Arraya Protects Managed Services Customers from WannaCry

A fair amount of digital ink has been spent recounting the ransomware attack known as WannaCry and its effects on the global market.  Ransomware attacks are nothing new; revenues obtained from these attacks exceed 1 billion annually, with previous examples such as 2015’s CryptoWall earning $325 million alone.  What is new is IT’s acknowledgement of ransomware as a legitimate threat.  WannaCry was successful in large part due to the high volume of systems running unpatched versions of Microsoft Windows.  Organizations are taking a close, hard look at their security posture and discovering something unexpected: their systems are not up to date.

According to StatCounter, the global install base for Windows OS is 38% (as of April 2017), with desktop deployments sitting at a nearly 85%.  This makes it a primary target for hackers and cyber criminals.  Of course, Microsoft is no stranger to security vulnerabilities. Their “Patch Tuesday” has been a monthly tradition for Windows system administrators since 2003.  Simply knowing when patches come out isn’t enough to protect your environment.  As Arraya’s Cyber Security Practice Director Tom Clerici highlighted in his article on basic security hygiene, vendors publicize vulnerabilities when they release patches, “yet many organizations fail to install and test those patches in a timely fashion.”   How could this be?

There are a few reasons.  There may be a lack of defined processes for how and when systems are patched.  It’s common practice to leverage the Windows Server Update Service (WSUS) to automate patching.  This is a good start, but WSUS does not account for all the applications running in the environment.  Who is going to identify and patch those applications?  What about validation?  It could also be a lack of focus.  Security is a hot topic, and countless projects and initiatives are being greenlit to harden the network and protect identities.  It’s ironic then that organizations are being exposed by the simplest of things: patch management.

Fortunately, Arraya’s Managed Services customers have not suffered the same fate.  We are proud to say that no customer who relies on us for systems management has been affected by the WannaCry outbreak.  Patch management is an integral part of our service and the first step in safeguarding infrastructures under our care.  We take this responsibility seriously and spend the time to baseline the environment and set up recurring schedules.  Consider this quote from Arraya’s Managed Services Director, Robert Whann: “having a well-executed patch process allows us to apply updates quickly without having to worry about outages and interruptions.”

Patching systems is only one part of a much larger security story.  Don’t let global events and external forces be your only motivation for building an actionable strategy.  Arraya offers a variety of services to help set your IT organization on the right path.  Consider the risk of doing nothing and leaving systems, information and your employees vulnerable. Don’t let that be the case. Visit us at www.arrayasolutions.com to start a conversation on how partnering with our Managed Services and Security practices can keep your business safe and bring your IT goals within reach.