Cyber Attacks – What Lessons Must Be Learned?

Back in May 2017 a cyber attack that came to be dubbed WannaCry hit computer systems worldwide and caused panic among a huge number of organisations across the globe.

One of the highest profile victims of these attacks was the NHS in the UK but there were estimated to be as many 200,000 computers affected in well over 100 countries.

The attack woke millions of people up to the potential vulnerabilities that computer systems and, by extension, businesses and all other organisations, have to the threats posed by cyber criminals.

From our perspective as IT experts at TTG, what’s interesting to ask is whether or not the situation that emerged around WannaCry can be reliably protected against by our clients. And, if so, then how would that happen?

I’m pleased to say that these attacks can indeed be guarded against – but only if the right steps are taken by businesses willing to take pre-emptive action to protect their IT systems and their overall operations.

Patching things up

The WannaCry attacks were targeted at one of the most commonly used operating systems in the world in Microsoft Windows. They exploited a vulnerability that was detected in the platform as long ago as March 2017. So why was it still able have such a massive impact in May 2017?

The answer to that question is primarily that not enough people or organisations updated and patched their Microsoft Windows operating systems between March and May of this year.

For the most part, computers operating with Windows 10 as their primary platform were protected against the WannaCry attacks because those systems automatically updated. But where those updates and their patches had to be updated manually, that simply did not happen in a huge number of cases, with the result being that many thousands of computers were essentially wide open to attack.

Updates can be a source of frustration for computer users in a hurry but those updates are always issued for a reason and very often that reason is to patch up a platform or a type of software once a potential vulnerability has been spotted.

Perhaps more often than not it will not matter whether your PC’s operating system is fully updated and as patched up as possible but sometimes it really does matter, as so many people found out recently thanks to WannaCry to their cost and consternation.

The problem of timeframes and procrastination

A potential problem for a lot of businesses and particularly for large organisations is that their computer systems don’t get updated as quickly as would be most effective. Sometimes it takes several months for a centralised updating process to be carried out by an overworked IT department on an organisation-wide basis.

Ideally, these updating initiatives would be carried out much more quickly and even instantaneously but that isn’t currently the way it works at large organisations such as the NHS. All of which effectively opens up a window of opportunity for hackers and for ransomware attackers who make it their business to identify software vulnerabilities and figure out ways to exploit them.

Protecting your systems properly

Identifying problems after they have been exploited is clearly not an ideal position to be in from an IT security perspective. To avoid such a scenario it’s necessary for companies to have plans and protocols in place that mean their systems are always well protected.

Bosses can help ensure that this happens by instructing their IT experts, whether they’re in house or external, to update all computers, software and other relevant systems with patches as soon as the relevant updates become available.

It can also be very helpful to essentially conduct audits of precisely what computers, software and systems are being used across an organisation at a given point in time. From there it helps to group the hardware that’s in use by age so that they can be replaced as necessary and issued with whatever patches or protections are required. This is particularly important because older machines often aren’t updated automatically in the way that newer equivalents would be.

Any business should certainly aim to keep a close eye on any computers which are still in use despite being more than five years old. In some ways these old PCs are like ticking time bombs just waiting to cause problems and open up access to your network because they are much more likely to be vulnerable to cyber attacks.

Time and money well spent

For big organisations or for SMEs, it can seem like a major undertaking to carry out all necessary updating and safeguarding of an entire suite of PCs but in practice it doesn’t need to be hugely expensive or time consuming. This is particularly the case if you work with experts like TTG in carrying out these kinds of endeavours.

But whether you tackle the process alone or bring in experts for assistance, what’s crucial to be aware of is the impact that not being properly protected against cyber attacks and ransomware attacks like WannaCry can have. As it stands, businesses today can all-too easily find themselves with little or no choice but to pay the ransom demands of cyber criminals who have successfully infiltrated their IT systems but with the right approach and investment that situation can be routinely avoided.

For businesses it’s all about balancing the risks of attach against the potential investments of time and money that are necessary to offset them. From our point of view at TTG, there is absolutely no question that all businesses should be taking IT security seriously at all times and doing whatever it takes to protect their software and their systems from the threats that we know are out there.