This week one of the largest ransomware incidents to date, ‘WannaCrypt’ or ‘WannaCry’, affected the operations of at least 300,000 machines worldwide ^[1], encrypting and locking victims out until a Bitcoin ransom equivalent to US$300 was paid. It affected the operations of about ^[2] 40 hospitals and other health organisations in the UK, as well as major infrastructure ^[3] companies and government agencies across Europe. Australia appears to have escaped the worst of it ^[4], with some businesses affected but no major disruptions to critical services. The incident has prompted the usual calls to patch software and update anti-virus services ^[5].

UK malware researcher @MalwareTech ^[6], became an accidental hero ^[7] when he registered a domain name found within the WannaCry malware which acted as a ‘kill switch ^[8]’ for the virus. Not a bad return on a US$10.69 investment. Despite the unexpected relief, variants without ^[9] the switch have since popped up. Brian Krebs ^[10] estimates that people have coughed up US$26,148 so far—a paltry return considering the damage done. By comparison, CryptoWall raised US$325 million ^[11] in 2015. Efforts to uncover those behind WannaCry are in full swing, with some early signs suggesting a North Korean connection ^[12].

WannaCry has capitalized on a vulnerability that was part of the cache of NSA ^[13] tools leaked by Shadow Brokers in mid-April ^[14]. Microsoft patched the vulnerability in March (MS17-010 ^[15]), and has this week released further patches ^[16] for unsupported operating systems such as Windows XP. The episode has re-ignited calls from Microsoft for a Digital Geneva Convention ^[17], and prompted the company to clip the NSA over the ears ^[18] for stockpiling these vulnerabilities. However, these altruistic measures from Microsoft, and continuing calls to ‘just patch ^[19]’ don’t fully consider the difficulty of doing so ^[20]. Most organisations don’t and didn’t have the resources ^[21] to update their systems to the latest and most secure versions of Windows. On the other hand, this vulnerability was a security defect in the product that Microsoft put out, yet, under current software licensing law, they’re not held liable ^[22]. Commentators are questioning why the current incentive structure is for hospitals to take on the costs of paying licensing fees every half-decade to buy security features we expect as a given of any other product.

After a significant delay ^[23] President Trump has finally signed ^[24] an executive order to strengthen the cybersecurity of critical infrastructure and federal computer networks. In good news, the order doesn’t appear to be a total car wreck ^[25], with Wired calling it ‘refreshingly even-keeled’ ^[26]. It calls for numerous reviews to be completed within 90 days, and has a strong focus on accountability, aligning cyber risk management with budgets, and taking action to replace legacy systems. It has also addressed issues including international cooperation, workforce development and threats to the defence industrial base. The order has found some support in Congress ^[27], but Senator John McCain called for more urgent action in finalising a national cybersecurity strategy stressing there was no need for ‘more assessments, reports and reviews.’ Progress may also be further slowed by the lethargic pace of recruitment ^[27] of senior government cybersecurity officials.

There was also Congressional support ^[27] for the mandatory application of the NIST cybersecurity framework also included in the executive order ^[28]. NIST have this week issued ^[29] their revised set of standards for password best-practice, reversing previous requirements for scheduled password changes and combinations of upper case, lower case letters, numbers and symbols and replacing them with more ‘human-friendly ^[30]’ requirements that reject previously-compromised passwords. This could include emoji passwords if the user so desires.

The recent Federal Budget contained a couple of interesting cyber-related initiatives. A new Cyber Security Advisory Office (CSAO) will pop up in PM&C’s Digital Transformation Agency (DTA). Funded to the tune of $10.7 million over the forward estimates ^[31], the CSAO is the government’s response ^[32] to recommendations from #censusfail ^[33] investigations. The Office is tasked with acting as the ‘single, comprehensive source of truth to which agencies can turn to’ for cybersecurity expertise. Aspirational…

The DTA is also set to lead broader IT procurement and projects, including hosting a ‘Digital Investment Management Office’ and a ‘Digital Marketplace’. The Agency will control a $129.6 million ‘Modernisation Fund’ that will focus ^[34] on modernising agencies, upgrading cultural centres, and consolidating APS-wide IT, finance, and human resources functions into six corporate service hubs. The Fund will also seek to open up government data for public use through ^[35] the Data Integration Partnership of Australia.

Finally, the Budget has earmarked funds for the DTA to kick off ^[36] GovPass, a scheme to build a trusted digital identity framework for government services. That’s a lot of projects for an agency that had its future called into question ^[37] as recently as February this year.