	Zafi
MIME	Beagle	MyDoom
Bagle	Bagle	Bagz
Mytob	MIME	MIME
Sober	Phish-Bank Fraud	Bank Fraud




	Department of Information Resources 300 West 15th St., Suite 1300 Austin, TX 78701 (Map & Directions) 1-512-475-4700		Privacy & Security Policy Accessibility \| Open Records Policy Link Policy \| Compact with Texans DIR Contacts \| dirinfo@dir.state.tx.us

Last updated November 18, 2005