By Joseph Menn
SAN FRANCISCO (Reuters) - For Kris Hagerman, chief executive of UK-based cyber security firm Sophos Group Plc (L:SOPH), the past week could have been bad. The WannaCry "ransomware" attack hobbled some of its hospital customers in Britain's National Health Service, forcing them to turn away ambulances and cancel surgeries.
The company quickly removed a boast on its website that “The NHS is totally protected with Sophos.” In many industries, that sort of stumble would likely hit a company's reputation hard.
Yet on Monday, three days after the global malware attack was first detected, Sophos stock jumped more than 7 percent to set a record high and climbed further on Wednesday after the company raised its financial forecasts.
As for most other cyber security firms, highly publicized cyber attacks are good for business, even though experts say such attacks underscore the industry's failings.
"We are making good progress and are doing a good job," Hagerman said in an interview this week. "People ask 'How come you haven’t solved the cyber crime problem?' and it's a little like saying 'You human beings have been around for hundreds of thousands of years, how come you haven't solved the crime problem?'"
Hagerman pointed out that his company only claimed to protect 60 percent of NHS affiliates and that other factors contributed to the disaster at the hospitals.
"They have their own budgets. They have their own approach to IT generally and IT security,” Hagerman said of individual hospitals, which pick their own operating systems, patching cycles and network setups. Microsoft Corp (O:MSFT) had issued a patch in March for the flaw WannaCry exploited in Windows operating systems.
Yet Hagerman acknowledged that Sophos did not update its basic antivirus software to block WannaCry until hours after it hit customers.
HIGH STAKES
Security experts say hospitals, where the stakes are especially high, represent a case study in how legacy industries need to up their cyber security game.
"We've tolerated a pretty poor level of effectiveness, because so far the consequences of failure have been acceptable," said Josh Corman, a cyber security industry veteran now working on related issues at the Atlantic Council and a member of a healthcare security task force established by the U.S. Congress.
"We are going to see failure measured in loss of life and a hit to GDP, and people will be very surprised."
Some long-lived medical devices have more than a thousand vulnerabilities, Corman said, and perhaps 85 percent of U.S. medical institutions have no staff qualified for basic cyber security tasks such as patching software, monitoring threat advisories and separating networks from one another.
Increasingly serious cyber security problems are partly an inevitable consequence of the growing complexity of digital technology.
But there are other causes too, including a lack of accountability that stems from the wide range of technology handlers: computer software vendors, antivirus suppliers, in-house professionals, consultants and various regulators.
Ultimately, Corman said, hospitals need to hire solid cyber security people instead of another nurse or two.
GOOD FOR BUSINESS
"What’s needed is punishment of the negligent," said Ross Anderson, a University of Cambridge pioneer in studying the economics of information security, referring to the hospitals that did not stop WannaCry.
"This is not about technology. This is about people fouling up in ways people would get a pink slip for” in less-insulated environments, he said, meaning they would lose their jobs.
For now, though, there are few signs of any revamp in large institutions' approach to cyber security - and little incentive for contractors in the cyber security industry to change.
Sophos was not the only company whose stock rose on Monday, as the global scale of WannaCry became apparent. Shares of U.S.-based FireEye Inc (O:FEYE) and Qualys Inc (O:QLYS) both rose more than 5 percent.
But Sophos stood out, aided by higher expectations for a product the company introduced last year to fend off ransomware - so called because the authors of the malware demand a 'ransom' to restore a user's infected computer - which worked at the hospitals that had installed it.
"It's good news for our business," one Sophos employee, who asked not to be named, told Reuters this week. "We were so inundated with people calling us."