How well did this company perform during the attack? iPremier, like most, performed at a high level during the attack. What I mean by that is that it appears from the reading that the entire company, or those responsible, took the approach of “all hands on deck”. It is in moments like this where people are generally thinking quickly, and sometimes out of the box. This helped to managed a correlated effort to resolve the issues. This is not to say that they didn’t have places for improvement. From the design of the article, there were traces that alluded to the fact that this was something that wasn’t planned on or prepared for. Almost as if security was a second tier concern of the company. For the CIO to be sitting on the ground when the bad news came, sends a message that there was a “surprise” that this type of thing could happen. This “it can’t happen to me” syndrome is the outcome of, either, an unprepared company or one in denial; no pun intended. Overall the outcome was good, so the performance must be measured on the outcome.

What should they have done differently, before or during the event?
After reviewing the Technical Architecture, it was clear that there was no DMZ established to help with such an attack. Whether this was just missing from the diagram or actually missing isn’t clear, but assuming the diagram to be correct, it is clear that there were very few cautions taken to protect the company/customer information from attacks. To have the firewall as the only thing in the DMZ or exposed to the outside world would have been a simple step to increase security and prevent this type of DoS before it ever happened. Following this same vein, the company should have recognized simple functions like this and implemented. It seems that premier was more concerned about saving the ego of the CIO than actually fixing the problem for future attacks.

What should they do in the aftermath of the event?
Security/Security/Security. The 3 basic rules of outward facing data are all security. A company such as iPremier should work towards having an internal focus of security, with a person/people specifically devoted to ensure the integrity and security of the system. This type of function should not fall to the CIO, but rather should be a sub-function of the IT organization.

What, if anything, should they say to customer, investors, and the public about what has happened?
Perception is the trick to a good campaign. I feel that if there is anything said, it should be the truth, but should be quickly followed with the positive notes that “we discovered the issue very early on and have resolved it” type of speak. All-in-all it depends on the desire of the company, but the best thing to do is face the medicine.