7 ms·

Put yourself in the shoes of business. Well, like the oil company now in USA. Lets say you haven't learn the lesson of backup importance. Your business has st

by jve 5y ago

Put yourself in the shoes of business. Well, like the oil company now in USA. Lets say you haven't learn the lesson of backup importance. Your business has stopped. Your ONLY way to recover and restore revenue stream is to get the data. You are aware that paying ransom may or may NOT work. Now, what do you do? The suggestions (cut the attackers revenue stream) may sound very right, correct and whatnot. But think of the side that is held as hostage.

hawk_ 5y ago
Businesses can't expect claims for theft insurance to be honored if they didn't take reasonable measures (install security cameras, alarms etc... and lock the valuables). How is this different?
- jve 5y ago
  Agree. Not arguing about not having insurance. Just saying that paying the ransom may be the only way out of trouble.
mjevans 5y ago
You can't trust a compromised system. It has to be purged and rebuilt from the ground up. I really miss the days of write-enable jumpers for BIOSes...
nobodyandproud 5y ago
Did the business follow best security practices? Did it do its due diligence to harden against attacks? Why should insurers pay, when businesses have no incentive to do this?
- hlasdjlfhalwjk 5y ago
  If you follow security best practices, you have append-only backups that you can use to restore the encrypted data and don't need insurance at all...
  - yodelshady 5y ago
    If the ransomware operators follow best practices, their C2 is in those backups too. The data's not encrypted, but without good IT, not for long. Maybe go two weeks' back and you'll get a clean instance, but that's two weeks' data loss, I've seen (non-tech) institutions hit where an hour of data loss is worth paying a ransom for.
    - StavrosK 5y ago
      Why is your data executable?
      - yodelshady 5y ago
        I'm really not sure that has a serious answer. https://en.wikipedia.org/wiki/Infrastructure_as_code https://en.wikipedia.org/wiki/Infrastructure_as_code https://en.wikipedia.org/wiki/Virtual_machine https://en.wikipedia.org/wiki/Virtual_machine https://en.wikipedia.org/wiki/Disk_image https://en.wikipedia.org/wiki/Disk_image https://en.wikipedia.org/wiki/Shadow_IT https://en.wikipedia.org/wiki/Shadow_IT https://en.wikipedia.org/wiki/Von_Neumann_architecture https://en.wikipedia.org/wiki/Von_Neumann_architecture Separation of code and executables is a nice idea that approximately 0% of organisations fully adhere to.
        fouric 5y ago
        > https://en.wikipedia.org/wiki/Infrastructure_as_code https://en.wikipedia.org/wiki/Infrastructure_as_code > "definition files" Not executable. Text. Readable by humans. Inspectable by humans so you can root out rootkits. Not even the valuable data that cyber criminals go for anyway - they go for personal and financial data, not k8s config files. > https://en.wikipedia.org/wiki/Virtual_machine https://en.wikipedia.org/wiki/Virtual_machine > https://en.wikipedia.org/wiki/Disk_image https://en.wikipedia.org/wiki/Disk_image Neither of those are relevant. You don't back up virtual machines or image disks - you take afore-mentioned plain-text, audited config files and spin up new instance from scratch. > https://en.wikipedia.org/wiki/Shadow_IT https://en.wikipedia.org/wiki/Shadow_IT If those are actually shadow IT, they won't be in the backups anyway. > https://en.wikipedia.org/wiki/Von_Neumann_architecture https://en.wikipedia.org/wiki/Von_Neumann_architecture This is irrelevant snark. If you back up a data file, it doesn't matter that it's stored in the memory of a Von Neumann architecture - it's only going to be used as a data file. > Separation of code and executables is a nice idea that approximately 0% of organisations fully adhere to. Citation needed. Also, you just said: > If the ransomware operators follow best practices ...so are we considering the ideal case, or not? > I'm really not sure that has a serious answer. Being snide is bad by itself, but it's even worse when you're wrong on top of it.
waihtis 5y ago
You can still pay the ransom, the insurer will just not reimburse it.
viraptor 5y ago
> You are aware that paying ransom may or may NOT work. The ransomware campaigns are pretty good on support. You will get a key for a sample of your data as a proof. You can sometimes pay progressively to get more trust. Getting your data back is just as important for the criminals as encrypting it in the first place - otherwise their business goes down.
- jve 5y ago
  Oh, good to know they provide support. I just remember some ransom (was it notpetya?) that had a broken "pay" thing or some invalid mail... anyway, you couldn't get the key. And encryption your data doesn't help if you don't have backups. Edit: Here is the story: https://www.theverge.com/2017/6/27/15881110/petya-notpetya-paying-ransom-email-blocked-ransomware https://www.theverge.com/2017/6/27/15881110/petya-notpetya-p... So email provider blocked their email...
  - fouric 5y ago
    > And encryption your data doesn't help if you don't have backups. Actually, it does. "We'll delete your data." is not the only ransomware threat - the other one that's not quite as big, but growing, is "We'll leak your data." Backups prevent denial. Encryption prevents dissemination.
rawtxapp 5y ago
To play the devil's advocate, in an ideal world, you go out of business and another business that actually followed security best practices takes over. Over time, companies start taking security more seriously. When it affects the users, they can just ignore, business as usual. But now, they can't just go on with their days, so that's the real accountability in my opinion.
paxys 5y ago
This is why you need government intervention. Just make it illegal to pay such ransoms. Now the easy option has disappeared. You likely go out of business, and the company which takes your place implements good security policies from the get go. Funding for hacker groups and newer attacks dries up. Sucks for you in particular, but the public overall is better for it.
- nickpp 5y ago
  Sure, just like when you have 5 sick people, each needing a different organ to survive. We need the government to select a healthy person, take his organs and save the other 5. Sucks for that person in particular, but the public overall is better for it.
  - fauigerzigerk 5y ago
    It's more like banning the purchase of organs on the black market if you suffer organ failure.
  - contravariant 5y ago
    Somewhat interesting that you use an argument against utilitarianism to argue against deontological ethics.
    - nickpp 5y ago
      Government intervention is government intervention no matter the context: it seems a good idea at first but it always backfires.
      - contravariant 5y ago
        To govern is to intervene, if a government doesn't intervene then what purpose does it have?
  - m3at 5y ago
    Interesting argument, though forcefully selecting a donnor does not increase organ failure rates for others, whereas paying ransom does increase risks of future attacks.
hnbad 5y ago
Have the government bail them out by buying them out, then collectivize the company. If your company is too big to fail, maybe it shouldn't be controlled by profit-optimizing external shareholders and reckless directors. If it isn't too big to fail and can't get a loan the usual way to pay for the ransom (or better: data recovery), just let it go bankrupt like any other company making a costly mistake.
oneplane 5y ago
> Now, what do you do? You quit and go do something else. It's not like your life ends when a company ends. In a less sarcastic tone: this is where your DRP and BCP get involved, and if you don't have those at that scale, then you were doomed from the start anyway and your existence as a company was on a short lifespan to begin with.
- vianneychevalie 5y ago
  For other readers : DRP is "Disaster Recovery Plan" and BCP is "Business Continuity Plan".
PoignardAzur 5y ago
You can still have your assurance pay the cost of setting your revenue stream back up the hard way. As long as the money isn't going to the criminal groups.
paul_f 5y ago
The one company that I know personally that was hit by ransomware, and paid off the attackers, managed their own backups Which were encrypted as well. IMO, it's not just the importance of backups, but of having third party, redundant, off-site backups.
- kogepathic 5y ago
  > IMO, it's not just the importance of backups, but of having third party, redundant, off-site backups. If your backups do not already include the above, then it is not a viable backup strategy.
wglb 5y ago
The chance of actually getting the data back are not that good https://www.msspalert.com/cybersecurity-research/71-ransomware-victims-unable-to-restore-all-data/ https://www.msspalert.com/cybersecurity-research/71-ransomwa...
- wglb 5y ago
  Or perhaps it is worse than that: https://www.forbes.com/sites/daveywinder/2021/05/02/ransomware-reality-shock-92-who-pay-dont-get-their-data-back/?sh=2758df29e0c7 https://www.forbes.com/sites/daveywinder/2021/05/02/ransomwa...

by jve 5y ago

hawk_ 5y ago

Businesses can't expect claims for theft insurance to be honored if they didn't take reasonable measures (install security cameras, alarms etc... and lock the valuables). How is this different?

jve 5y ago
Agree. Not arguing about not having insurance. Just saying that paying the ransom may be the only way out of trouble.

mjevans 5y ago

You can't trust a compromised system. It has to be purged and rebuilt from the ground up. I really miss the days of write-enable jumpers for BIOSes...

nobodyandproud 5y ago

Did the business follow best security practices? Did it do its due diligence to harden against attacks? Why should insurers pay, when businesses have no incentive to do this?

hlasdjlfhalwjk 5y ago
If you follow security best practices, you have append-only backups that you can use to restore the encrypted data and don't need insurance at all...
- yodelshady 5y ago
  If the ransomware operators follow best practices, their C2 is in those backups too. The data's not encrypted, but without good IT, not for long. Maybe go two weeks' back and you'll get a clean instance, but that's two weeks' data loss, I've seen (non-tech) institutions hit where an hour of data loss is worth paying a ransom for.
  - StavrosK 5y ago
    Why is your data executable?
    - yodelshady 5y ago
      I'm really not sure that has a serious answer. https://en.wikipedia.org/wiki/Infrastructure_as_code https://en.wikipedia.org/wiki/Infrastructure_as_code https://en.wikipedia.org/wiki/Virtual_machine https://en.wikipedia.org/wiki/Virtual_machine https://en.wikipedia.org/wiki/Disk_image https://en.wikipedia.org/wiki/Disk_image https://en.wikipedia.org/wiki/Shadow_IT https://en.wikipedia.org/wiki/Shadow_IT https://en.wikipedia.org/wiki/Von_Neumann_architecture https://en.wikipedia.org/wiki/Von_Neumann_architecture Separation of code and executables is a nice idea that approximately 0% of organisations fully adhere to.
      - fouric 5y ago
        > https://en.wikipedia.org/wiki/Infrastructure_as_code https://en.wikipedia.org/wiki/Infrastructure_as_code > "definition files" Not executable. Text. Readable by humans. Inspectable by humans so you can root out rootkits. Not even the valuable data that cyber criminals go for anyway - they go for personal and financial data, not k8s config files. > https://en.wikipedia.org/wiki/Virtual_machine https://en.wikipedia.org/wiki/Virtual_machine > https://en.wikipedia.org/wiki/Disk_image https://en.wikipedia.org/wiki/Disk_image Neither of those are relevant. You don't back up virtual machines or image disks - you take afore-mentioned plain-text, audited config files and spin up new instance from scratch. > https://en.wikipedia.org/wiki/Shadow_IT https://en.wikipedia.org/wiki/Shadow_IT If those are actually shadow IT, they won't be in the backups anyway. > https://en.wikipedia.org/wiki/Von_Neumann_architecture https://en.wikipedia.org/wiki/Von_Neumann_architecture This is irrelevant snark. If you back up a data file, it doesn't matter that it's stored in the memory of a Von Neumann architecture - it's only going to be used as a data file. > Separation of code and executables is a nice idea that approximately 0% of organisations fully adhere to. Citation needed. Also, you just said: > If the ransomware operators follow best practices ...so are we considering the ideal case, or not? > I'm really not sure that has a serious answer. Being snide is bad by itself, but it's even worse when you're wrong on top of it.

waihtis 5y ago

You can still pay the ransom, the insurer will just not reimburse it.

viraptor 5y ago

> You are aware that paying ransom may or may NOT work. The ransomware campaigns are pretty good on support. You will get a key for a sample of your data as a proof. You can sometimes pay progressively to get more trust. Getting your data back is just as important for the criminals as encrypting it in the first place - otherwise their business goes down.

jve 5y ago
Oh, good to know they provide support. I just remember some ransom (was it notpetya?) that had a broken "pay" thing or some invalid mail... anyway, you couldn't get the key. And encryption your data doesn't help if you don't have backups. Edit: Here is the story: https://www.theverge.com/2017/6/27/15881110/petya-notpetya-paying-ransom-email-blocked-ransomware https://www.theverge.com/2017/6/27/15881110/petya-notpetya-p... So email provider blocked their email...
- fouric 5y ago
  > And encryption your data doesn't help if you don't have backups. Actually, it does. "We'll delete your data." is not the only ransomware threat - the other one that's not quite as big, but growing, is "We'll leak your data." Backups prevent denial. Encryption prevents dissemination.

rawtxapp 5y ago

To play the devil's advocate, in an ideal world, you go out of business and another business that actually followed security best practices takes over. Over time, companies start taking security more seriously. When it affects the users, they can just ignore, business as usual. But now, they can't just go on with their days, so that's the real accountability in my opinion.

paxys 5y ago

This is why you need government intervention. Just make it illegal to pay such ransoms. Now the easy option has disappeared. You likely go out of business, and the company which takes your place implements good security policies from the get go. Funding for hacker groups and newer attacks dries up. Sucks for you in particular, but the public overall is better for it.

nickpp 5y ago
Sure, just like when you have 5 sick people, each needing a different organ to survive. We need the government to select a healthy person, take his organs and save the other 5. Sucks for that person in particular, but the public overall is better for it.
- fauigerzigerk 5y ago
  It's more like banning the purchase of organs on the black market if you suffer organ failure.
- contravariant 5y ago
  Somewhat interesting that you use an argument against utilitarianism to argue against deontological ethics.
  - nickpp 5y ago
    Government intervention is government intervention no matter the context: it seems a good idea at first but it always backfires.
    - contravariant 5y ago
      To govern is to intervene, if a government doesn't intervene then what purpose does it have?
- m3at 5y ago
  Interesting argument, though forcefully selecting a donnor does not increase organ failure rates for others, whereas paying ransom does increase risks of future attacks.

hnbad 5y ago

Have the government bail them out by buying them out, then collectivize the company. If your company is too big to fail, maybe it shouldn't be controlled by profit-optimizing external shareholders and reckless directors. If it isn't too big to fail and can't get a loan the usual way to pay for the ransom (or better: data recovery), just let it go bankrupt like any other company making a costly mistake.

oneplane 5y ago

> Now, what do you do? You quit and go do something else. It's not like your life ends when a company ends. In a less sarcastic tone: this is where your DRP and BCP get involved, and if you don't have those at that scale, then you were doomed from the start anyway and your existence as a company was on a short lifespan to begin with.

vianneychevalie 5y ago
For other readers : DRP is "Disaster Recovery Plan" and BCP is "Business Continuity Plan".

PoignardAzur 5y ago

You can still have your assurance pay the cost of setting your revenue stream back up the hard way. As long as the money isn't going to the criminal groups.

paul_f 5y ago

The one company that I know personally that was hit by ransomware, and paid off the attackers, managed their own backups Which were encrypted as well. IMO, it's not just the importance of backups, but of having third party, redundant, off-site backups.

kogepathic 5y ago
> IMO, it's not just the importance of backups, but of having third party, redundant, off-site backups. If your backups do not already include the above, then it is not a viable backup strategy.

wglb 5y ago

The chance of actually getting the data back are not that good https://www.msspalert.com/cybersecurity-research/71-ransomware-victims-unable-to-restore-all-data/ https://www.msspalert.com/cybersecurity-research/71-ransomwa...

wglb 5y ago
Or perhaps it is worse than that: https://www.forbes.com/sites/daveywinder/2021/05/02/ransomware-reality-shock-92-who-pay-dont-get-their-data-back/?sh=2758df29e0c7 https://www.forbes.com/sites/daveywinder/2021/05/02/ransomwa...