Pulsant Protects

Pulsant is committed to protecting customers’ operations, infrastructure and data. We have invested significant time and effort in putting the most effective procedures, policies and best practices in place to guard against the threat of cyber attacks and mitigate the associated risk. We have a multi-layered cyber security strategy, supported by the latest technologies, tools and expertise. But protecting against cyber threats is an ongoing partnership with organisations and their suppliers.

Read what our cyber security expert Hazel Freeman has to say about the recent attack and what organisations can do to mitigate the risk of cyber attacks.

Reflecting on the NHS ‘WannaCry’ Ransomware attack
By Hazel Freeman, Managing Principal Consultant, Consultancy Services, Pulsant

Reflecting on the NHS ‘WannaCry’ Ransomware attackLike everyone else, I was saddened by the NHS Ransomware attack that took place, and unfortunately it’s the kind of thing we’re now seeing on a frequent basis. As is the case in most crimes, the culprits do not think about who they are affecting — they are only thinking about the potential financial gain. 

What was interesting about this attack on the NHS, however, was the extent of the damage that could have been reduced and the associated risk that could have been mitigated through the proper implementation of some simple technical controls, as well as appropriate awareness training being delivered to staff.

Now, this might sound like a grand statement that’s much easier said than it is put into practice, but the controls are very simple and can be implemented by any business. They are as follows:-

• Keep IT operating systems and software up to date with the most recent security patches
• Keep anti-virus/anti-malware software up to date
• Stop users from being able to run executables on their devices
• Back up your information and test that you can restore it regularly. This way, if you are unfortunate enough to be hit by an attack, you can restore your data
• If you can, block any executables from being delivered via email or via malicious websites by using email filtering, enabling personal firewalls, blocking known fraudulent sites or by using whitelisting
• Train your users to identify fraudulent emails
• Ensure you have effective business continuity and disaster recovery plans in place that are regularly tested

The question most people have struggled to understand in this instance is why — if the security controls were so simple — weren’t they already put in place?

Legacy systems

These are a huge issue for many organisations that have been around for a long time, or ones that have grown through mergers and acquisitions. They are also the biggest pain to IT managers.

The old adage of ‘If it’s not broke, don’t fix it’ means that there are plenty of companies out there that rely heavily upon old IT systems for everyday business processes, and many of these companies are reluctant to change or upgrade because ultimately they still work fine. Unfortunately, due to the fast-paced nature of IT, even if an application is running perfectly well and still doing the job it was designed to do, the IT equipment and operating system that it’s running on will eventually pass its ‘best before’ date.