Why disclosure rules didn't prevent the WannaCry attack

As cybersecurity experts continue working to mitigate the WannaCry ransomware attack that struck hundreds of thousands of users around the world, Microsoft and others are lashing out at the National Security Agency.

Cybercriminals appear to have used the EternalBlue exploit stolen from the NSA to develop the ransomware, which locks up computers and then moves laterally though networks to infect others.

"The governments of the world should treat this attack as a wake-up call," Microsoft President Brad Smith said in a company blog post.

"We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world," he added. "We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits."

The U.S. government's Vulnerabilities Equities Process is designed to evaluate the offensive and surveillance values of finding and exploiting zero-days versus the risk to governments and the private sector if those vulnerabilities are not disclosed and patched.

In the wake of the release of hacking tools by Shadow Brokers and WikiLeaks, Microsoft and others have renewed calls for VEP reform to increase disclosure. But former White House cybersecurity coordinator Michael Daniel told FCW that VEP is already biased towards disclosure and that the government "is not hording zero-days."

Whether or not the NSA tipped off the company, Microsoft issued a patch for the EternalBlue exploit on March 14, and the Shadow Brokers did not release the NSA tools until April 14. The WannaCry attack surfaced on May 12.

"I think the challenge is with two months notice, organizations still aren't able to get ahead of the curve enough to protect themselves against this," said Illumio's Nathaniel Gleicher, former director for cybersecurity policy at the National Security Council.

Gleicher and other former officials said that while VEP might need to be reformed in some way, there are more immediate concerns, such as the fact that insiders appear to be stealing government hacking tools.

"Recent history indicates we have a problem managing the contract workforce effectively, primarily because we currently have fewer tools to address the issue," said Daniel.

He added that contractors "often exist in a kind of no-man's land" where they work for companies that do not directly oversee them since the contractors are working in government offices, but they are also not monitored in the same fashion as government employees.

"In the current environment, government-held vulnerabilities are going to leak," said Ari Schwartz, former senior director for cybersecurity at the NSC and now with Venable. "Governments should not expect that they can hold on to vulnerabilities as long as they used to and we have to come up with coping mechanisms for it."

Daniel added that "not all zero-days are created equal." He said some are more easily exploitable than others and therefore require a more urgent response.

"We need to develop a more refined severity schema for vulnerabilities so we know how to react, and at what speed," he said. "It'll never be perfect, but we can do better."

Microsoft described the leak of the NSA hacking tools as the equivalent of the U.S. military having Tomahawk missiles stolen.

"This attack demonstrates the degree to which cybersecurity has become a shared responsibility between tech companies and customers," said Smith. "The fact that so many computers remained vulnerable two months after the release of a patch illustrates this aspect. As cybercriminals become more sophisticated, there is simply no way for customers to protect themselves against threats unless they update their systems."

Schwartz added that patches exist for the vast majority of exploits. "In my experience, regulators in the U.S. have started to pay more attention to patching protocols and governance of patching in their reviews and audits in sectors where they have more direct oversight."

He said sectors like banking and electricity, for example, have better patching regimes than healthcare, which was the sector hardest hit in the UK by WannaCry.

"I think that businesses need to recalculate the benefit/cost ratio for patching [and] updating to newest operating system," said Daniel. "They may be underweighting the cost of not patching, potentially leading to situations like this."

Gleicher, however, cautioned against too much focus on patching and not enough on other mitigation tactics. He said that especially in large organizations, patching can be slow and cumbersome, and while it needs to be done, more focus on segmentation of networks can prioritize and speed up the patching process.

He added that in the case of WannaCry, disabling the Server Message Block protocol on devices either before or during the attack would shut down the malware's ability to move through a network.

"Thinking that any one solution is the only solution is a serious handicap for defenders," he said. "We need to use all the different controls we have together so that we can speed up our cycle."

Schwartz said that moving to "cloud will greatly help security for a range of business, particularly small and medium.

"This is a perfect example of why," he added. "Most companies running in the cloud would not have to worry about WannaCry at all."