How did Slammer manage to worm its way through so many of the world's networks in a span of less than 48 hours, even though Microsoft issued a patch for the vulnerability six months ago? Because hundreds of network administrators never took the simple, routine step of installing the patch.

The attack began in the wee hours of Saturday morning, Eastern U.S. time. By Saturday evening, hundreds of thousands of servers across the United States, Europe and Asia had the worm because they had never been patched.

The worm scans the Internet for vulnerable servers, stores itself in the memory, and then searches for more vulnerable servers. It interferes with legitimate traffic by continually transmitting an endless loop of junk code, slowing or stopping service. Although a simple reboot will remove the worm, the server remains vulnerable to reinfection if it remains unpatched when re-connected to the Internet.

Tom Ohlsson, Marketing Vice President at Internet traffic monitoring firm Matrix NetSystems, told Newsfactor Network that at the peak of the attacks, "the Internet was seriously hampered with a very, very high packet loss." Internet traffic slowed to a crawl, and thousands of ATM banking machines across the United States were unable to dispense cash.

The saving grace, Ohlsson said, was that the attack peaked when Internet traffic was low, allowing the network to recover quickly. If it had occurred when Internet traffic was high, he told the news service, the results would have been "catastrophic."

It's frightening to think the Internet could have been devasted by a known worm - with a known and readily available patch - six months after the patch was issued simply because thousands of network administrators around the world are too lazy, too disorganized, too understaffed or too uncaring to install it. Their irresponsibility puts every company that relies on this vital business tool at unacceptable risk. Job Number One in every IT department should be staying current on installing security patches. If that isn't the case at your company, it's time to get serious and make it so.

CIOs and network administrators don't deserve all of the blame, of course. Corporate boards must also shoulder their share of the responsibility. Industry experts say boards, which don't really understand cyber-security issues and are reluctant to fund what they don't understand, have kept IT security budgets well below what they should be at many companies. While they take the threat to their physical assets seriously in the wake of September 11, investing in their business continuity and disaster recovery capabilities, they continue to underestimate the damage that could occur from a cyber-security breach.

Once again, however, it is the job of the CIO to educate them. Paint vivid scenarios your board can understand of exactly what would happen if the corporate network went down for an extended period. Outline the work that couldn't get done, the customer inquiries that couldn't be answered, the shipments that couldn't be tracked, the invoices that couldn't be issued, and exactly what that will mean to the bottom line.

Better yet, tell them how stockholders are likely to react if word gets out (team up with the CFO and estimate the damage to the company stock price in the wake of such news, and you'll be sure to hold their attention). Then give them your best estimate of what it will take to prevent such an occurrence - or to quickly recover from one if it does occur, reducing the risk the news will leak. Chances are the money will be forthcoming. At the very least, you'll get enough manpower to ensure your security patches get loaded expeditiously.