Seventy-plus attacks
in a single afternoon.

The situation

Public-health surveillance systems running in seventy-five countries, and the encrypted hardware that went into the field with researchers and staff. Equipment came back from the field infected often enough that breaking down the malware — how it worked, how it spread — was part of the job rather than an incident. And every system in the estate, without exception, carried NIST 800-53 controls at Low, Moderate or High.

What made it different

Two things, and neither is what people expect. The first is scale of categorization: most enterprises put a couple of systems through 800-53 and find it painful. This was hundreds, each one categorized and controlled at its own level, all of it live. The second is more mundane and harder to engineer around — seventy-five countries is a great many time zones. Ever had a meeting start at two in the morning? That is not a war story, it is a Tuesday, and it shapes what kind of security operation is actually sustainable.

What I did

Ran security for the whole footprint: the surveillance systems across all seventy-five countries, the 800-53 control baseline across hundreds of systems, and the encrypted-hardware program that put equipment into researchers’ hands and took it back afterwards.

When that hardware returned infected, I took the malware apart myself — what it was, how it worked, how it propagated — rather than sending it somewhere and waiting for a verdict. In an environment where the same field kit goes back out again, understanding the spread mechanism is the difference between cleaning one laptop and stopping a pattern.

Result