After the August worm in 2005, we learned a few lessons. the most important being having better administration for our networking gear. We have come to a point now that we can disable a switch port or a group of ports or a segment with a click of a mouse, or a single command. This gives a ability to isolate the machine or a segment which is infected. Also we use policies on our switches through which we can disable any protocol port on a switch port or a LAN. We are also working on NAC solution which would allow is to isolate any outside laptop connecting to our network if it does not meet the baseline patched status.

Off course, all this is complimented with firewalls, IDSs and a dedicated security team.

That was all technical but it could not have been possible without strong policies and procedures and commitment from the senior management. Also, we have a great co-ordination between the IRT, Security team and the Net OPs and well defined guidelines so that in a event there is no time wasted going through the red tape.

Hope this helps

Thanks for the replies guys.

I always find it is good to take a step back from my current situation and see how others are handling the same issue. Especially good to see that others have had success with changes that I would like to implement, means I must be doing something right for a change

In a semi related issue, I've seen a few reports on research carried out state side that are trying to get Microsoft (and others I'm presuming) to change the way that patches are released. An attempt to stop the bad guys from reverse engineering the updates to create more exploits.

To me this seems short sighted and naive, as the 'fix' code needs to reach end users computers in one method or another and I can see nothing stopping the bad guys from (heaven forbid) purchasing a legit copy of <insert here> OS. From my understanding I can only see this scenario increasing the time/resources required to implement any new patch.

Is this really what is being proposed, or did I miss something somewhere?