Real-Life GRC Case Study • Ransomware • Healthcare
WannaCry Ransomware and the NHS (UK, 2017): What Happened, What Failed, and How GRC Could Have Stopped It
A real incident analysis for GRC students—focused on governance, risk, compliance, and resilience. This case shows how “basic cyber hygiene” failures (patching + asset lifecycle + segmentation) can escalate into national-scale disruption.
1) Incident Overview
On 12 May 2017, the global WannaCry ransomware outbreak impacted the UK’s National Health Service (NHS). The malware spread quickly across vulnerable Windows systems, disrupting patient care operations and forcing some organizations to fall back to manual processes.
Key fact (from public investigation)
The National Audit Office (NAO) reported that at least 81 of 236 NHS trusts across England were affected, and 603 other NHS organizations were infected (including 595 GP practices). Source: UK NAO investigation report.
The National Audit Office (NAO) reported that at least 81 of 236 NHS trusts across England were affected, and 603 other NHS organizations were infected (including 595 GP practices). Source: UK NAO investigation report.
2) What Made WannaCry Different
WannaCry behaved like a worm: it didn’t need a user to click on every machine. It could propagate over the network by exploiting vulnerable systems.
Illustration: High-level attack chain (WannaCry propagation)
WannaCry leveraged SMB vulnerabilities (MS17-010) and used SMB/TCP port 445 for propagation. (See references below.)
3) Timeline (Specific and Verifiable)
| Date | What happened | GRC control that should exist |
|---|---|---|
| 14 Mar 2017 | Microsoft released MS17-010 to fix critical SMB vulnerabilities (remote code execution). | Critical patch SLA (e.g., 14 days) + compliance reporting |
| 12 May 2017 | WannaCry outbreak spreads rapidly; NHS organizations experience operational disruption. | EDR/SIEM alerting + network isolation playbook |
| Post-incident | Public investigations highlight preventability and systemic weaknesses. | Risk register refresh + board dashboard + resilience roadmap |
For learning accuracy, this section references Microsoft’s MS17-010 notice and the UK NAO investigation (see references).
4) What Failed (Mapped to GRC Functions)
| GRC Function | Failure | What “good” looks like |
|---|---|---|
| Governance | Cyber risk metrics (patch SLA compliance, legacy OS count) not treated as board-level KPIs. | Board reporting: patch compliance %, critical vuln aging, legacy OS burn-down |
| Risk Management | Known vulnerability exposure not quantified; risk acceptance (if any) not clearly documented. | Risk register entry with inherent/residual scoring + documented risk acceptance |
| Compliance | Healthcare operational resilience requirements not enforced uniformly across organizations. | Minimum security baseline + compliance evidence + periodic audits |
| Control Assurance | Legacy OS, weak segmentation, and inconsistent patching increased blast radius. | Segmentation, SMB hardening, continuous vulnerability scanning, EDR |
| BCP/DR | Recovery readiness varies; operational disruption escalates quickly during ransomware. | Immutable/offline backups + tested restores + downtime runbooks |
6) What Could Have Prevented the Incident (Specific Controls)
| Control | Exact implementation | Type |
|---|---|---|
| Critical Patch SLA | Apply MS17-010-class patches within 14 days; auto-report exceptions; weekly “critical aging” report to CIO. | Preventive |
| Disable SMBv1 + reduce exposure | Disable SMBv1 where feasible; restrict TCP/445 internally with firewall rules; block externally entirely. | Preventive |
| Asset inventory + OS lifecycle | Maintain authoritative asset inventory; prohibit unsupported OS in production or isolate them with compensating controls. | Governance |
| Vulnerability scanning + remediation workflow | Weekly scans; ticketing for remediation; escalation if critical vulns exceed SLA; audit evidence retained. | Detective |
| Minimum security baseline | Hardening standards enforced (CIS-like); centralized policy; periodic compliance checks. | Governance |
Why these would work
Public sources confirm MS17-010 existed before the outbreak. With a strict patch SLA + visibility (KPIs), a large portion of susceptible systems would have been remediated before 12 May 2017.
Public sources confirm MS17-010 existed before the outbreak. With a strict patch SLA + visibility (KPIs), a large portion of susceptible systems would have been remediated before 12 May 2017.
7) How to Contain Damage (When Prevention Fails)
Illustration: Flat network vs segmented network
Segmentation limits propagation—especially for worm-capable ransomware using SMB lateral movement.
- EDR quarantine: isolate infected endpoints automatically when SMB scan/encryption behavior is detected.
- Kill switch / network shutdown protocol: pre-approved emergency actions to reduce spread.
- Immutable/offline backups: keep at least one offline or immutable copy; test restores quarterly.
- Rapid comms playbook: IT + operations + leadership align quickly; patient safety workflows activate.
9) Practice Exercises (For GRC Students)
How to use in class
Give students 30–45 minutes. Make them produce deliverables—not just answers: risk register entry, KPI dashboard, and a short board memo.
Give students 30–45 minutes. Make them produce deliverables—not just answers: risk register entry, KPI dashboard, and a short board memo.
| Exercise | Task | Expected Output |
|---|---|---|
| Exercise A | Create a risk register entry for “Unpatched SMB vulnerability exploited by ransomware worm” with inherent and residual scoring. | 1 complete register row + KRIs + owner + due date |
| Exercise B | Design a board dashboard with 6 KPIs that would have exposed the issue before the incident. | KPI list + thresholds + escalation rule |
| Exercise C | Write a 6–8 line executive memo explaining what happened and what investment is required. | Board memo draft (clear, non-technical) |
References (Public Sources)
Use these links to validate facts and to show students how to cite authoritative sources in GRC reporting.
- UK National Audit Office (NAO) — Investigation: WannaCry cyber attack and the NHS (HTML report page): nao.org.uk
- NAO PDF (same report): PDF download
- Microsoft — MS17-010 security update (March 14, 2017): support.microsoft.com
- Google Cloud Threat Intelligence — WannaCry leveraging EternalBlue + SMB/TCP 445: cloud.google.com
- NHS Digital Cyber Alert — SMB vulnerabilities used for malware propagation (MS17-010 related): digital.nhs.uk
- UK Parliament Public Accounts Committee — Cyber-attack on the NHS (PDF): parliament.uk PDF
Teaching note
When students present “what happened,” make them cite NAO/Microsoft sources. When they propose controls, make them tie each control to a GRC artifact: policy, KPI, audit evidence, and ownership.
When students present “what happened,” make them cite NAO/Microsoft sources. When they propose controls, make them tie each control to a GRC artifact: policy, KPI, audit evidence, and ownership.