UK Government report says NHS could have prevented WannaCry

A report by the British government’s National Audit Office (NAO) has found that the National Health Service (NHS) could “have taken relatively simple action to protect themselves” against the WannaCry malware which brought some NHS organisations to a standstill while the problem was rectified.

In its report, the NAO writes:

“All NHS organisations infected by WannaCry has unpatched or unsupported Windows operating systems so were susceptible to the ransomware. However, whether organisations had patched their systems or not, taking action to manage their firewalls facing the internet would have guarded organisations against infection”

Another interesting finding from the report is that the majority of NHS devices which were affected by WannaCry were in fact running a supported version of Windows 7, but they were simply unpatched and therefore vulnerable. Windows XP machines were also affected, but they were in the minority of infected devices.

The report states that the NHS has accepted that there are lessons to learn from WannaCry and is now taking action. For example, it’s setting out a response plan for future attacks, it is ensuring organisations implement critical CareCERT alerts, that they apply patches, and make sure anti-virus software is up to date. The NHS will ensure that essential communications can continue to flow during an attack when systems are down, and lastly, it’ll make sure organisations, boards, and their staff are taking cyber security seriously and are working proactively to reduce the impact an attack could have on patient care.

Source: National Audit Office via: BBC News | Image via NHS