JO STARNES, NT2580, UNIT 2
CALCULATING THE WINDOW OF VULNERABILITY
The window of vulnerability is the amount of time the systems defense measures are compromised, minimized, or eliminated. This is when the system is most likely to be at risk, and can be affected by malicious attacks.
It is not stated as what day the server software detected the attack on the SMB server. It only states that it was detected the day before. So from day one, these are the steps we will need to take to get the SMB server back up and running properly and safely, as well as the amount of time it will take for us to solve the issue:
Day 1 - The software company will release a patch for this attack in three days.
Day 4 – We will receive the patch, and we need to install and test the patch, this will take at least five days. Day 9 – After installation and testing is completed; we will send the update to the entire company’s network devices. As soon as all the updates are sent out to all the devices, they will need to be rebooted in order for the patch to take effect. We can send out a message to all devices to insure this happens. This could take a day or two to complete.
This could all be completed as early as 10 days if there are no issues during the process, however problems may arise and it could possibly take a day or two more. I hope that this is helpful and we will start immediately on the problem.
It is of upmost importance that you have team members monitoring the server at all times during the Window of Vulnerability. Report any issues to us and we will certainly address them immediately.
Resources
Microsoft TechNet, Window of Vulnerabily,9.25.14