Dr Saif Abed talks about WannaCry – one year on

Dr Saif Abed, founding partner at Abed Graham

As sunshine illuminated Friday lunchtime on 12 May 2017, reports started to pop up on local news-sites and social media that the NHS was experiencing a cyber-attack. By tea-time, it was clear that it was caught up in the world-wide WannaCry event.

The ransomware attack affected 150,000 computers in 150 countries, but in the UK it had a very visible impact on the health service. Some trusts closed their A&Es as IT teams worked across the weekend to get systems up and running again.

Dr Saif Abed, a founding partner of the Abed Graham consultancy, a partner of Highland Marketing, has spoken extensively about WannaCry, the various reports that have been written on its impact, and on what needs to happen next. He talks to Lyn Whitfield.

What is your memory of 12 May? Were you surprised, at the time, that the NHS was affected by this kind of attack? Do you agree with a recent Public Accounts Committee report that the NHS was, in fact, “lucky” (the attack hit on a Friday afternoon and the kill switch was found quickly, which minimised disruption)? How easily could the impact have been worse?

My memory of the time is still remarkably vivid, if only because I heard about what was happening from personal contacts and not just the news. Was I surprised? I have to say: ‘No’ because I had been commenting on the risks that healthcare organisations were facing for some time.

But, of course, there was no way I could have predicted how a national attack would play out. As far as the level of disruption goes, it could definitely have been a lot worse. A more targeted attack could have been much more devastating.

I’m of the mindset that health IT is the new frontier of cyberwarfare. Future attackers will look to target the integrity of health IT systems; not just whether they are available or not. Imagine what would happen the day drugs are administered from an e-prescribing system and patient medications are mixed up because of a cyber-attack? That gives you a flavour of how bad things could get.

When we spoke a few days after the attack, you said there should be a “forensic” inquiry into what happened. Do you think the inquiries that have been held have done that job? At EHI Live last October, you also warned that there was a “blame” culture around WannaCry. Have the inquiries encouraged or stopped that?

There have been a number of inquiries from different government agencies that have shed light on the state of cyber security in the NHS; and that’s been positive. What is important is to build on the conclusions and recommendations of these reviews, by actioning them in practice.

I think that is starting to happen. We all know that public sector organisations are cash strapped, so we can only move at a certain pace but I think, overall, there’s been positive progress. I would like to see a greater focus on clinical leadership and contingency planning for clinical services, but I think that will develop sooner rather than later because the stakes are so high.

I would also re-emphasise that a blame culture has to be avoided. We have to stay focused on the task at hand rather than point fingers. There have been some reports that have perhaps strayed into this territory, but not enough to hamper progress, I would suggest.

If you were asked to pick out just one legacy of the attack, what would it be?

Cyber security is a patient safety issue and we are all accountable. That has to be the headline statement. If we only focus on buying more technology – and ignore human and process factors – then truly devastating attacks will be inevitable.

Do you think the NHS is in a better position on cyber security than it was a year ago? NHS Digital has put out a big ‘lessons learned’ report, but the Public Accounts Committee is worried that there is no detailed, costed plan to implement it. Do you think it’s right? And if so, where do you think national and local organisations need to focus their efforts?

The NHS is in a better position because there’s greater awareness and cyber security is becoming, gradually, a board level agenda item. Also, the government has been allocating more funding while government agencies have been liaising with industry to bolster cyber defence capabilities.

These centrally driven moves are critical. At a local level, it’s a more mixed picture; as you would expect given variations in digital maturity. We are still a way away from having Cyber Essentials adopted uniformly across the NHS; let alone having compliance with the major regulatory requirements outlined in the EU’s NIS Directive – which is under the ownership of the Department of Culture, Media and Sport for the NHS.

My primary guidance would be not to rely on buying more technology. If you are following the National Cyber Security Centre’s guidance, you will see that there is much more talk of humans being the strongest link in security. And I think that’s where attention needs to be.

NHS organisations need to ask themselves: ‘When technology fails, as eventually all systems do, can you maintain clinical services as usual, with minimal disruption?’

Most security experts seem to think that another cyber-security incident is inevitable. As and when one hits, do you think the NHS will be in a better position to respond?

Depends on the nature of the attack I’m afraid! A little bit of ransomware: sure. But a co-ordinated nation-state attack targeting the integrity of clinical information systems: I think we have more work to do. The good news is we can get there through collaboration and resolute co-ordination.

A lot has happened in a year, and Highland Marketing has been looking back at what is known about the WannaCry virus, at the many reports that have been written on its impact on the NHS, and at what the Commons Public Accounts Committee wants to hear in June.

Lyn Whitfield

Lyn is a journalist by background. After completing her training in local papers, she specialised in coverage of the public sector in England, the NHS, and healthcare IT. This has enabled her to follow closely the many twists and turns of recent health policy; and to report on them for specialist audiences. It has also given her an exceptional ability to advise clients on the reality of working with the NHS, and on communications that work for them. Lyn’s skills include strategic thinking, managing projects with a communications and publication element, editing, research, interviewing and writing. A little about Lyn: Lyn has an impressive educational record, with a first degree in Politics, Philosophy and Economics from Oxford University, and a Masters degree in Social Policy and Planning from the London School of Economics and Political Science. Before taking up her current post, her journalism employers included the Health Service Journal and digitalhealth.net (formerly EHealth Insider). Over her career, she has also worked with think-tanks, including the King’s Fund and the Nuffield Trust, and major companies, such as Microsoft. Lyn is a proud Yorkshire lass, but lives in Winchester with her partner, a political cartoonist with his own live-drawing business. Her ‘downtime’ activities include Pilates and running; she has completed a number of marathons.

Next Drip, drip, drop »

Previous « WannaCry havoc – the NHS cyber attack one year on

Published by

Lyn Whitfield

Tags: Dr Saif AbedNHSWannaCry

6 years ago

People at the heart of tech at the heart of the NHS
Highland Marketing advisory board member Natasha Phillips led a discussion on nurses, midwives, and allied…
What will the general election mean for the NHS and health tech?
Two weeks into a six week campaign, content director Lyn Whitfield considers what the election…
NHS finances: cuts get real
The NHS has gone into 2024-5 facing a tough financial situation and both systems and…