![](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2016\/04\/ransomware.png?w=738\")
<\/p>\n<\/p>\n
The fallout from the WannaCrypt ransomware attack which\u00a0quickly spread to multiple countries and systems last Friday continues to cause consternation around the world.<\/p>\n
In the UK scores of\u00a0National Health Service Trusts were infected, leading to\u00a0routine appointments being canceled and huge concern over the robustness of critical healthcare\u00a0systems that are still running on a\u00a0fifteen-year-old software platform (Windows XP) which is\u00a0vulnerable to the exploit.<\/p>\n
Critics have suggested\u00a0a lack of government funding has left\u00a0the NHS\u00a0wide open\u00a0to malware attacks that\u00a0exploit outdated software.<\/p>\n
UK Home Secretary, Amber Rudd, sought\u00a0to\u00a0rebut that\u00a0criticism a\u00a0few days ago<\/a>, arguing\u00a0that the success of the WannaCrypt attack\u00a0on NHS\u2019 systems is nothing to do with\u00a0\u201cour preparedness\u201d.<\/p>\n \u201cIf you look at who has been impacted by this virus it is a huge variety across different industries and across different international governments. This is a virus that has attacked window platforms, the fact is that the NHS has fallen victim to this. I don\u2019t believe it is to do with our preparedness. There is always more we can all do to make sure we are secure against viruses but I think there has already been good preparations in place by the NHS to make sure they were ready for this sort of attack,\u201d she said in a statement at the weekend.<\/p>\n Back in 2015<\/a>, the UK government announced a\u00a0five year National Cyber Security Strateg<\/a>y \u2014 when it said it would be putting\u00a0\u00a31.9 billion into\u00a0transformational investment up to 2020, including for defending critical infrastructure and ecommerce activity from hackers.<\/p>\n It\u2019s not clear exactly\u00a0how much of that money has been spent so\u00a0far on upgrading critical systems. But, very evidently, there is still much work to do to get the public sector off of\u00a0legacy platforms such as\u00a0Windows XP.<\/p>\n Indeed, as well as multiple NHS Trusts, TechCrunch understands that some of the UK Home Office\u2019s own systems are still running on the platform. According to a source familiar with the matter,\u00a0the government department\u00a0uses Windows XP for its Poise end-user computing environment that\u2019s used by civil servants and contractors.<\/p>\n When we contacted the Home Office to ask\u00a0which of its systems are running\u00a0on Windows XP it failed to address the question. Instead they responded with\u00a0general comments that Home Office IT systems are under \u201cconstant review\u201d, and\u00a0the department has been following the National Cyber Security Centre\u2019s advice to secure its systems against\u00a0the WannaCrypt virus.<\/p>\n The spokeswoman added that the department\u00a0has put additional security and contingency measures in place \u2014 without specifying what those measures are.<\/p>\n In a statement on its website<\/a>\u00a0the NCSC urges organizations to follow its advice to limit their risk of being infected by WannaCrypt. \u201cWe know already that there have been attempts to attack organisations beyond the National Health Service. It is therefore absolutely imperative that any organisation that believes they may be affected, follows and implements this guidance,\u201d it notes.<\/p>\n The NCSC\u2019s\u00a0advice\u00a0for companies to secure themselves from ransomeware attacks includes:<\/p>\n We put several questions to the NCSC about the UK\u2019s cyber security spending priorities \u2014\u00a0at\u00a0the time of writing it\u00a0had not responded but we\u2019ll update this post if they do.<\/p>\n Our source pointed out\u00a0that many\u00a0organizations do not upgrade from an older OS because they fall behind a number of upgrades and it becomes increasingly difficult and expensive to make an OS\u00a0upgrade\u00a0the further back you are\u00a0on platform versions. Which underlines how important\u00a0funding is to this security story \u2014 whatever Rudd claims about the UK having no problems with \u201cpreparedness\u201d.<\/p>\n Questions about the\u00a0ongoing reliance in\u00a0the UK public sector on vulnerable\u00a0legacy systems need to\u00a0be asked \u2014 not least given a sequence of failed centralized government IT projects, including for health and border control.<\/p>\n Given its public\u00a0prioritizing of cyber security \u2014 including a boost in funding specifically for bolstering critical systems \u2014 the optics certainly don\u2019t look good.<\/p>\n In the Home Office\u2019s case it\u2019s not clear what kind of practical impact there might\u00a0be should\u00a0some of its internal\u00a0systems become\u00a0infected with WannaCrypt. Disruption to asylum applications, for example, would not have the same visibility\u00a0as disruption to healthcare. But the department also oversees policing and programs related to critical comms infrastructure, such as for emergency services, so there\u2019s potentially public safety concerns here too.<\/p>\n The Home Secretary herself has acknowledged there are \u201clessons to learn\u201d from the WannaCrypt attack. And it seems very likely the department will be having\u00a0expedited conversations about upgrading\u00a0off of Windows XP stat, although it\u2019s declining to talk publicly about anything it\u2019s doing on that front.<\/p>\n Another question mark in this story is the role of domestic intelligence agencies \u2014 given that the exploit WannaCrypt is utilizing was apparently stolen from\u00a0the NSA. And the NSA has a long history of working closely with the UK\u2019s own domestic intelligence agency, GCHQ. Which at least makes it\u00a0a\u00a0possibility the UK\u2019s own spy agency might have had some knowledge of or role in maintaining\u00a0the underlying flaw that\u2019s caused so much disruption here. And even if GCHQ is quietly helping defend the Home Office\u2019s internal systems from this specific flaw, it\u2019s evidently failed to provide such a\u00a0service to the NHS.<\/p>\n Microsoft has rightly\u00a0taken flak for not continuing to provide security patches for its older platforms. But the company also put out a strongly worded statement\u00a0yesterday<\/a>, laying the blame for WannaCrypt\u2019s\u00a0spread at the feet of\u00a0government agencies that have\u00a0made a practice of stockpiling and even creating security exploits \u2014 likening it to if the military allowed stockpiles of conventional weapons to be stolen.<\/p>\n \u201cThis attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem,\u201d said\u00a0company\u00a0president and chief legal officer Brad Smith yesterday. \u201cRepeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage.\u201d<\/p>\n \u201cThe governments of the world should treat this attack as a wake-up call,\u201d he added. \u201cThey need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world. We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.\u201d<\/p>\n Microsoft is advocating for a\u00a0\u201cDigital Geneva Convention<\/a>\u201d to govern these issues, including a new requirement for governments to report vulnerabilities to vendors, rather than stockpile, sell, or exploit them.<\/p>\n Where we stand here and now, with intelligence agencies actively and secretly exploiting weaknesses in security systems, we are very far away from any such accord that security must\u00a0be a priority for everyone \u2014 including\u00a0every part of government.<\/p>\n But perhaps we\u2019re a little\u00a0closer to understanding the scale of the risks involved.<\/p>\n Featured Image: Bryce Durbin<\/small><\/p>\n","protected":false},"excerpt":{"rendered":"\n
![\"\"](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2016\/04\/ransomware.png?w=680\")
The fallout from the WannaCrypt ransomware attack which quickly spread to multiple countries and systems last Friday continues to cause consternation around the world. And raises questions over government cyber security priorities. Read More<\/a><\/p>\n\n<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>\n<\/div>\n
<\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-341107","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/341107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=341107"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/341107\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=341107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=341107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=341107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}