Deal with ransomware the way police deal with hostage situations

clicks | 14 days ago | comments: discuss | tags: bitcoin

Article preview (bot search)

(Original link:

Russia deploys military assets to Italy to help in fight against virus Deal with ransomware the way police deal with hostage situations
When faced with a ransomware attack, a person or company or government agency finds its digital data encrypted by an unknown person, and then gets a demand for a ransom.
As that type of digital hijacking has become more common in recent years , there have been two major ways people have chosen to respond : pay the ransom, which can be in the hundreds of thousands of dollars, or hire computer security consultants to recover the data independently.
Those approaches are missing another option that we have identified in our cybersecurity policy studies . Police have a long history of successful crisis and hostage negotiation - experience that offers lessons that could be useful for people and organizations facing ransomware attacks.
Understanding the problem
In the first nine months of 2019, more than 600 U.S. government agencies - including entire municipal governments - suffered ransomware attacks. Louisiana Governor John Bel Edwards was forced to declare a state of emergency following ransomware attacks on state government servers that caused widespread network outages at many state agencies , including the Office of Motor Vehicles and the departments of Public Health and Public Safety.
Many of those victims chose to pay the ransom demanded by whoever hijacked their data. Lake City, Florida, for instance, paid US$460,000 to unlock its data.
Other targets, like the city of Baltimore, chose to fight back instead of paying the ransom. Rather than handing the attackers the $76,000 they demanded, Baltimore paid more than $10 million to purchase new equipment and absorbed more than $8 million in lost revenue from taxes and fees that went unpaid while systems were down.
Those moves were in line with FBI advice saying that paying the ransom could increase the likelihood of additional attacks, both on previous targets and new ones.
More recently, the FBI has softened its stance to open the door to the paying of ransom in certain cases, but to always report doing so to law enforcement. Although the agency still underscores that paying a ransom does not guarantee that the encrypted files will be recovered, or that the victim will not be targeted again, it does recognize that " all options " should be considered in these cases.
Preventing ransomware
The best protection against ransomware is prevention .
Learn, and teach your coworkers and employees, how best to protect yourselves , both personally and professionally, from hackers. Keep software up-to-date with the latest security upgrades .
In addition, ensure your data is backed up regularly . That way, if a ransomware attack happens, the victims can get professional help removing the malware from their systems, restore their data and move on.
Many companies have purchased insurance coverage to help pay the costs of recovering from ransomware - but some of those policies also include paying ransoms in the event of an attack.
Getting the data back isn't a sure thing. Of the organizations that have paid the ransom, 20% haven't actually recovered their data.
That presents victims with the certainty of spending some amount of money - whether it's a ransom payment or a bill for a cybersecurity specialist - and not necessarily getting their data back.
An opportunity to engage
We have found another approach that could reduce the amount of money spent and simultaneously increase the certainty of data recovery.
Negotiating with hostage takers is tricky business, both online and offline. But many cybercriminals are often willing to bargain over the price of a ransomware payout. In fact, nearly three out of four ransomware hackers would return stolen data for a discounted price .
With cybercrime overall - of which ransomware is a large and growing component - slated to cost the global economy $6 trillion a year by 2021, the opportunity to lower costs could be very valuable. For people or organizations without insurance coverage, there is little to lose by trying.
When a ransomware attack begins, affected computers' screens normally announce the attack, include a demand for payment, and show a countdown clock, after which, allegedly, the hijacked data will become irretrievable.
That time is a window of opportunity to negotiate with the attackers. Usually, ransomware attackers require their victims to buy bitcoin , a form of digital currency , in order to pay the ransom. Most people don't know how to buy bitcoin in the first place, so often an attacker has to teach the victim what to do. This opens a channel of communication between the victim and the attacker, which is analogous to the starting point police experts use to defuse hostage situations.
Negotiating with cybercriminals
In general, the less the victim knows about how to purchase bitcoin, the more time the victim has to build up rapport and trust with the cybercriminal. During a negotiati...