Last May's Wannacry attack which crippled the UK's National Health Service was a relatively simple attack and could have been prevented by the service following basic IT security best practice. Figures released by the National Audit Office reveal that the ransomware attack affected 45 NHS organisations including 37 trusts on the first day and at least 81 out of 236 trusts across England, 595 GP practices, and 603 primary care and other NHS organisations were impacted during the course of the campaign.
Even after being alerted by the Department and Cabinet Office in 2014, who warned about the dangers of using outdated software, NHS trusts did little to update or replace software used at clinics and hospitals. The problem was compounded by the fact that, the Department of Health had no procedures to assess if NHS trusts and hospitals were complying with best practice guidelines to prevent cyber-attacks.
The report continues: The lack of visibility was such that even now, neither the Department nor NHS England knows how many GP appointments were cancelled, how many patients were diverted, or how much the disruption to services cost the NHS. According to NAO, the disruption could have been much worse if the ransomware had not been stopped by a cyber-researcher activating a ‘kill switch'.
The Audit Office also observed that the NHS had not rehearsed for a national cyber-attack, it was not immediately clear who should lead the response as there were problems with communications, that locally NHS staff shared information through personal mobile devices, including using the encrypted WhatsApp application, that infected organisations had unpatched, or unsupported Windows operating systems so were susceptible to the ransomware, and that the NHS has accepted that there are lessons to learn from WannaCry and is taking action.
Cyberattacks: Preparing For The Inevitable
It is generally accepted that it is when, not if, large organisations will be the target of malicious cyberattacks. The importance of being prepared has been laid out in a blog post Sweat In Peace, Don't Bleed In War, written by Meredydd Hughes, a former UK chief constable with substantial crisis management experience.read more
Varonis Blog Highlights 110 Cybersecurity Statistics
Cybersecurity company Varonis has issued its predictions for the forthcoming year with a blog post entitled 110 Cybersecurity Statics For 2020. The blog states that cybersecurity issues are becoming a day-to-day struggle for businesses. Recent trends and cybersecurity statistics reveal a huge increase in hacked and breached data from sources that are increasingly common in the workplace, like mobile and IoT devices.read more
UK To Go On The Cyber Offensive
The UK Government is about to launch a new proactive and offensive cybersecurity team that will wage cyberwarfare against hostile nation-states and online crime organisations. It would be naive to believe that the UK has not launched cyberattacks against third parties, but the killing of Qassem Soleimani has brought this out into the open.read more
Are You Ready For Iranian Revenge Cyberattacks?
Following the killing of Qassem Suleimani no-one can be sure of what military action Iran will take, but experts agree that its cyberattacks will increase against countries and governments it sees as hostile.read more