Ransomware attacks remain a continuing threat to organisations as ransomware gangs introduce new strains which make them difficult to defend against.
http://cyberbrokers.co.uk/ransomware-is-still-a-real-threat/
With ransomware attacks comes the inevitable ransom demand. These demands in the early days were only a few hundred dollars and this has now developed into a multimillion dollar business for hackers.
Ransomware as a service (RaaS) is a subscription based model that allows other hackers to use already developed ransomware tools to carry out ransomware attacks.With this brings an increase in attacks together with an increase in the threat landscape and of course the actual ransom.
Should the ransom be paid?
Every organisation will have their own views on this and whether the ransom should be paid to the hackers or not. The type and severity of the ransomware attack will be the main factor as to how the organisation will wish this to play out.
What also is at stake – is it theft of data , is it loss of manufacture or it the use of the company website? All will have some form of financial implication.
Are there back-ups in place , are these isolated from the network and are these still secure ?
The role of insurance
If cyber insurance is in place the policyholder will advise their insurers of the attack and they will appoint a forensic investigator and a ransom ware specialist from their vendor panel.
These two parties will ascertain the extent of the incident and also as to whether there is collateral damage in that a sideways attack has taken place where data is already being extrapolated and in place to be distributed on the Dark Web or the public domain.
The decision to pay
If the position is that the data cannot be retrieved through back-up or it is not possible to return the business to near normal functionality it may be necessary to pay the ransom.
Some of the possible implications of paying this are as follows:-
The hackers will not provide the encryption code
The data still not be released
A further ransom could be demanded
Paying the ransom
If cyber insurance is in place the specialist ransomware vendor will organise the ransom payment to the ransomware gang in Bitcoin currency via a Bitcoin account set up on the business’s behalf.
As a result of the high incident of ransomware attacks there are signs that cyber insurers are restricting coverage. A number of insurers are introducing coinsurance but recently Axa in France have decided not to provide coverage for the payment of ransoms for policyholders in France.
Long term effects of paying the ransom
- The hackers could return to make subsequent ransom demands
- The business could gain a reputation for paying a ransom and other ransomware gangs will try their luck
- The original malware planted remains in the network and hackers return to exploit any vulnerabilities
The payment of a ransom following a ransomware attack is likely to be the last resort of a business but if robust cyber security is in place it provides every chance of having to succumb to the demands of hackers.
Image : Shutterstock
