Conclusions Advanced warning didn't help We had HD's exploit for a few weeks Firewall rules, IDS signatures Patch was available for approximately 1 month High threat level Large scale worm + DDoS payload Blaster spread quickly, contained by week's end 6 hour spread time, 5 day containment time DDoS thwarted Potential for 1.3mil SYN pps Blaster could have been worse