Businesses dig out from Slammer

"Our students are very creative these days. We figure if we can't defend against one of these [worms] we definitely can't protect ourselves against our students," Hill said.

Halamka also said that monitoring tools and up-to-date network hardware from Cisco Systems helped to blunt the impact of Slammer at BIDMC.

Although BIDMC had patched its SQL Server machines using Service Pack 3 in July, however, IT staff didn't anticipate the worm spreading through the vulnerable Microsoft Data Engine 2000 (MSDE) component, which was also affected by the SQL vulnerability and was installed on personal computers running Microsoft Office XP in the hospital's research area and in private offices, Halamka said.

Those nonserver machines caused the slowdowns on BIDMC's network, according to Halamka.

Such lapses are common given the large number of software security bulletins and patches released by companies such as Microsoft each year, according to Vincent Gullotto, vice president of the McAfee AVERT (Anti-Virus Emergency Response Team) division.

"The difficulty for organizations is to know which patches to apply and which not to apply," Gullotto said.

Organizations should consider working with security consulting companies or speaking directly with software vendors to determine the possible impact of security vulnerabilities.

"Administrators need to look at each bulletin and determine how bad the vulnerability is and whether it affects them. When the vulnerability is on a popular platform that you are using, some action is required because the more popular the platform, the more valuable a target it is for a hacker," Gullotto said.

In addition to scrutinizing each patch announcement, organizations should consider deploying vulnerability assessment tools for their network and increasing the frequency with which they roll out software updates to user desktops, Gullotto said.