Internet Security Systems (ISS) is the leading provider of total information security management for networks, servers, applications and desktops. ISS offers security management systems for security assessment, policy enforcement and intrusion detection - all built on the company's SAFEsuite™ security management platform. ISS also provides superior customer service, consulting and education offerings that significantly reduce the complexity and expense inherent in protecting online assets.
 
THE SITUATION
 
They were coming, that much was for sure. It was just a matter of time.
 
But who? And how?  And from where?
 
“X-Force” is ISS’s internal, worldwide “Internet watchdog” research team, ever alert and on the watch for hacker activity.  And the “X-Force™” knew there was a large attack coming since they had been watching specific criminal hacker activities more closely since the summer of 1999. 
 
THE OPPORTUNITY
 
ISS, with the help of Brodeur Worldwide, was ready and waiting for a big attack, and ISS’s objective was to use such an event as an opportunity to position itself as THE source for Internet security.
 
RESEARCH AND PLANNING
 
ISS and Brodeur developed and currently utilize two media lists for two different purposes.  One list is for “security” as an industry, which includes contacts for media outlets offering financial news.  The second list is for “security” as a news topic.  Called the “X-Force media list,” that second list contains contacts in the press who cover computer attacks and hacker news. The X-Force media list was to be used when quick response to an attack is needed. Also, key spokespeople for the X-Force also are made readily available 24 hours a day to respond to media requests around the world.
 
STRATEGY
 
For ISS, the strategy was simple: Be prepared, wait for the attack, and make key executives available to the media around-the-clock.
 
Brodeur, ISS and its federally funded partner, Computer Emergency Response Team, sent out an “attack alert” to clients, prospective clients and the media on December 28, 1999, warning that a big attack was on the horizon.  Hackers, the alert explained, display identifiable patterns of online behavior leading up to attacks -- and that’s what ISS’s X-Force watches for.  By noting these patterns, ISS was able to say that something big was coming. The company also articulated the seriousness of the pending attack and detailed the damage it could cause to websites.  ISS also predicted that this attack would hit more popular, larger sites.
 
ISS’s outreach to the media included an offer to help “put the attack into context” when it finally occurred.
 
None of ISS’s competitors (Network Associates, Symantec, Security Focus) took such an approach prior to the DoS attack.
 
EXECUTION
 
The attack finally came on February 8, 2000, as hackers launched “Denial of Service” (DoS) attacks that crippled Yahoo!, eBay, Amazon, E*TRADE, CNN and other high-profile Web destinations. The term “DoS” quickly became a buzzword in the press, but few in the public arena really knew what it meant or how such attacks were launched.
 
RESULTS
 
The proactive alert was successful in educating ISS’s audience and increasing trust in the company.  Because of it, the media was quick to respond to the offer from ISS representatives to put the attacks in context. Momentum picked up after quotes from ISS began appearing in DoS news stories, and soon more reporters were calling on ISS for expert opinion, quotes and context. 
 
In seven fast and furious days, the ISS media team conducted 108 interviews – which translates roughly to a bit more than one interview every 30 minutes for the week beginning February 8, 2000 and ending February 16, 2000.
 
ISS representatives, including CEO Thomas Noonan, Founder/CTO Christopher Klausand X-Force Director Chris Rouland, were featured in more than 20 television appearances, 15 radio interviews, and they were quoted in countless news stories.  The Wall Street Journal alone called on ISS and published its comments five times.
 
The momentum from this initial seven days of media frenzy continued weeks into the aftermath of the DoS attacks.  The media program helped establish ISS and its X-Force as a trusted source for information about online security.  Today, the media continue to turn to ISS as a resource for computer security and virus stories.  Additionally, the DoS-related exposure helped boost ISS’s stock price and financial performance in the network space. Shares off ISS (NASDAQ:ISSX) rose 11 percent the day of the attacks and continued to rise for the rest of the month as ISS remained in the news. They closed at 103 ¼ on February 28 (up from 63 15/16 on the first day of the month).  ISS holds 65% of the market in network vulnerability assessment and 54% in intrusion detection.
 
With Brodeur’s help, ISS captured the media’s attention, but someone else took notice, as well.  Less than a week after the attack, President Clinton invited ISS CEO Tom Noonan to a “cyber security summit” at the White House.