Network Risk Assessment

Over a weekend, the high school's IT staff ran a vulnerability scanner across the whole network. Monday morning it produced a report. Five of its rows are below, shortened.

A scanner knows the flaw. It doesn't know the school: which device holds what, who can reach it, and what it would cost if someone did. That is the analyst's job. Rate each row high, moderate, or low for this school.

Any device that can reach the file server, which is every device on the network, could run code on the machine that holds staff documents and student records, so row A is high. An adversary could take the records, rewrite them, or lock the server so nobody can open them, which touches all three security principles.

Row B's passphrase is known to every student, so every student device, and any device a student lends it to, shares a network with the staff computers. From there, every attack a local network allows is within easy reach, and row B is high too.

Row C is moderate. No data or access is exposed, but the error pages hand an adversary a map: which software to look up flaws for, and what the servers behind the site are called.

The scanner scored row D above row C, and the flaw is real, but using it means first having the controller's administrator password, which two people in the school hold, and knowing how to turn a published flaw into a working attack on an unusual device. Someone who did all that could make the bells ring at the wrong times. That puts row D at the bottom: low.

Row E is moderate. A login sent unencrypted can be read by anyone who can get the traffic in front of them, and on this flat network ARP poisoning makes that easy for any student device. What the login opens is a printer, so the damage is limited, though a printer's settings can hold other accounts' passwords.

Row A's update went in that Monday night. Row B needed a project, sign-ins for every student and a network of their own, so it went on the list for the summer, and row C took ten minutes. Row D stayed on the list too, at the bottom, where the school's own rating put it.

Row A's update was the urgent one because a flaw of that kind was behind WannaCry. Microsoft released an update on March 14, 2017, for a flaw in Windows file sharing that let a remote computer run code. On May 12, ransomware that used the flaw began spreading on its own, from computer to computer, to machines that lacked the update and could be reached on the network port Windows file sharing listens on. It locked their files behind a demand for bitcoin. By May 14, Europol counted more than 200,000 victims in at least 150 countries, most of them hit within hours. In Germany it reached the national railway, Deutsche Bahn: screens in stations showed the ransom demand in place of train times, and some ticket machines stopped working, though the trains kept running.

In England, it hit the National Health Service hard. The National Audit Office found that at least 80 of England's 236 NHS trusts were affected, along with hundreds of family doctors' practices. NHS England counted 6,912 cancelled appointments and estimated more than 19,000 in all. Five hospital trusts had to send emergency patients to other hospitals, among them Barts Health, which runs the Royal London Hospital, one of London's main trauma centers. The outbreak was largely halted that first day, when a British researcher, Marcus Hutchins, registered a web address the program checked before doing anything else. The United States and Britain later said North Korea was behind it. The National Audit Office found that the attack could have been prevented by basic security practice, starting with installing the update.