Effects from WannaCry Attack May Have Been Lessened With Training

The massive WannaCry ransomware attack that made its way around the world recently is a great lesson to companies everywhere. While the attack itself was not particularly sophisticated, the fact that one single person’s mistake could lead to the malware spreading throughout an organization and then around the world demonstrates that having perimeter security measures in place no longer will suffice. It’s training and education that may have ultimately prevented it from going beyond the first organization.

Most stories report all the news of this malware being spread via an unpatched vulnerability in Microsoft Windows. Indeed, that is true and how it works its way around. However, the initial reason it was set loose is because of phishing. A Dropbox link was embedded in email messages that were clicked by unsuspecting users. Then a worm was released that made its way around the globe checking for ways to exploit the vulnerability.

This is where the training and education comes in. Presenting cybersecurity training once per year is no longer good enough. Events like these happen all the time and like this one, the details, subjects, modus operandi, etc. constantly change and variants continue, even if the initial one is stopped. A continual training program that keeps employees and third parties up to date on the latest threats also serves as a constant reminder of what phishing is and can do.

Various media outlets have reported that the WannaCry or WCry ransomware has affected between 100,000 to 300,000 companies worldwide. However, with the requested ransom of approximately US $300, the total that the attacker(s) have netted, as far as anyone has been able to determine is about US $50,000. While not too shabby for a day’s work, considering how many have been affected one might expect a much larger figure. And indeed, the damage done to your organization with respect to time spent dealing with a ransomware attack, loss of IP, destruction of customer or client data far exceeds the cost to put an education and awareness training program in place.

No doubt that ensuring all systems are kept up to date, the latest patches applied, and perimeter security tools are in place are all necessary tasks. This is so serious that Microsoft even issued patches for this vulnerability for versions of its products that it stopped supporting years ago, such as Windows XP. If you haven’t applied these for MS17-010, do it right now. Don’t delay any longer.

Many companies were not affected so negatively because they were able to restore systems from backups. This is another wise habit to adopt. Rather than pay the hackers, as the FBI is continually reminding people to avoid, make the effort to keep recent backups of critical systems.

For detailed descriptions of what it is and how WannaCry (and the other variations) spread, check out a blog from Trend Micro or a story from Bleeping Computer. Both described how it took advantage of the alleged NSA exploit that was exposed by the hacking group Shadow Brokers. Once the executable is released, it “spreads through a Worm executable that scans the Internet for Windows servers that have the Samba TCP port 445 accessible.” This is how one single person who mistakenly clicks an infected link or document can wreak havoc throughout your network and even around the globe. With the Internet, we are all connected.