WannaCry? How IT Asset Management Will Help You Avoid Ransomware Attacks

Prior to installing a home security system, a discovery process must take place to evaluate all vulnerabilities around the property. No matter how good a home security system is, it is worthless if you do not secure every window and door.

When securing IT assets, a discovery process must be performed to find and identify all IT assets that need to be secured. However, IT assets are often lost because they are changed, updated, relocated, or refreshed. For this reason, IT asset management is critical to your security solution.

1. Do you wanna cry?

On March 14, 2017, Microsoft released a critical patch that protected machines from this type of attack. On Friday, May 12, 2017, at least 230,000 computers in more than 150 countries were paralyzed when Wannacry went into action.

What happened? Organizations that were running unsupported operating systems like Windows XP and Windows 2003 were at risk because Microsoft was no longer releasing updates for those operating systems. To stop the crying and protect organizations that are still running older versions of Windows, Microsoft compassionately released a patch for the older, outdated operating systems. 

2. Do you wanna know what’s wrong?

Unfortunately, many organizations were hit because they were not current with their patch updates. For those that did not make patching a priority, they now know to reevaluate their priorities. However, many organizations continue to fly blind when it comes to tracking their IT assets.

Throughout history, generals and commanders at war have spent countless hours and days evaluating maps to understand the battlefield. They use this knowledge to gain an advantage against their enemies. Maps provide a view of the landscape along with all its obstacles. When at war, it is vital not to be surprised by the enemy. Without a map, generals and commanders would be fighting as if they were blind. 

IT asset reports are much like a map, they provide a vision of the battlefield. When IT can see everything, they are able to see obstacles that are putting the organization at risk. In other words, they are able to see all assets that could be vulnerable to a ransomware attack such as older, outdated operating systems and applications.

For those organizations that do not have reliable asset reports, be advised that you are fighting a battle without a reliable map. 

3. Do you wanna fix it?

It is important to understand that security starts with discovery.

To apply security policies to IT assets, security solutions must see the asset. Many organizations pay little attention to the importance of discovery services and the discovery database. They view it as a necessity to their security solution instead of a critical component. 

I propose that IT asset management is the most critical part of any security solution. Discovery services need to be 99.99% reliable when it comes to discovering and documenting IT assets. Anything less is too much risk. 

If you left one window unlocked in your home, it would not matter that the rest of the windows and doors were locked. Everything must be discovered for complete security. Be sure to choose reliable discovery solutions if you want to ensure your network is secure. An undiscovered device is like an unlocked window.  

A reliable asset management database will not only provide your security solution with all the IT assets that need to be compliant, it has the ability to provide data to other systems that require asset information such as your IT service management solution or procurement database.

4. Do you wanna be happy?

Organizations that do not have asset management alongside their security solutions might be surprised by something they did not see. I would not be able to sleep in my house knowing that a door was left unlocked. However, when I know that all doors and windows are secure, I sleep much better.

If you want to reduce the stress that WannaCry has caused IT managers around the world, get a map. In other words, be sure to have a complete and accurate view of every IT asset on your network. Be sure to have policies in place to track updates and changes to IT assets.

If you don’t start managing your assets using ITAM principles, you might do a lot of crying when a message appears on your screen informing you that your data is being held hostage unless you pay the ransom. Don’t be surprised by an IT asset that you did not see.