Study: Unprotected PCs Compromised in 20 minutes

According to the Internet Storm Center, part of the SANS Institute, between 2003 and 2004, the average 'survival time' of unprotected computers connected to the Internet dropped from 40 minutes to 20 minutes. A user connecting a new, unpatched PC to an unprotected Internet connection can expect to be infected by one of numerous worms within this time. The actual time it will take for a specific computer to be compromised will vary widely depending on any filters applied by the Internet Service Provider (ISP) and the configuration of the operating system.

Because it is difficult or impossible to download all critical patches within 20 minutes, the SANS ISC published a guide to assist users in connecting to the Internet securely while downloading critical updates. This guide, which targets users of Windows XP, is entitled "Windows XP: Surviving the First Day" and can be accessed (at no cost) at the SANS Institute Reading Room.

Survival time is computed from data in reports submitted daily by several thousand volunteers around the world. On average, each system reporting data is hit by a probe once before the survival time expires. These same data are used to monitor the Internet for outbreaks of worms, and the complete network of sensors and analysis is called Internet Storm Center. Complete reports to attack patterns on the Internet may be found at http://isc.sans.org. Volunteers submitting data to Internet Storm Center represent a wide range of Internet users and include home users, corporate users, universities and government agencies in more than 70 countries. Internet Storm Center is now receiving over 1 billion reports each month from organizations that manage more than 500,000 Internet addresses.



Graph shows average survival times from March 2003 to July 2004 -- Internet Storm Center