Negotiating Ransom: To Pay Or Not?

Ransomware is one of the key cyber security threats that faces business and the cyber criminals behind it are becoming more dangerousOver the past eighteen months there has been a surge of ransomware attacks, made more disruptive by the complications of Coronavirus.  

From the criminals’ point of view, ransomware is massively profitable and a relatively easy exploit to accomplish. According to the European Union Agency for Cybersecurity (ENISA) 45 percent of victim organisations pay the ransom.

In December 2020, the acting head of the US Cybersecurity and Infrastructure Security Agency (CISA) said that ransomware was “quickly becoming a national emergency,” and it now effects most countries and corporates. In Britain, Lindy Cameron, newly appointed the chief of the British National Cyber Security Centre (NCSC) says her agency is committed to tackling the threat of ransomware and "supports victims of ransomware every day" but that a coordinated response is required to combat the growing threat. 

Speaking earlier this month, Lindy Cameron said "For the vast majority of UK citizens and businesses, and indeed for the vast majority of critical national infrastructure providers and government service providers, the primary key threat is not state actors but cyber criminals." She also noted that the ecosystem is evolving through the Ransomware as a Service (RaaS) model, whereby ransomware variants and commodity listings are available off the shelf for a one-off payment or a share of the profits.

Many analysts were surprised at how quickly the attack victim paid the $4.4 million ransom demanded when the US Colonial Pipeline was struck with ransomware recently, although much of the money extorted has since been recovered by the FBI.

The Colonial Pipeline CEO Joseph Blount told US lawmakers that although his company had an emergency-response plan in place, it didn’t include plans for responding to a ransomware attack.  However, the company did have insurance to pay for ransomware attacks, so the decision to pay was swift. A ransomware notice first appeared on a machine in Colonial Pipeline’s control room around 5 a.m. on May 7th and by 6 a.m. the company had shut down its 5,000-mile pipeline, Blount testified. 

By 7 a.m. the company had contacted outside legal counsel and engaged digital investigations firm FireEye to begin a forensic assessment of the damage. By late afternoon the same day, Blount decided to pay the ransom and on May 8th the money was sent.

The FBI advises victims to avoid negotiating with hackers, arguing that paying ransoms incentivises criminal behavior. This puts victims in a tricky position. “Regardless of whether you or your organisation have decided to pay the ransom, the FBI urges you to report ransomware incidents to law enforcement. Doing so provides investigators with the critical information they need to track ransomware attackers, hold them accountable under US law, and prevent future attacks”, says an FBI report.

The rise in ransomware as a business for criminals has produced a parallel rise in companies engaged in helping victims negotiate ransoms and recover the money extorted. 

Negotiating ransoms is a fraught process that can take more than a week and change rapidly, depending on the demands of the extortionists and the condition of the victim’s backups, according to Bill Siegel, CEO and co-founder of Coveware, a company that negotiates ransomware payments for victims. Coveware also aggregates statistics and other data about ransomware incidents to help the government track the scourge. Siegel told The New Yorker that Coveware has negotiated a “few thousand” ransomware cases since 2018 and that each case is different..

Siegel declined to discuss his customers or the specifics of negotiations, to avoid giving ransomware actors insight into negotiating tactics. Handling one of these negotiations is not easy and often goes five or seven days, it typically means that the company isn’t sure if they actually need to pay or not.

If an organisation has to pay very fast, it’s typically because they know they have no other means to recover.

The issue for most organisations is that they have not properly configured a backup if they suffer a ransomware attack. A server that gets impacted with ransomware has to be, at a minimum, heavily remediated to ever be trusted again. The best practice is to establish a clean backup network where you can re-image all of the servers, re-install all of the applications and then, for the data,  upload uncontaminated backups that you can restore to the backup network servers. To determine if files will decrypt properly you need to do scans on all of the encrypted files to look at the integrity of the encryption. A properly encrypted file will normally properly decrypt. 

A major aspect of the he Colonial Pipeline outage is that it had cascading effects that the company had no direct control over - the reaction of consumers - who started panic-buying and hoarding fuel.  Even though there wasn’t actually a fuel shortage, people created a fuel shortage from panic.

This is a compelling example of the follow-on effects that might not anticipated in an emergency and which that can put pressure on organisations to pay the ransom.

NCSC:    FBI:     Zero Day:    New Yorker:     ENISA:     SHRM:    ZDNet:   CloudsavvyIT:     Schnier On Security:

Image: Unsplash

You Might Also Read:

Running Out Of Cyber Gas

Will Governments Ban Ransom Payments To Hackers?:

 

 

« DarkSide May Not Stay Dark For Long
Global Police Operation Closes Fake Pharma Websites »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BlueVoyant

BlueVoyant

BlueVoyant helps organizations to meet increasingly sophisticated cyber attack techniques head-on with real-time threat intelligence and managed security services.

OneVisage

OneVisage

Our award-winning 3DAuth digital identity platform turns any consumer mobile device into a real-time 3D facial scanner that securely authenticates the user in seconds.

Leadcomm

Leadcomm

Leadcomm is a Brazilian company focused on the distribution and integration of IT systems and security solutions for large companies.

Cybersecurity Professionals

Cybersecurity Professionals

Search vacancies from top cyber security jobs worldwide on CyberSecurity Professionals. View IT security jobs or upload your CV to be seen by recruiters from industry leading firms.

C11 Cyber Security & Digital Innovation Centre

C11 Cyber Security & Digital Innovation Centre

C11 is working with local and national partners to develop talent and bring brilliant minds and brilliant businesses together.

SterlingRisk Programs

SterlingRisk Programs

SterlingRisk’s Cyber practice brings experience working with a wide array of clients across a broad spectrum of industries.

Bolster

Bolster

Bolster (formerly RedMarlin) is an AI-based cyber-security platform designed to detect phishing and fraudulent sites in real-time.

iTechArt Group

iTechArt Group

iTechArt is a top-tier custom software development company offering Cybersecurity Consulting, Application Security Testing, Risk Management and Compliance, and Infrastructure Security services.

Reliance Cyber

Reliance Cyber

Reliance Cyber (formerly Reliance ACSN) help to monitor and manage your organisation’s security infrastructure 24/7, so you can make sure all threats and issues are dealt with.

Seigur

Seigur

Seigur is an IT consultancy business providing flexible legal and cyber security services for IT and data privacy programmes.

Eunetic

Eunetic

Eunetic IT security solutions - we secure your websites, emails, domains and data.

Inspectiv

Inspectiv

Inspectiv offers a turn-key solution to continuously identify security vulnerabilities and provide security assurance.

VC3

VC3

VC3 provides a full range of Information Technology Solutions and Services to hundreds of municipalities and organizations throughout the USA.

Armolon

Armolon

Armolon provides comprehensive data breach and cybersecurity, as well cybersecurity audits and certifications, and disaster recovery/business continuity services to clients.

Qeros

Qeros

Qeros is a next-generation distributed system enables secure data and transaction processing at the velocity of thought.

Coastline Cybersecurity

Coastline Cybersecurity

Coastline Cyber is a cybersecurity consulting firm dedicated to helping organizations strengthen their security posture by reducing risks, mitigating threats, and protecting against attacks.