By Barry Coatesworth, Guidehouse, Director - Risk
Last year, CNA Financial Corporation, one of the biggest US insurance companies reportedly paid hackers$40 million following a ransomware attack, while Colonial Pipeline paid hackers $4.4 million for a decryption tool to restore its operations. This was despite the FBI and the Department of Homeland Security recommending that companies not pay the ransom. In 2021, the average mitigation cost of a ransomware attack was $1.85 million, with organizations and companies experiencing 21 days of downtime on average following an attack, and 80% of victims who paid a ransom experiencing another attack soon after. The question is what your organization will do if it is attacked by ransomware. Will you pay for data or system recovery? Should you pay? What happens if you pay?
What happens if you pay?
Theoretically, if organizations pay the ransom, the attackers will provide a decryption tool and withdraw the threat to publish stolen data. However, payment doesn’t guarantee all data will be restored. On average, only 65% of data was recovered, and only 8% of organizations recovered all data. Some experts say that 80% recovery is the best you can hope for. And if the encryption keys work, there's still a lot of work to be done. Data recovery can take weeks, especially if most of it is encrypted. For example, HSE, the Irish health service still needs the support of the Irish Defence Forces to restore systems. Two months after the initial attack, only 3,933 servers out of 4,891 were recovered and only 69,000 out of 83,000 affected devices were cleaned up. The main reasons why businesses pay ransoms are:
What are the potential legal and commercial risks of paying ransoms?
While committing a ransomware attack is clearly criminal activity, it is generally not a crime to pay a ransom note unless the payer knows or reasonably suspects that there is a connection to terrorism or that it would violate sanctions regimes. In April 2021, the United States imposed sanctions against 32 Russian organizations and officials involved in cybercrime “and other acts of disinformation.” These sanctions are said to have been partly in response to a series of cyberattacks, including the attack on SolarWinds Corporation. Understanding whether is is okay to pay a ransom is further complicated by increased sanctions imposed on Russia for invading Ukraine.
In addition, new legislation introduced in early 2022 known as “The Strengthening American Cybersecurity Act” also requires notification from critical infrastructure owners to report if they have made a ransomware payment. This “hard reality” perspective is reflected in recent changes made to the FBI’s official guidance on ransomware threats. “...the FBI understands that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers.” However, paying a ransom can be risky business for several reasons, including:
What happens if you do not pay?
You find yourself in the very same position the ransomware attacker first put you in by encrypting all your files to “twist your arm” into paying. Depending on what kind of ransomware infection you have, there is some possibility that a decryptor already exists for that particular strain; less likely, but not unheard of, is the possibility that an experienced analysis team may discover a way to decrypt your files. A lot of ransomware is poorly written and poorly implemented. It may be that all is not lost as it first might seem. Projects like NoMoreRansom can be a very valuable resource when evaluating a course of action if faced with a ransomware attack. If your data backup system is robust you are in a much better position to rebuild your environment, and it may not be as painful to move forward without paying.
Prepare now
Organizations cannot prevent every possible ransomware attack. The best thing you can do is assume you will be hit and have plans in place that enable a quick response. This is the perfect time to double down on your cybersecurity posture. It’s a great idea to have an independent company perform a cyber resilience review to determine the current risk to your environment. This includes running through exercises about what happens when an attack occurs. Doing so may reveal unexpected problem areas. For example, one organization found that it took much longer than anticipated to write a press release about an attack, highlighting the need for a pre-written statement. It’s also important to strengthen backups and test restores forall critical businesses.
Assuming the backups work, the cost of recovery will always be less than paying the ransom for an uncertain outcome. Furthermore, make sure executives are fully briefed on the topic and involved in decisions. The more they understand the risks, the better prepared they will be to decide and justify it in the face of scrutiny. Treat ransomware as a business decision. If the problem is visible across the organization, there will be fewer surprises if you do get hit. This will facilitate more informed decision-making in the response, including deciding whether you should pay. Sources:
https://www.cybereason.com/hubfs/dam/collateral/ebooks/Cybereason_Ransomware_Research_2021.pdf https://www.coveware.com/blog/ransomware-marketplace-report-q4-2020 https://www.hhs.gov/sites/default/files/ransomware-trends-2021.pdf https://www.exclusive-networks.com/uk/wp-content/uploads/sites/28/2020/12/Ransomware.pdf
Latest News
AI workplace tool sparks selloff in...
By Editorial Panel, Editor, GRC Outloo...
