I work in an industry where security is kind of a big deal. Without getting into specifics, or naming company names, we'll just say that the companies I work with a lot are in the financial sector. Because of that, I've found that their security is pretty damned hard core, and their vendor risk assessment crews are even more hard core.
Knowing all that, you can probably assume that I get a lot of risk assessment questionnaires asking about the company I work for and our security practices. On top of their annual, or semi-annual risk assessments whenever news breaks out of some fancy new malware, their pucker factor goes up exponentially and I get bombarded with questions asking about what we're doing about it.
Although I completely understand where they are coming from, the truth is in the world of network security, threats like this are always out there. There are always viruses, Trojans, worms and other nasty things hackers are trying to do to cause chaos, damage systems, steal information or to steal money. The difference with these cases is that they are famous and they've made the news cycle.
This latest crazy threat that has everyone in a tizzy is
WannaCry(Or WCry, or Wanna Decryptor). If you have been living under a rock, it's your typical
ransomware that encrypts all your files and asks you to pay a ransom to have your files unlocked. In reality, it's no different than
CryptoLocker that came out in 2013. One might argue that the difference is how it was spread using
a vulnerability that the NSA had been using for years.
Guess what folks, I have news for you. Shit like this comes out every day. In fact,
WikiLeaks has been leaking all of the CIA's exploits for the past few months.
The Hacker News reported yesterday that two of the CIA's tools affect all versions of Windows! WannaCry only affected Windows 2008 and below! Get ready for an epic shitstorm of hacks now that the United State's Government's secrets are all over the web!
Long story short, DON'T PANIC! Stuff like this happens every day. The best thing you can do is prepare for it. Keep your systems patched, make sure your antivirus/anti-malware is up to date, use firewalls, beware of phishing scams, and make sure you have reliable backups! You know, all the recommended security shit you are supposed to do, and not be lazy about! If you maintain a decent security posture, you can prevent a lot of this sort of thing, or be able to mitigate against it should you be affected.
Do you agree? Disagree? Let us know in the comments.
7:00 AM
Paul B
