HomeAbout usMediaCIS Press Releases‘WannaCry’ Ransomware Attacks

‘WannaCry’ Ransomware Attacks

May 14, 2017

East Greenbush, NY

‘WannaCry’ Ransomware Attacks Underscore the Urgent Need for Organizations to Follow Basic Cyber Hygiene with an Emphasis on Secure Configuration and Automated Patching

 The “WannaCry” ransomware infecting and locking up tens of thousands of computers in dozens of countries takes advantage of a known Microsoft® vulnerability. The software giant issued a patch on March 14, 2017, but many computers still have not been patched and protected.

“The attacks exploited known vulnerabilities dating back to March and impacted systems which were not configured to best practices. Equally important is that the attacks could have been prevented if the available patches were installed,” said Steven J. Spano, CIS President, and COO. “This is a reminder that we can’t take the basic security best practices for granted. Adopting and enforcing security frameworks such as the CIS Controls and CIS Benchmarks are important steps to help organizations start and stay secure,” said Spano.

Resilience Against Botnets and Other Automated, Distributed Threats

“Although ‘WannaCry’ is a pure ransomware play, it could easily be an opportunity to collect botnets for future distributed denial-of-service attacks,” said Curtis Dukes, Executive V.P. and G.M., CIS Security Best Practices & Automation Group. Botnets are a network of private computers infected with malicious software and controlled as a group without the owners’ knowledge; e.g., to send spam messages.

Other Information

  • CIS’ Multi-State Information Sharing & Analysis Center (MS-ISAC®) issued an advisory addressing the vulnerability being exploited and released an updated advisory on May 13, 2017
  • Home users with auto-update for Microsoft® Windows are already protected.
  • Sign up for MS-ISAC advisories

About CIS

CIS is a forward-thinking nonprofit entity that harnesses the power of the global IT community to safeguard private and public organizations against cyber threats. Our CIS Controls and CIS Benchmarks are global standards and recognized best practices for securing IT systems and data against the most pervasive attacks. These proven guidelines are continuously refined and verified by a volunteer global community of experienced IT professionals. CIS is home to the Multi-State Information Sharing & Analysis Center (MS-ISAC®), the go-to resource for cyber threat prevention, protection, response, and recovery for state, local, tribal, and territorial governments.