Alarm bells have been ringing

Microsoft’s security teams actively monitor for emerging threats. While reviewing their latest updates they discovered some vulnerabilities that pose an elevated risk of cyber-attacks by ‘nation-state actors’ or Shadow Brokers that could leave organisations exposed to another attack similar to May’s WannaCrypt attack.

Why has this been put in place?

To address these vulnerabilities in this month’s updates, Microsoft has released further urgent patches for older versions of Windows, such as XP. For organisations running supported versions of Windows (Window 10 or 8.1) with updates switched on then there is no need to take action. Check updates are enabled.

Read Microsoft’s June 2017 security update release

Are you up-to-date?

Older unsupported versions of Windows, although patches have been put in place, could still be vulnerable as they do not have latest security features or advances in protection. The best course of action would be to upgrade to a supported version of Windows, ideally Windows 10. However, due to cost constraints, this is not available as an immediate fix for some organisations. Therefore we would recommend that all systems have cyber security protection in place, such as the latest versions of anti-virus and anti-ransomware software. Check your anti-virus software is up-to-date.

James Butler, CTO at Trustmarque, has this advice for our customers:

“The recent WannaCry outbreak demonstrated the importance of defence-in-depth and of being proactive with tracking and acting on vendor announcements and new threats.  Many customers have already taken steps to make improvements in these areas and Microsoft is being more proactive with patching XP for exploits and risks they consider exceptional.  The fact that Microsoft has highlighted their new proactive action to release patches for Windows XP should be noted by customers and acted on as soon as possible.

It also makes the point that WannaCry was not a one off and demonstrates a continued trend towards a more complex and quickly evolving threat landscape.  Customers should continue to focus on building a holistic and multi-layered approach to information risk management as a fundamental part of their strategy, architecture and operating model that can cope with this.”

To reiterate

  • We recommend you check that all Windows updates are enabled and if not run the updates.
  • For out of support operating systems such as Windows XP or Window Server 2003, follow the advice in Microsoft Security Advisory 4025685.
  • Ensure your organisation’s anti-virus software is switched on, up-to-date and working across your network.
  • Most of all we would advise that all users are educated on the risks of opening unsolicited emails and don’t click any links within them. And also that they are warned about the risks of using unsanctioned apps or devices that could leave your organisation exposed to attack.

If you have any further questions about your current Windows operating systems or your cyber-security arrangements, speak to your Account Manager or email [email protected].