How WannaCry Changed The Information Security Landscape

Last month one of the biggest information security conferences in the world took place in London. InfoSec attracted 13,500 information security experts for 3 days focused on the latest security issues, but one topic dominated the conference – WannaCry.

The recent WannaCry ransomware attack hit hundreds of thousands of victims in over 150 countries. Users of infected computers found their systems locked and a demand for a ransom payment if the user wants to use their computer again – hence the term ransomware.

WannaCry is possibly the largest simultaneous attack on global computer systems and is a real wake-up call for executives with a focus on information security. Companies are extracting more and more data from their customers defining payments, preferences, and future plans – more detailed information is available for hackers to steal from corporate systems. This month the AA motoring organisation in the UK has been criticised as they accidentally made the personal details of over 100,000 customers visible on their website and when they realised their error they failed to inform customers that their card details may have been made public.

But users of devices in the home are just as vulnerable to ransomware attacks. Homes are now largely wifi-enabled and have many connected devices such as laptops, phones, Kindles, and home control systems like the Amazon Echo or Google Home. Ransom attacks demanding a fee of $1000 to access your home systems again will be paid by many people because losing access to all your personal devices would be even more expensive – not only in replacement value, but because of the data we store on our devices.

The InfoSec conference delegates discussed WannaCry at length and the top tips cited for avoiding these attacks were:

1. Multilayered information security defence; in the office, ensure at least three levels of information security by managing everyday risk, compliance risk, and external risks in a coordinated way, but with different teams able to focus on each area.
2. Stay updated; at home or at work ensure that all software is up to date with automatic patching of updates. Apply a good anti-virus system and ensure it automatically updates itself. Ensure your data is not stored locally or is regularly backed up so you can recover if systems are lost.
3. Staff awareness; train all staff in the risks to the business, not just your IT team. Everyone uses IT in their function today and therefore anyone can be the access point to your business.

Data breaches and ransom attacks are now a serious threat to business and need to be treated as such. Information security no longer means running a virus check once a week, this is a complex environment that can create an existential threat to your business if you become a victim to an attack.