For anyone inside the IT support and infosec bubble, the Wanna Decryptor ransomware worm that infected at least 200,000 computers in 150 countries was inevitable. That it came in the run-up to a general election in which the Conservative Party's presidential-style campaign calls for a "strong and stable" government to lead the UK under Theresa May—whose administration, just months earlier, released a series of tech-related policy papers that made scant mention of information security—is bad timing for the PM.
It could have been far worse for the Tories: had WCry hit many more hospitals than the 48 NHS trusts said to have been affected by the outbreak, and if news broke about the ransomware attack, not late on Friday afternoon, but on Tuesday morning at the expected launch of the Conservatives' manifesto, then the fallout would have been much more damaging politically.
We know that, before the events of late last week, Microsoft had pushed out a Windows security update in March to protect against the NSA-derived WannaCrypt vulnerability. But any organisation or business still running unsupported Windows operating systems—16-year-old XP, five-year-old Windows 8, and Windows Server 2003—didn't get the update. Microsoft, which isn't holding punches against those outfits around the world that have failed to upgrade their operating systems, took what it said was an "unusual step" of releasing a patch for the OSes that the software giant had abandoned more than three years ago.
But as the postmortem into what went wrong begins and uneasiness about the possibility of further outbreaks continues, how much can a lack of government investment in Britain's creaking IT systems within the NHS be blamed for critical public service systems being exposed in this way?
NHS Digital claimed over the weekend that, despite the "widespread speculation about the use of Microsoft Windows XP by NHS organisations" being largely blamed for the supposed scale of the ransomware attack on hospitals in England and Scotland, "the vast majority are running contemporary systems."
It added: "we can confirm that the number of devices within the NHS that reportedly use XP has fallen to 4.7 percent, with this figure continuing to decrease. This may be because some expensive hardware (such as MRI scanners) cannot be updated immediately, and in such instances organisations will take steps to mitigate any risk, such as by isolating the device from the main network."
Intriguingly, NHS Digital hasn't offered up the number of devices that are still running Windows Server 2003 and Windows 8. While XP was—for so long—the workhorse-like operating system that refused to die, it's clearly not the only reason why so many organisations and businesses across the world were caught out by WCry.
Big orgs typically move slowly when it comes to migrating over from aged operating systems to newer versions, be this due to a lack of support for legacy but crucial software or a conservative, wait-and-see approach to how well an OS performs once it is released in the wild.
For the NHS, migration strategies under current government policy are patchwork—meaning that individual trusts manage their own IT strategy and the results, unsurprisingly, are mixed. Upgrading a big organisation's operating system doesn't come cheap, either. So for some, it's been easier to stand still. Every week, headlines routinely flag up another NHS funding crisis. It's arguably little wonder, then, that staff at these organisations fret about upgrade costs.
Sick note
Six years ago, the Tory-led coalition dismantled Labour's NHS National Programme for IT, which was described by the Public Accounts Committee as "one of the worst and most expensive contracting fiascos in the history of the public sector." However, the failing project wasn't altogether abandoned by then prime minister David Cameron's government. Separate management and accountability structures were brought in with components of the programme remaining in place.
"We need to move on from a top down approach and instead provide information systems driven by local decision-making. This is the only way to make sure we get value for money and that the modern NHS meets the needs of patients," the Department of Health said in 2011.
Value for money and modernisation via the now dropped "digital-by-default" mantra were—alongside transparency—key buzzwords for the Tories under Cameron. We're still waiting to see how much this culture has changed under May. But there is one thing that links the two very different styles of Conservative government: the decision to keep on Jeremy Hunt as health secretary.
Over the weekend, the government sought safety in numbers by pointing out that the Wanna Decryptor saga affected countries across the world. But it was home secretary Amber Rudd, and not Hunt, who was wheeled out to defend Whitehall's actions as newspapers and politicians demanded answers.
"If you look at who's been impacted by this virus, it's a huge variety across different industries and across international governments," gaffe-prone Rudd told Sky News. "This is a virus that attacked Windows platforms," she added. "I don't think it's to do with that preparedness." And she claimed that the NHS already had "good preparations in place" to deal with such attacks. But it's clear that the government ignored numerous warnings about the use of outdated systems by some health services in England and Scotland.
Hunt, meanwhile, has remained tight-lipped. In the past, he has trumpeted plans to make the NHS paperless by 2018 and said that the UK's health service "cannot be the last man standing as the rest of the economy embraces the technology revolution." But he has since reneged on those promises and admitted to a House of Lords Select Committee on the long-term sustainability of the NHS that "we have a long way to go when it comes to hospital IT systems."
Which brings us back to WCry. The government has been at pains to remind everyone that it is now taking cyber attacks seriously, and it's pumping £1.9 billion into various initiatives to try to keep the UK safe from evil malefactors who want to do us harm. But as anyone in information security will tell you, you're only as strong as your weakest point.
Listing image by Christian Marquardt/Getty Images
reader comments
33