I never intended to become a ransomware negotiator. But a year and a half ago, we notified a ransomware victim that their corporate data was about to be released on a dark web “shame site” for all to see, and they pulled me in as the lead troubleshooter. Following that, more cases followed and today it’s turned into a deluge. Now I tend to show up a lot in the media as “the guy who talks to ransomware bad guys.” It’s not a job I want or particularly enjoy.
We’ve learned a lot since that first case. And I’ll put it bluntly — the bad guys are not using very sophisticated techniques in their attacks. In fact, they’re using the same old tricks they’ve used for a long time. Only instead of just stealing data (remember those “good old days?”), they’re breaking into corporate networks and unleashing ransomware.
What bothers me most is how preventable this all is. In fact, like current COVID-19 deaths, it’s at least 99.2% preventable. “Vaccinating” a company against ransomware isn’t expensive or technically daunting — yet companies fail at simple cyber hygiene and put their businesses, our critical infrastructure, and sometimes even people’s lives, at risk.
Unfortunately, the discussion around ransomware today has largely been boiled down to the question: “Should companies pay ransom?” The FBI’s guidance says “no.” But if you’re a small business that will go under in a few days if you can’t get your systems back online, that kind of blanket guidance isn’t really useful or practical. Even more disturbing, several states are now considering making ransom payments illegal — this is a classic “punish the victim” approach that we saw fail so spectacularly with the War on Drugs.
The ransomware epidemic will stop when people stop resisting the ransomware vaccine — simple cyber hygiene. For example, studies show that more than 80% of last year’s ransomware attacks focused on something called “remote desktop protocol (RDP).” Companies are not implementing simple security controls on RDP, and the threat actors are exploiting it. Fixing that alone would substantially reduce the number of “soft targets” for ransomware attacks (and ransomware actors like soft targets — they’re easy money. So every company should strive to not be “low-hanging fruit.” Not a big ask!).
Implementing multi-factor authentication (which we all know from our online banking logins) would further harden us against ransomware — yet most companies still haven’t done that. Finally, enforcing internal policies around strong passwords and banning the use of those passwords on personal accounts would effectively fully vaccinate organizations from ransomware. Three steps; 99.2% protection. It’s that simple. (Colonial Pipeline would only be in the news for pumping oil had they done these three simple things.)
Government can play a constructive role in this process. In fact, if a fraction of the resources expended on COVID-19 vaccination promotion were devoted to a government-subsidized program focused on the prevention and repair of ransomware attacks, it would make a real difference. This type of program could provide organizations with the know-how to stave off attacks, and, in the event someone is infected with ransomware, it could provide financial support and other resources to help businesses come back online without paying ransoms.
It’s really not complicated: If you want people to stop paying ransoms, give them a way to do it without going out of business. This is something the government can do. There would be collateral benefits to this type of program as well — for example, U.S. companies and assets would be better protected from foreign government cyber operations seeking to steal our intellectual property and damage our economy.
I never wanted to be in the business of ransomware negotiation. In fact, nothing would make me happier than to see that job disappear. But if we keep focusing on the wrong questions (pay or don’t pay? Should we launch offensive cyberattacks? etc.), we’ll never end the ransomware pandemic.
Kurtis Minder is the co-founder and CEO of GroupSense (Twitter: @GroupSenseCyber), a cybersecurity company, and one of the top ransomware negotiators in the country.