I have been talking to many people during the last several days regarding this “global cyber ransomware event.” It dawned on me that this may finally help people, especially Microsoft, look at things a little differently. Allow me to expound.
First, if you are one of many system managers that neglected to keep current with Windows deployments in your company, you need to give pause and reflect. The clean-up exercise you spent all weekend on was really unnecessary. Sadly, for many of you it was out of your control due to maintenance window conflicts, user cooperation issues, or lack of clarity from Microsoft. Some of you work in tightly controlled, regulated industries, and balancing up-to-date maintenance with poor regulatory guidance means that chasing patches hasn’t been on the forefront of your mind. The only way forward, for all of us, is to gain control.
As system managers, you have an obligation to communicate the importance of routine maintenance; keeping up-to-date with patching should not be optional. If it’s too burdensome for your IT team, get help from an outside partner to apply an appropriate systems management approach that allows you to focus on other priorities. Senior Management at every organization should see the risk of not doing these things – you now have ammunition from the media. Use this opportunity to re-examine your Standard Operating Procedures.
Secondly, Microsoft needs to learn a great deal from this. Yes, I am calling them out. It’s not their fault, per se, but the approach we take to the “patch cycle” isn’t scalable, is far too intrusive, and demands that we spend far too much time trying to figure out what is truly important for the stability and security of our IT environments. I predict we will see a far different approach from them in the future, but they need to take their 3,800 security engineers and envision a way to completely retool the update process as well as the system flaw patches that it fixes. What we have today just doesn’t work well for most.
I am optimistic that this event, regardless of its impact or origin, can be learned from. What reflections have you made?
