Over the past week, many clients and individuals have asked me why some companies and health care facilities were devastated by the WannaCry ransomware, and why others made it through the weekend without a blink of an eye.

Simplistically, it is because those who pay attention to security patches that they receive from technology vendors for their products (like Microsoft in this case), are protecting their network better than those who can’t get to them. And those thieves (primarily in China) who bought pirated software got their just deserves for stealing the software and therefore, not receiving the patch from Microsoft.

My IT friends tell me it is a challenge to stay on top of all of the vulnerability patches that they receive every day from technology companies and that they are having a difficult time prioritizing the pushes. The WannaCry attack emphasizes how important it is to push those patches when they are received from technology companies and to make implementation of the pushes when they are received a priority in a risk management plan.

Most reports of the WannaCry attack call it a “wake up call” to the healthcare industry (and obviously other industries) that bigger and more widespread attacks are on their way. Implementing patches when they are pushed out by technology companies are an effective way to protect an organization from a known vulnerability. The technology companies are not sending these pushes out because they have nothing better to do. They are pushing them out to protect their customers, including you, from vulnerabilities that they are aware of. So if they know about them, so do the hackers.

Although it is difficult to keep up with vulnerability patches, last weekend was a great reminder of how important they are for protection and for your risk management program.

[View source.]