Even large institutions not immune to Conficker

The latest Conficker news in Ed Tech comes from the University of Utah. According to CNET News,

More than 700 computers at the University of Utah have been infected with the Conficker worm.

The hit includes computers at the university's three hospitals

While this isn't exactly surprising (this worm is pretty insidious) it should make institutions of all sizes think hard about their IT policies, hardware, and software. There aren't too many of us who have taken a lunch break in the last few years, so we know that it is all too easy to let patching and updates slide, especially on older machines. Yet any machine running recent Microsoft operating systems that has had patches and updates applied through the end of 2008 should not have been infected with Conficker.

Certainly, we expect this sort of thing on home machines that simply get used by naive owners, but at a university? And there's the rub: no matter how big or small your institution, computers can fall through the cracks. Even at our small high school, this has been the first year that we've had comprehensive documentation for all computers onsite. It's easy to roll out a computer for a user; it's far harder to keep track of it.

Small schools often lack the resources to ensure that updates take place when they need to while large institutions have countless computers to manage, sitting in a variety of departments, many of which might manage their own IT. It's no wonder that many schools resort to Draconian approaches to user privileges, outside computing resources, etc. Hospital IT simply can't go down; yet that is exactly what happened in the case of the University of Utah, as the school attempted to isolate the Conficker-infected machines.

While we all struggle with limited resources in school IT, situations like Conficker certainly make the case for powerful devices at the gateway that can scan and detect infected clients. They also make the case for extensive documentation and policies, ensuring that "rogue computers" aren't set up in an office somewhere wreaking havoc where no one can locate them.