4 ms·

Organizations should be legally prevented from being able to pay these ransoms and should instead receive funding to help them recover from the damages. It fund

Organizations should be legally prevented from being able to pay these ransoms and should instead receive funding to help them recover from the damages. It funds an entire industry that can just grow and grow because it pays off

JumpCrisscross 6y ago
> Organizations should be legally prevented from being able to pay these ransoms and should instead receive funding to help them recover from the damages Isn’t a simpler solution insurance? The insurance company becomes a specialist in pricing and reducing this risk. And the malware writers become, in effect, ersatz pen testers. Like a ban, you’re reducing the incidence rate. Unlike the ban, you’re extracting a public good from the ransom era’ work in the form of better infosec.
- deleted 6y ago
  [deleted]
- TedDoesntTalk 6y ago
  > Like a ban, you’re reducing the incidence rate. How does buying an insurance policy reduce the incidence of ransomeware?
  - sqrt17 6y ago
    The insurance policy would be tied to following some (infosec) best practices. In the best of all worlds, insurances would then check on their customers to make sure best practices are followed in the same way that we follow best practices for avoiding fires in terms of building construction and not having flammable materials lying around too much.
- bb2018 6y ago
  Right now - a lot of hacked organizations may just say "it's not worth the payout" but if they are already paying insurance then of course they are going to tell the insurance company its important and ask for the ransom to be paid. I think the bright spot of the ban would be that if it was legally enforced then all hackers would see this and quickly realize it wasn't worth the risk. (Not sure if I'm for this 100% - but I think it is worth considering)
  - MaxBarraclough 6y ago
    > if they are already paying insurance then of course they are going to tell the insurance company its important and ask for the ransom to be paid Interesting point. If this kind of insurance became widespread, that would be great news for the attackers.
- waihtis 6y ago
  Insurance companies still have a lot of trouble pricing and selling cyber insurance. Ransomware is a bit of a outlier here, being the most popular category of cyber insurance and all, but it seems to still be difficult for insurers to price their premiums. It's mostly because there aren't a lot of good measurements for assessing how likely a company is to get hacked / hit by RW (I'm not a believer in infosec through Q&A / self-assessment). These are of course growing pains and especially for SMB some form of insurance + cybersecurity tooling basics will be the dominating approach to managing cyber risk.
- devonkim 6y ago
  Software purchasers in a lot of enterprise IT are contractually and legally required to carry such insurance in the US. The problem is that the organizations usually impacted are similar to people refusing to pay for car insurance - ones that keep trying to skimp on security so much for legit budgetary reasons (small town police departments come to mind) or because they are institutionally so incompetent and covering it up (Equifax) auditors and actuaries would have trouble pricing their insurance correctly.
renewiltord 6y ago
There's an easier way that forces them to behave in this manner: poison the well by releasing ransomware en masse, receiving the money, and then not releasing the data. Once the well is sufficiently poisoned, no victim has an incentive to participate. They don't know if they're paying a defector or a cooperator. No state can take this action. Any hero who does so will be prosecuted. But if they /dev/null their bitcoin address private key, they can rest easy that what they did was purely selfless.
- tzs 6y ago
  The ransomeware makers can counter that by making their ransomware divide the victim’s data into a very large number of separately encrypted sections each using a different key. Then instead of trying to sell the victim one key for a million dollars they would offer say 100000 keys at $10 each. Now it only costs the victim $10 to pick a random section and buy its key. If that works they can pick another and buy it’s key, and so one until they are confident the seller can be trusted and they can then buy the remaining keys.
  - TwoBit 6y ago
    Perhaps, but fakers can do that too. Also I expect that the actual effective cost of the individual keys - especially the first - would be more than $10.
    - D2187645 6y ago
      Let them unlock until they hit half point, but leave the rest unlockable.
  - londons_explore 6y ago
    Practically, this is how all these ransomwares work in big organisations... It's usually ~$1000 per machine. Sometimes more for machines with big disks or depending on which active directory groups they're in. That tells you that UCSF paid for data recovery on 1000+ machines probably...

JumpCrisscross 6y ago

> Organizations should be legally prevented from being able to pay these ransoms and should instead receive funding to help them recover from the damages Isn’t a simpler solution insurance? The insurance company becomes a specialist in pricing and reducing this risk. And the malware writers become, in effect, ersatz pen testers. Like a ban, you’re reducing the incidence rate. Unlike the ban, you’re extracting a public good from the ransom era’ work in the form of better infosec.

deleted 6y ago
[deleted]
TedDoesntTalk 6y ago
> Like a ban, you’re reducing the incidence rate. How does buying an insurance policy reduce the incidence of ransomeware?
- sqrt17 6y ago
  The insurance policy would be tied to following some (infosec) best practices. In the best of all worlds, insurances would then check on their customers to make sure best practices are followed in the same way that we follow best practices for avoiding fires in terms of building construction and not having flammable materials lying around too much.
bb2018 6y ago
Right now - a lot of hacked organizations may just say "it's not worth the payout" but if they are already paying insurance then of course they are going to tell the insurance company its important and ask for the ransom to be paid. I think the bright spot of the ban would be that if it was legally enforced then all hackers would see this and quickly realize it wasn't worth the risk. (Not sure if I'm for this 100% - but I think it is worth considering)
- MaxBarraclough 6y ago
  > if they are already paying insurance then of course they are going to tell the insurance company its important and ask for the ransom to be paid Interesting point. If this kind of insurance became widespread, that would be great news for the attackers.
waihtis 6y ago
Insurance companies still have a lot of trouble pricing and selling cyber insurance. Ransomware is a bit of a outlier here, being the most popular category of cyber insurance and all, but it seems to still be difficult for insurers to price their premiums. It's mostly because there aren't a lot of good measurements for assessing how likely a company is to get hacked / hit by RW (I'm not a believer in infosec through Q&A / self-assessment). These are of course growing pains and especially for SMB some form of insurance + cybersecurity tooling basics will be the dominating approach to managing cyber risk.
devonkim 6y ago
Software purchasers in a lot of enterprise IT are contractually and legally required to carry such insurance in the US. The problem is that the organizations usually impacted are similar to people refusing to pay for car insurance - ones that keep trying to skimp on security so much for legit budgetary reasons (small town police departments come to mind) or because they are institutionally so incompetent and covering it up (Equifax) auditors and actuaries would have trouble pricing their insurance correctly.

renewiltord 6y ago

There's an easier way that forces them to behave in this manner: poison the well by releasing ransomware en masse, receiving the money, and then not releasing the data. Once the well is sufficiently poisoned, no victim has an incentive to participate. They don't know if they're paying a defector or a cooperator. No state can take this action. Any hero who does so will be prosecuted. But if they /dev/null their bitcoin address private key, they can rest easy that what they did was purely selfless.

tzs 6y ago
The ransomeware makers can counter that by making their ransomware divide the victim’s data into a very large number of separately encrypted sections each using a different key. Then instead of trying to sell the victim one key for a million dollars they would offer say 100000 keys at $10 each. Now it only costs the victim $10 to pick a random section and buy its key. If that works they can pick another and buy it’s key, and so one until they are confident the seller can be trusted and they can then buy the remaining keys.
- TwoBit 6y ago
  Perhaps, but fakers can do that too. Also I expect that the actual effective cost of the individual keys - especially the first - would be more than $10.
  - D2187645 6y ago
    Let them unlock until they hit half point, but leave the rest unlockable.
- londons_explore 6y ago
  Practically, this is how all these ransomwares work in big organisations... It's usually ~$1000 per machine. Sometimes more for machines with big disks or depending on which active directory groups they're in. That tells you that UCSF paid for data recovery on 1000+ machines probably...