Sadly, the WannaCry Ransomware Disaster Could Have Been Easily Prevented

On May 11, 2017, the WannaCry ransomware spread around the globe like wildfire and disabled computing infrastructures belonging to organizations of all shapes and sizes. As the world watched the news unfold, it seemed as if practically no business was immune to this ultra-powerful ransomware. Yet, many quick-thinking organizations were. All because they had the foresight to follow IT best practices.

What made the WannaCry ransomware particularly potent was the fact that its delivery method borrowed from recently stolen cyberspying tools developed by the NSA. Such a high-level attack caught many organizations off guard--except for the ones that applied a security patch issued by Microsoft in March, almost two months prior. These security patches were designed specifically to address the vulnerability exploited by the ransomware hackers. Basically, hackers were counting on organizations being slow to apply the security patches. Obviously, these hackers have enough knowledge about how businesses conduct their IT operations to know that such a gamble would pay off, handsomely.

The average PC user may not be aware of how a large business, especially one entrusted with sensitive data, could fail to apply important security patches in a timely manner. After all, many users simply have their PC set to automatically update. For these PC users, the patches from Microsoft are downloaded and applied quickly and painlessly. However, what the world needs to be aware of is something that hackers understand all too well is that many businesses and organizations do not immediately apply patches when they're published. Instead, organizations prefer to have their IT teams test the patches before applying them to the company network to ensure the patch does not impact operations.

For a business that relies on software to keep operations moving forward, making a change or even a slight adjustment to a system that’s working can be a big risk. What if upgrading to a new version of software means that new features aren’t compatible with established processes? What if a new security patch changes an OS in such a way as to disrupt day-to-day operations? This is why businesses make the choice to test all new software, upgrades, updates, and patches - even the major, security ones from Microsoft - before applying it to the network. The larger and more complex the company and its network, the more time and resources it will take to perform such a test. This is why the WannaCry ransomware was so much more effective against larger organizations than smaller businesses or PC users which had the ability to apply the patches in a more timely manner.

The companies that fell victim to the recent round of ransomware attacks aren’t completely off the hook. Between the time Microsoft issued its patches (March) to the time WannaCry hit (May), IT teams had ample time to test and apply the provided patches, which would have saved them a world of hurt. Therefore, for companies wanting to safeguard themselves from another worldwide ransomware attack (or even lesser attacks), it's vital to prioritize in following best practices like applying patches.

If you or your IT team has so much going on that it’s difficult to handle IT maintenance responsibilities like applying patches, then you can call on Directive for assistance. Routine tasks like applying security patches can be outsourced to professionals, and for many IT tasks, they can be accomplished remotely. By outsourcing your IT to Directive, you can rest assured that your systems are up-to-date and safeguarded from the latest threats, which means you won’t “wanna cry” should another round of ransomware ravish the world.

Call us today at 607.433.2200 to learn more.