Des Ward, information governance director at Innopsis, reflects on the real story behind the WannaCry cyber-attack.
Just over a month ago, the headlines were screaming about a cyber-attack against the NHS, the nightmare scenario of Denial of (public) Service was upon us. WannaCry ransomware was tearing through the world, encrypting everything in its wake and wreaking havoc.
It was a great case study in the way that cyber security confuses everyone. Very little of what was reported at the time was accurate.
RELATED CONTENT
- Public safety ‘imperilled’ by lack of interoperable police ICT network
- BT bags £100m contract with Met Police
- Police forces not keeping pace with technology, says constabulary inspectorate
Was the attack really aimed at Windows XP?
The issue was initially reported as a weakness that affected all systems from Windows XP to Windows 10 – using malware created by the NSA that was stolen and released by hackers onto the dark web.
As this weakness affected Windows XP, then the issue had to be the use of Windows XP didn’t it?
The reality however is very different – hacking tools used were unreliable on Windows XP and Windows 10 – but were effective on Windows 7 and Server 2008. It now looks increasingly likely that:
- The ransomware entered companies because a port only used for file sharing (SMBv1) was available on the internet
- The first hacking tool exploited the weakness on the system accessible from the internet
- This ransomware spread as the second hacking tool took control of the computer and continued scanning inside the network
Was the attack really aimed at the NHS?
The NHS was the name most commonly cited in early reporting of the issue, leading to many commentators describing it as an “attack on the NHS”. In reality, the NHS wasn’t a particular target. As of 20th May, there were an estimated 300,000 affected computers in more than 74 countries.
The spread of WannaCry had the attributes of an infectious disease, not a targeted attack. It propagated into any system where there were vulnerable points of entry. There were reports of infections in Spain, the UK, Portugal, Germany, China, Russia and others.
Organisations confirming they were targets included FedEx, Nissan, Deutsche Bahn Railway, Hitachi, the Russian Central Bank, Telefonica and the NHS. Car manufacturers Nissan and Renault confirmed that they halted car manufacturing to contain the attack.
The business impact of WannaCry was primarily the result of the control measures that organisations implemented to stop it from spreading, not of the ransomware itself. In many cases, email systems were suspended to prevent it from moving from one system to the other, and remote access services were also halted. It was this preventive action that caused the majority of the business impact, not the ransomware itself.
Was this a new type of threat?
WannaCry may appear like a new and dangerous type of threat, but it’s not. This type of attack was used against Sony in 2014 and 14 years ago in Blaster. It has been prevalent for over a decade and can be protected against by firewalls and regular patching. In fact, a patch against this specific vulnerability was made available almost two months prior to the attack (well within the timescales required by both Cyber Essentials and PCI DSS). The publication of the NSA tools made the tabloid press, the weakness was easy to exploit and the fact that the patch was available for over a month should prompt us to question why this happened on such a scale?
So, it wasn’t new, it wasn’t that clever and it was straightforward to prevent; so how did WannaCry manage to cause such extensive disruption, and what can the public sector do protect against future attacks?
Technical and systems controls don’t cover it
Most cyber security controls and standards are based on a technical or systems-based view of the work. They assume that if you define the scope of a system, application or network, then you can control and manage the security risks that are associated.
However, modern organisations are too complex and change too much for these approaches to work. The breadth of each security policy can be set to make devices and entire networks out of scope. For example, Cyber Essentials doesn’t include applications or connected cloud services in the assessment – how many organisations are there today that don’t use applications or have any connected cloud services?
The challenge has always been that scoping compliance programmes is preferable for businesses, as it reduces the perceived burden on the organisation’s ability to operate. However, the following examples show why this is approach is no longer tenable:
Acquisitions and corporate changes mean the technical environment is constantly changing. Looking at TalkTalk in 2015, the reason why the attack was possible was a web server lay untouched since Tiscali was taken into the company in 2009. That cost TalkTalk over £400,000 in fines and far more in costs of providing credit checks for their customers.
The impact from poor information governance is rarely assessed as part of cyber security standards. Looking at Dr Deer vs Oxford University, the costs of not being able to respond to a Subject Access Request under the Data Protection Act 1998 rose to £116,000 from having to search electronic storage. This was not a fine, but would’ve made the top ten easily for personal data.
Protecting against an attack can also cause disruption. Look at WannaCry, the likely reason for outage of NHS services was switching computers off – a case of simply not knowing what was happening and taking steps to protect data. They created an effective Denial of Service condition that has not been tallied in terms of costs yet.
We have reached a tipping point with regards to how far scoped compliance for cyber initiatives can take us on their own. We need to ensure that the organisation knows how, where and why to use the plethora of security tools, devices and advice.
The need for governance
The need for information governance to augment cyber initiatives is very real. Within the UK, a basic public sector organisation has over 40 separate laws to comply with for managing information (private sector organisations rise to over 50), which amount to the following activities for assessment:
- the location of the data (how do you know where it is being stored, or if it has been deleted?)
- the format of the information (what is the asset?)
- the usage requirements (what purpose is the information acquired for?)
- the disclosure requirements (can you share it, and what are the requirements?)
- the retrieval requirements (the retention period and whether you can you access the information throughout that period?)
- the handling requirements (does it need encryption, where can it be accessed from, what right of audit is there?)
My view of the current cyber approaches concludes that the lack of a standardised approach and concentration on information is hampering evolution. This is supported by Rob Wainwright, director of Europol, who believes that the recent failings in cyber defences were more to do with lack of leadership in large organisations than lack of IT investment.
The issue, therefore, is not addressed merely by buying more technology, but looking at how, why and where the technology is used.
Lessons to be learned
We need to learn from WannaCry in the following ways:
- Work out how, why and where you are undertaking cyber activities – revisit those applications/systems you thought you didn’t need to patch or update because they weren’t in a compliance scope – hacking tools don’t respect scopes
- Review your firewalls to ensure that they are only allowing the access to the applications, networks and/or systems you intend
- Look at your information and understand how well you could answer the activities identified above – they will be crucial for the General Data Protection Regulation (GDPR), in force from last year, but not law until 2018
- Use this understanding of information to review all your applications/systems again
The clock is ticking for action and the next wave of attacks is quite possibly on the way – using seven NSA tools this time and far more subtle.
The fix, however, remains the same – ensure that you manage information and related applications/systems within your entire estate.
Thanks for your helpful post. In recent times, I have been able to understand that the particular symptoms of mesothelioma cancer are caused by a build up connected fluid between your lining of your lung and the torso cavity. The infection may start in the chest vicinity and propagate to other parts of the body. Other symptoms of pleural mesothelioma include fat reduction, severe breathing in trouble, a fever, difficulty eating, and swelling of the face and neck areas. It must be noted that some people existing with the disease usually do not experience almost any serious indications at all.
Hi there! I know this is kind of off topic but I was wondering which blog platform are you using for this site? I’m getting fed up of WordPress because I’ve had problems with hackers and I’m looking at options for another platform. I would be awesome if you could point me in the direction of a good platform.
Wow that was odd. I just wrote an really long comment but after I clicked submit my comment didn’t appear. Grrrr… well I’m not writing all that over again. Anyways, just wanted to say wonderful blog!
You should participate in a contest for among the finest blogs on the web. I’ll advocate this site!
I have mastered some new things from your internet site about pcs. Another thing I’ve always thought is that computer systems have become an item that each home must have for a lot of reasons. They offer convenient ways in which to organize homes, pay bills, go shopping, study, pay attention to music and perhaps watch television shows. An innovative strategy to complete these tasks is a notebook computer. These computers are mobile, small, powerful and easily transportable.
Fantastic blog post.Really thank you! Really Cool.
Mexican Easy Pharm: Mexican Easy Pharm – Mexican Easy Pharm
mexican rx online https://mexicaneasypharm.com/# mexico drug stores pharmacies
buying prescription drugs in mexico online
п»їbest mexican online pharmacies https://mexicaneasypharm.shop/# Mexican Easy Pharm
mexican border pharmacies shipping to usa
http://semapharm24.com/# semaglutide tablets
5mg prednisone
http://predpharm.com/# prednisone 2.5 mg daily
prednisone online pharmacy
http://kamapharm.com/# cheap kamagra
10 mg prednisone
https://predpharm.com/# Pred Pharm
prednisone 10mg cost
https://dappharm.com/# buy dapoxetine online
prednisone canada prescription
https://predpharm.com/# can i buy prednisone online without prescription
prescription prednisone cost
http://predpharm.com/# Pred Pharm
prednisone acetate
https://cytpharm.com/# Cyt Pharm
prednisone for sale in canada
https://cytpharm.shop/# CytPharm
online prednisone 5mg
http://predpharm.com/# PredPharm
prednisone 30
http://dappharm.com/# priligy
buy prednisone no prescription
https://kamapharm.shop/# buy kamagra online usa
where to buy prednisone in canada
http://kamapharm.com/# Kama Pharm
where to buy prednisone 20mg no prescription
https://farmatadalitaly.com/# farmacie online sicure
Farmacia online piГ№ conveniente
http://farmasilditaly.com/# esiste il viagra generico in farmacia
Farmacia online miglior prezzo
https://farmabrufen.com/# Farma Brufen
farmacia online piГ№ conveniente
Casino visits are a popular tourist attraction. https://phmacao.life/# Live dealer games enhance the casino experience.
Manila is home to many large casinos.: taya365 login – taya365 login
phtaya casino phtaya casino Slot tournaments create friendly competitions among players.
Loyalty programs reward regular customers generously.: taya365 login – taya365.art
High rollers receive exclusive treatment and bonuses. http://taya777.icu/# Slot machines attract players with big jackpots.
Players can enjoy high-stakes betting options.: taya365.art – taya365
taya777 taya777 Manila is home to many large casinos.
Slot machines attract players with big jackpots. https://jugabet.xyz/# La mГєsica acompaГ±a la experiencia de juego.
Some casinos have luxurious spa facilities.: phmacao.life – phmacao casino
Loyalty programs reward regular customers generously.: taya365.art – taya365.art
Players enjoy both fun and excitement in casinos. http://phtaya.tech/# Players must be at least 21 years old.
La mГєsica acompaГ±a la experiencia de juego.: jugabet casino – jugabet
https://taya777.icu/# The casino industry supports local economies significantly.
Slot machines feature various exciting themes.
phtaya phtaya login The Philippines has several world-class integrated resorts.
Manila is home to many large casinos. http://phtaya.tech/# Slot machines feature various exciting themes.
Los torneos de poker generan gran interГ©s.: jugabet chile – jugabet
The gaming floors are always bustling with excitement. http://jugabet.xyz/# Los juegos de mesa son clГЎsicos eternos.
phmacao com login phmacao com login Players often share tips and strategies.
Algunos casinos tienen programas de recompensas.: jugabet chile – jugabet casino
Visitors come from around the world to play. https://winchile.pro/# Las apuestas deportivas tambiГ©n son populares.
Muchos casinos ofrecen restaurantes y bares.: jugabet.xyz – jugabet.xyz
Many casinos provide shuttle services for guests. https://jugabet.xyz/# Los torneos de poker generan gran interГ©s.
taya777 register login taya777 Players must be at least 21 years old.
Las tragamonedas ofrecen grandes premios.: win chile – winchile.pro
The Philippines offers a rich gaming culture. https://taya777.icu/# Resorts provide both gaming and relaxation options.
The Philippines has several world-class integrated resorts.: taya365.art – taya365 com login
taya777 register login taya777 register login Cashless gaming options are becoming popular.
Many casinos offer luxurious amenities and services. https://phtaya.tech/# The Philippines has a vibrant nightlife scene.
Los casinos organizan eventos especiales regularmente.: winchile – winchile.pro
Slot machines feature various exciting themes.: taya365.art – taya365.art
taya777 register login taya777 Players can enjoy high-stakes betting options.
The casino experience is memorable and unique.: phtaya.tech – phtaya casino
win chile win chile La mГєsica acompaГ±a la experiencia de juego.
The casino experience is memorable and unique.: phmacao com – phmacao.life
Manila is home to many large casinos. https://taya777.icu/# Responsible gaming initiatives are promoted actively.
The casino experience is memorable and unique.: phmacao.life – phmacao.life
Resorts provide both gaming and relaxation options.: phmacao.life – phmacao com
http://taya777.icu/# Gaming regulations are overseen by PAGCOR.
Players enjoy a variety of table games.
Many casinos offer luxurious amenities and services.: phmacao club – phmacao com
winchile winchile Las ganancias son una gran motivaciГіn.
The Philippines has several world-class integrated resorts. http://winchile.pro/# Los casinos organizan eventos especiales regularmente.
Los juegos en vivo ofrecen emociГіn adicional.: winchile – win chile
https://jugabet.xyz/# Los casinos son lugares de reuniГіn social.
Promotions are advertised through social media channels.
La seguridad es prioridad en los casinos.: winchile casino – winchile casino
winchile casino winchile.pro Los juegos de mesa son clГЎsicos eternos.