WannaCry Ransomware: It may seem incredible that we are still discovering security vulnerabilities in software that has been in use for decades. Most of us would expect that, at least for software that hundreds of millions of people use every day, bugs should have been identified and fixed.
But the chaos caused by the WannaCry ransomware last week shows how difficult it is to ensure that even the most widely used software doesn't go wrong, and on a large scale.
This is because software is rarely designed or written in isolation. Sometimes developers rely on old code written by others and connect it to other systems that may not even have been built. Code is often written in a hurry by developers who intend to fix it later. And as business priorities change, so too should the way in which coding is done, whether it’s in the coding languages used or the way projects are managed.
Rather than striving for perfection, software development is more often a compromise. Think of an office building in the middle of a busy city: it might have to be built over old sewers and underground train tracks. The project manager hopes that the basement won't start to flood, or worse, that the foundation won't rot and the building will collapse.
This doesn't mean that software companies should give up: the importance of strong code and secure software can only increase as it is used in everything from automotive to medical equipment.
But writing now and fixing later doesn't seem to be an option anymore. It might be for trivial software, but it's not for the developers who build the critical systems we rely on every day.
But even non-programmers should recognize the importance of creating and maintaining software security by rewarding companies that make these standards a priority.
We should also recognize that software will inevitably leave us hanging occasionally. This may involve supporting systems and data, but prepare for the worst. It also means we need to better understand the risks we face.
Too many events allowed WannaCry to be so aggressive (leaks of CIA hacking tools, vulnerabilities in older Windows, systems that had not been updated).
All signs (see the WikiLeaks concerning more CIA tools) indicate that more "storms" will follow, perhaps even bigger than the last one.
More “WannaCry” is coming, and it will happen soon, so get ready.
