This blog is a platform to highlight information risk. The whole Conficker issue has certainly influenced information risk in both positive and negative ways.

“Billso” is right, there is little doubt significant events in the malicious code space spur users to practice better information security habits. They renew their AV subscriptions or install new AV. The word “firewall” re-enters their vocabulary. They examine their habits for risks.

Business leaders turn to their technology staff with “we’re covered about this Conficker thing right?” queries. These represent opportunities for IT and InfoSec staff to engage their leaders about not only Conficker but other issues they face. If nothing else, it’s an opportunity for the IT and IS staffs to develop relationships across the business. From this perspective, an unintended consequence of Conficker is it has helped us reduce total risk.

This is the primary reason crimeware authors have striven to “run under the radar” since the days of Sasser, Slammer and Code Red. They don’t want headlines to encourage users to safer habits. They do want to cultivate “what, me worry?” attitudes. In the past couple of months, their goals in this vein have been thwarted.

“Caffeine head” is also correct that Conficker has spared many from hardship for the same reason; they clean up their safe computing habits. I suspect “JM” is of the opinion that because Conficker didn’t “detonate” on April 1st, “caffeine head” was overreaching, but I’m reticent to make the same accusation. Every user who’s updated AV, or has been reluctance to click on “you need to upgrade flash to view this video,” has been spared hardship; especially those un-related to Conficker, courteous of other crimeware.

Conficker is a risk problem. Part of the problem is what we don’t know, and not knowing is causing us to spend time trying to understand it, time we could be devoting to other risk management activities. Part of the problem is the magnitude of infected systems. Our colleagues at IBM have recently blogged about their measurements of the size of the Conficker infected population at http://blogs.iss.net/archive/CountingConfickers.html

Conficker has helped us engage users and business leaders to build the trust I think JM wants us to build. The conversations we have, like this one, when we can set others straight on what aspects of the issue are hype and what issues really do represent risk; these conversations cultivate relationships and trust.