3 ms·
That's most likely what happens after the sysadmins get notified of the issue. Take the NHS incident as an example. Within 1h and 15min the generated emails wer
by eXpl0it3r 9y ago
That's most likely what happens after the sysadmins get notified of the issue. Take the NHS incident as an example. Within 1h and 15min the generated emails were around 500 million. A one hour response time is still relatively quick.
The more important question is, why email systems don't have default rules to prevent such an email storm?
When emails go to tens of thousands of people, a system should probably only allow it with special credentials or at least ensure that it's a read-only mailing list.
Other measurements would be to detect growing email chains and block emails when the chain has reached some threshold.
- DKnoll 9y agoTrue enough, but it is fairly easy to restrict use of distribution groups in Exchange, which I would bet most of these orgs use. I'd argue 1hr response is pretty slow for the NHS, since they require 24/7 support availability of even their vendors. I imagine they responded pretty quickly but nobody had a plan in place for situations like this and a large public sector organisation isn't a place conducive to one person taking charge and fixing the problem immediately.