THE RANSOMWARE DEBATE
To pay or not to pay, that is the question. That statement underpins the ransomware debate. But what other options are there and what are the ramifications of reluctantly coughing up the ransom. Take some time now to explore your options regarding your cybersecurity and a potential ransomware attack.
THE ORIGIN OF RANSOMWARE – THE STRANGE STORY OF POPP
Ransomware had its origins way back in 1989 when Harvard-taught evolutionary biologist, Dr. Joseph Popp, created the Aids Trojan. The malware displayed a message claiming that the user’s license to use some specific software had expired. To be able to access the software again, the user was required to pay ‘PC Cyborg Corporation’ the sum of $189. Ironically, paying the ransom wasn’t necessary since the decryption key could be extracted from the code of the Trojan. Why Popp, who was conducting AIDS research at the time, did this, nobody knows. He was arrested in Amsterdam and sent back to the United States and then extradited to the UK to stand trial. Before the trial, Popp exhibited increasingly bizarre behaviour, including wearing condoms on his nose, a cardboard box on his head, and putting curlers in his beard to ward off the threat of radiation. In November 1991 the court determined that Popp was unfit to stand trial.
FAST FORWARD TO 2021
The United States Justice Department stated this year that 2020 was the worst year to date for ransomware attacks. Instead of $189, cybercriminals are now demanding six- or seven-figure ransoms of victimized businesses. Ransomware has become a lucrative business model having many constituent parts including developing malware code and operational software, executing the attack based on preattack intelligence acquisition, negotiating the ransom, and even providing the victim with technical support for the data recovery process. Lisa Ventura, CEO of the UK Cyber Security Association stated that ransomware attacks grew exponentially by 150% in 2020 and show no sign of slowing down. She said:
“The volume of attacks makes ransomware the most impactful threat that we currently face.”
WHY THE RANSOMWARE DEBATE?
That said, why the ransomware debate? In our fast-moving technological world, we all need our data to function, and if it is kidnapped, then we need to ensure its safe return. Therein lies the rub, as Hamlet would have said. If you pay, there is no guarantee that your data and applications will be in the same condition as before they were held hostage. Ciaran Martin, a Professor at the Blavatnik School of Government at Oxford University, says:
“Ransomware is usually very serious but not always an existential threat and rarely a threat to life, paying often means getting an only moderately effective decrypter key and you still have to run it on battered systems in need of repair.”
THE RANSOMWARE DEBATE – WHAT ARE THE OPTIONS?
Other than forking out thousands or millions what can you do? Research conducted by Talion which founded the #RansomAware initiative, determined 79% of cybersecurity professionals were in favour of making payments illegal. Talion principal threat analyst Mitchell Mellard admits there are many parts to the ransomware debate, and stated:
“I don’t think the option of payment should be shelved but it should be regulated. Limit it to instances where the network or dataset is critical, such as a hospital or critical infrastructure.”
CYBER INSURANCE
One option is to take out cyber insurance against ransomware attacks. However, in essence, this only adds fuel to the fire. The insurer pays, giving hackers more resources to develop new tools, the opportunity for underground recruitment, and the purchase of leaked credentials and exploits. All this is likely to make the next attack successful and so the cycle continues.
Ian Thornton-Trump, a researcher at a threat intelligence provider, says
“In virtually all of the thousands of cases of ransomware attack I’ve researched, successful attacks can be broken down into the failure of staff, a flaw in a process or a failure of security technology.”
PREVENTION IS BETTER THAN CURE
Trump’s owns carry a great deal of weight. Hackers will only succeed if we let them. Zhero can help educate your staff on sound cybersecurity practices, including the do’s and don’ts of password management, email security and phishing, data backup, and everything to keep your data and that of your clients safe and sound. Don’t debate ransomware. Contact Zhero today.
