I have been watching, with no little schadefreude (trans. "damage joy") today's outage of
many NHS services as a result of a ransomware attack.
This could happen to anyone, n'est ce pas? The various NHS trusts affected were just unlucky.
They have many, many users (admin staff in each GP's surgery; nurses, auxiliaries and doctors rushing to enter data before dashing off to the next patient). Why is it unsurprising that this is happening now?
The NHS is an organisational monolith. It makes monolithic policy announcements. As a result of those policies,
Windows XP became the canonical choice for NHS PCs. It is still the canonical choice for NHS PCs.
Windows XP launched to the public in late 2001. Microsoft ended support for Windows XP in April 2014. Honestly, I have to give Microsoft kudos for this (oh, that hurts) because they
kept XP supported way beyond any reasonable timeframe. But all good things come to an end, and security updates
are no longer built for XP. The NHS paid Microsoft for an
extra year of security patches but decided not to extend that option beyond 2015, presumably because no-one could come
up with a convincing value proposition for it. Oops.
The consequences of this were inevitable, and today we saw them. A huge userbase of Internet-connected PCs no longer receiving security updates is going to get hit by something - they were a bit unlucky that it was ransomware, which is harder to recover from than a straight service-DoS, but this was entirely foreseeable.
Luckily the NHS mandates that all critical operational data be backed up to central storage services, and that its sites conduct regular data-restore exercises. Doesn't it? Bueller?
I don't want to blame the central NHS IT security folks here - I'm sure they do as good a job as possible in an
impossible-to-manage environment, and that the central patient data is fairly secure. However, if you predicate effective
operations for most of the NHS on data stored on regular PCs then you really want to be sure that they are secure.
Windows XP has been end-of-support for three gold-durned years at this point, and progress in getting NHS services off
it has been negligible. You just know that budget for this migration got repurposed for something else more time-sensitive "temporarily".
This is a great example of organisational inertia, in fact maybe a canonical one. It was going to be really
hard to argue for a massively expensive and disruptive change, moving all NHS desktops to a less-archaic OS - Windows 10 seems like
a reasonable candidate, but would still probably require a large proportion of desktops and laptops to be replaced.
As long as nothing was on fire, there would be a huge pushback on any such change with very few people actively pushing
for it to happen. So nothing would happen - until now...
Please check back in 2027 when the NHS will have been on Windows 10 for 8 years, 2 years end-of-life, and the same
thing will be happening again.