WannaCry's Question for Web Teams: How Old Is Your Oldest Unpatched Install?

The ransomware called WannaCry swept through more than 150 countries in the second week of May, and the images will hold their place in the industry’s memory. Emergency rooms diverting patients. Factory lines idled. Ransom screens on railway departure boards.

The technical account, now well established, contains the sentence that makes this a web-team story rather than a Windows story. The flaw WannaCry exploited was patched by Microsoft in March, two months before the outbreak. Nobody gets breached by a zero-day on Tuesday. They get breached by the patch they skipped in March.

The defense existed. It had been published, announced, and distributed. The organizations that fell were not defeated by sophistication. They were defeated by the gap between ‘patch available’ and ‘patch applied.’ A gap made of unmanaged inventory, deferred maintenance, and systems old enough to have fallen off the support list entirely.

Every web team should hear that as a personal question, because the same gap runs through institutional websites with the same structure and the same eventual invoice. We have documented both since a Drupal advisory made the case in hours rather than months. The question, asked honestly: how old is your oldest unpatched install, and who would know?

The website’s version of the unpatched hospital

Translate the outbreak’s anatomy to the sites we audit, because the mapping is uncomfortably direct.

The forgotten systems. The 2014 campaign microsite still running its launch-year CMS version. The departmental WordPress nobody currently employed remembers commissioning. The event site from two redesigns ago. The staging server that became critical.

The support-expired tier. Installs on platform versions past end-of-life, receiving no patches at all. The web equivalent of the aged Windows editions that anchored WannaCry’s casualty list.

The lateral exposure. These orphans typically share hosting, credentials, or a domain with the flagship properties. ‘It’s just an old microsite’ understates the blast radius in exactly the way ‘it’s just one workstation’ did this month.

Our audits find this tier in a large majority of institutional sites, and the finding is never malice, or even negligence in the individual sense. It is the structural absence of an inventory. That is why every security post we have written, from Heartbleed forward, lands on the same unglamorous predicate. You cannot patch what you have not listed. The census comes first. Everything else is built on it.

The practice, restated with the outbreak’s urgency

• Site inventory, complete and owned. Every install, per the census habit. Its platform and version. Its owner by name. Its hosting and data sensitivity. Refreshed on a calendar, because sites grow orphans continuously.

• Patch SLAs by severity, in writing. Drupalgeddon meant exploitation within hours of disclosure. After that, critical-advisory response measured in hours rather than sprints became the only defensible standard. WannaCry is the argument for making that standard universal rather than boutique. Routine updates on a monthly cadence. Critical advisories as interrupts, with a named on-call path.

• The end-of-life list. Platforms and versions with published support horizons, tracked like lease expirations, with migration or retirement scheduled before the support cliff rather than discovered after. Unsupported software is unpatchable by definition, and unpatchable is the condition this month priced.

• Retirement as a first-class outcome. A striking fraction of the vulnerable tier serves no one. The cheapest patch is decommissioning, and the inventory review should retire as enthusiastically as it upgrades.

• Backups tested against the ransomware scenario specifically. Restoration rehearsed. Backup isolation verified, because encrypted backups on connected storage are hostages, not backups. Recovery time measured rather than assumed, per the incident-response practice.

The tabletop, ransomware edition

Our incident-response practice gets its scenario update, because WannaCry’s specific shape deserves rehearsal.

Convene the hour and walk the room through it. Monday, 9 a.m., the flagship site’s CMS is encrypted and a ransom note names a deadline. Who notices first, and through what monitoring? Who declares the incident, and who has authority to take systems offline?

Where are the backups? When were they last restored, rather than merely taken? Is the backup target reachable from the compromised network? If yes, assume it is encrypted too, because that is the design of this year’s strains.

What is the communications sequence, and who owns each step? The status page. The leadership note. The regulatory clocks if personal data is in scope.

And the question that decides the whole exercise. What is the honest recovery-time estimate, measured against the cost of each day down during your busiest season?

Every gap the hour surfaces is a finding at conference-room prices. The same gap surfaces at incident prices otherwise. Our clients who ran the exercise after Drupalgeddon spent this month’s news cycle bored. That is the product. Rehearsal converts catastrophe into procedure, and procedure is what Monday at 9 a.m. actually tests.

The budget framing, for the leadership meeting

The paragraph to bring upstairs, because May supplied the visual aid this argument has always lacked.

The gap between patch-available and patch-applied is not a technical condition. It is a governance choice with a price, and this month the price was on television. Surgeries postponed. Production halted. Ransoms demanded. Reputations marked.

The choice hides because its cost builds invisibly until it does not. Its remedy (steady, unglamorous maintenance funding) appears on every budget as a line someone proposes trimming. Nothing visibly happens when maintenance works. That asymmetry is the whole problem, and leadership owns it, not IT. An organization that funds its website as a launch and starves it as an operation has chosen its side of the gap, whatever its intentions.

The reframe we have urged for a decade got its clearest illustration yet. Maintenance is infrastructure. Fund it like the plumbing it is, with the same expectation of permanence and the same intolerance for deferral. The WannaCry stories become what they are for our patched clients this month: news about other people’s governance.

The inventory takes weeks. The SLAs take a policy memo. The next worm is already in development, and it will publish the same question with a new name. Indeed, a variant is reportedly circulating as this post goes up. The question does not age. Only the answers do, one funded quarter at a time.