A controller (104) manages operations of a communication network (101). The controller has a communication element (202) for monitoring data traffic in the communication network and for controlling operations of the communication network, a memory (204) for storage, and a processor (206) for controlling operations of the communication element, and the memory. The processor is programmed to monitor (302) the communication network for the effects of malicious software, detect (304) a suspected malicious event, record (306) the suspected malicious event, restrict (308) Internet access to one or more customers suspected of having infected terminal equipment interrupting service of the communication network, and notify (310) said one or more customers of the restricted Internet access.