Ransomware attacks possible due to poor patch management processes: Sivarama Krishnan of PwC India

The recent WannaCry attack is an awakening call for one and all. Although, the kill switch might have restricted this ransomware from spreading, it is still estimated to have damaged business worth $4 billion across the world. Sivarama Krishnan, Partner and Leader, PwC India explains, why WannaCry became big and what is the learning from this attack.

BT: Is the WannaCry chapter over or there can be still more?
Krishnan: The recent spate of attacks like WannaCry and Petaya were only possible because of poor patch management processes - fixing which hardly requires any investment. Until corporates, the government and citizens all take these simple, basic preventive measures with due seriousness, these attacks will continue to cause disruptions. It is now imperative that discussions around proactive monitoring, better incident response and cyber insurance come to the fore. Cyber security is a now a persistent business risk, in fact it is one of the biggest all-encompassing risks a business today can face. It can not only cause business disruption, financial loss but also endanger reputation, it is a crisis waiting to happen if not acknowledged and accounted for at the right time.

BT: How badly has WannaCry affected in the international space as well as India?
Krishnan: Cyber risks are border/territory/country agnostic. It is not possible to protect only one specific country during such attacks. India was relatively less affected during the last few attacks. However, as we work towards becoming a digital economy and with a new technology led and enabled tax reforms like GST, our vigilance in cyber space needs to be urgently enhanced.

BT: Ransomware attacks have been happening in the past as well, but what made WannaCry so big?
Krishnan: WannaCry wasn't the first of its kind attack but what made it so big is its scale and spread. It caught all unaware, jostled countries/businesses out of complacency when it comes to preparedness to deal with cyber threats.

BT: What has been the learning from WannaCry?
Krishnan: WannaCry has again highlighted that cyber security threats today have become increasingly sophisticated and complex. Organisations, however, have not been able evolve at the same pace.
The conventional 'technology-centric' approach has now become outdated and a more comprehensive and strategic approach to tackle these evolving threats is essential. As the enterprise network boundaries are getting blurred, a new approach, rooted in technology, but one that also includes other key aspects such as people and processes is needed. In fact it is time to focus on the human parameter. An efficient and executable strategy is one that is agile and can adapt to the changing threat landscape. Lastly, businesses need to realise that this is an area of investment and like any other investment, the dividends are for times to come. As security incidents become more frequent, the cost of managing and mitigating breaches also rise. However, the cost of not being prepared, having a robust cyber security infrastructure is much more than investing in it as a preventive mechanism.