This past Friday, May 12, a ransomware attack hit more than 200,000 computers across 150 countries, locking people and businesses out of their own computers. As a result, blame is starting to be thrown around, with the two most prominent names being the NSA and Microsoft.
However, new data may force some of the victims to point their fingers at themselves.
The Blame Game
As mentioned, blame is starting to be levied against Microsoft for not patching older versions of Windows with new firewalls or the NSA for letting these exploits sit. However, data released from Spiceworks revealed that many of the businesses that fell victim to the attack had at least one computer using Windows XP.
Microsoft pulled security support for the operating system back in 2014, meaning that users were missing almost three years of security updates. These updates included the March fix that prevented more computers from being hit.
Victims Of Limits
The data Spiceworks released also revealed that just over 80 percent of all business had the necessary patch released in March, available on Windows 7 and 10. It means nearly 20 percent were using computers running XP and Vista, which had its support pulled last year, leaving it open to Friday's attack. In many cases, the computers running these older operating systems are part of a collection of computers the victim businesses were using.
"Many companies subscribe to the theory that if it's 'not broke, don't fix it,' especially those that aren't prioritizing IT," Spiceworks senior technology analyst Peter Tsai told told ZDNet. "As a result, many IT departments lack the resources and budget needed to upgrade to newer operating systems like Windows 10. It takes time to upgrade all systems in an organization and train end users on the new features and functionality."
A good example of what Tsai is talking about are the hospitals in the UK that were forced to turn people away. The hack took down the systems, keeping patients from being put into the system. On the other hand, NHS Wales had updated its system, allowing it to continue taking patients, unlike the other hospitals.
Futureproofing
The comments and data show that, in many cases, these attacks could have been prevented. Security is one of the key pieces of infrastructure that needs a near constant eye, but doesn't always get the attention it deserves. This is what opens the door to these kind of attacks. A lax approach can have far-reaching consequences, as the hack proved, but hopefully it will force many of the victims to step up and fix what needed fixing even before the attack.
