9 ms·

When I heard that this pipeline company started advertising a job opening for CyberSecurity Advisor in the last few days, and heard today the ransom of about $5

by yebyen 5y ago

When I heard that this pipeline company started advertising a job opening for CyberSecurity Advisor in the last few days, and heard today the ransom of about $5 million was paid, my first reaction was to say "I bet the salary for that position is a lot less than $5 million, and I bet the budget for that department will be less, too..."

rebuilder 5y ago
Well, if it's more expensive to prevent the attack than to pay the ransom, what's the point? ;)
- g_p 5y ago
  I think you're right - as I said on a sibling comment, if beans are all you count, and bean-counters rule the roost, you can write this off as a one-off, and point out you had 30 years without a ransomware, and therefore we don't need to do anything...
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
  - Jeff_Brown 5y ago
    That's surely how it would be represented in order to retroactively justify negligence. But a more precise calculus would take into account that (1) the proliferation in ransomware is recent and explosive, and (2) getting hit by one ransomware group doesn't mean a second group won't strike soon. (Although I'm guessing the second wouldn't be allowed to use the same ransomware-as-a-service platform, as that would harm the platform's reputation.)
- bluGill 5y ago
  Until the attacks get more expensive. Some companies never settle law suits even when it is obvious they will lose in court. As a result they only have to deal with courts in cases where it is obvious they will lose since no lawyer will bother a with a case that isn't obvious. (the end result is about the same lost overall - when they lose they tend to be punished in court for not settling)
- mywittyname 5y ago
  I know you're saying this in jest, but that's the calculus. The outcome here shows that executives made the right call. The $5MM fee was easily paid, less than the costs of security, and the insurance company will probably cover it anyway. And the government/people were so outraged that the attackers were met with fucking swift justice. The company will probably get some grants or something to cover the cost of "securing their infrastructure." Never let a good crisis go to waste.
  - pixl97 5y ago
    Which is why the company needs a significant fine for failing to secure infrastructure.
  - rebuilder 5y ago
    I wasn't really saying it in jest. The ";)" was more of an "oh, the horror" signifier, meaning I don't really think it's great that the cost-benefit analysis here is so short-sighted. Any employee choosing to spend millions to avoid the cost of a heretofore unencountered cyberattack would be making a strategic decision, while probably not being empowered to make decisions at that level. So they do not take action. Bureaucracies do not take visionary action. They stay the course.
- blackearl 5y ago
  Now that they've outed themselves as an easy mark, should be simple to hit them again and demand more money. At some point it'll be less expensive to improve their security infrastructure.
  - hooande 5y ago
    Ransoming Colonial basically put Darkside out of business. no one is going to hit them again
    - rebuilder 5y ago
      Or, so they say... We really don't know enough to say anything here. It might just as well be that whoever controls the funds at Darkside pulled an exit scam.
    - Jeff_Brown 5y ago
      Their stuff may have been seized, but their business model has not to my knowledge been invalidated. Ransomware is not a capital-intensive business. A new generation of ransomware groups will quickly spring up to replace DarkSide.
- vsareto 5y ago
  They did get some free help from the US amplifying all of this and the media essentially tying DarkSide to the pipeline shutdown (even though they likely only set out for the business side). Maybe now utilities going to the US for a similar reason will be in everyone's DR/IR plan (even if Colonial didn't reach out to the US admin).
  - Jeff_Brown 5y ago
    Expecting the company to continue operating after freezing data on the "business side" seems strange to me.
- jethro_tell 5y ago
  This is why it's a problem. What's the point is the business side, but when taken as a whole, this type of infrastructure is too important to the country as a whole. Everyone want's to make the calculation and hope it's not them, but if it's everyone at once, or there is no ransom option it's a completely different ball game. This is a situation where we are asking private companies to take responsibility for something outside of a profit motive and the results are some what less than surprising.
g_p 5y ago
I think you're spot-on here - the ransom is seen as a "cost of doing business", and until recently security was seen as "a problem that happens to other people". Sadly my experience is that organisations like this will take their $5m ransom (or other remediation cost), assume it's a one-off, then divide it by their number of ransom-free years, and proclaim it was better value for money than hiring 2 or 3 senior security gurus on $300k /yr with 60 vacation days, and letting them bring in a team to deliver meaningful security. Beyond taking security out of the hands of bean-counters though, I'm not sure how you address this. Pursuing organisations that pay ransoms and prosecuting senior CEO/CFO-type executives for conspiracy to commit money laundering (and pushing for criminal convictions) could discourage paying ransoms. If it's left to businesses as something they can write down as a "cost", I don't see it getting better - there has to be a risk to the liberty of the CEO/CFO before they'll take security seriously in my experience. 90 days in federal prison would certainly sharpen their focus in future.
- briffle 5y ago
  Even better, they will take the cost of their Insurance Deductible, and then do those calculations. Most businesses have insurance for this stuff.
  - g_p 5y ago
    Interestingly, it looks like (some) insurers may be responding to this. > In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals. https://www.insurancejournal.com/news/international/2021/05/09/613255.htm https://www.insurancejournal.com/news/international/2021/05/...
  - aerostable_slug 5y ago
    And DarkSide has stated they target businesses with that insurance. It's smart. They were hosed the moment Colonial's infosec (or whomever) recommended closing the valves on the pipelines. Until that moment they'd been doing reasonably well (for criminal scum).
  - deleted 5y ago
mgfist 5y ago
TBH I was shocked $5 million was all it cost.
- yebyen 5y ago
  I imagine it went something like this "OK, now that you have our attention, and the eyes of the entire international media apparatus are on us, here's how we're going to do this. We're going to send some integer number of million money dollars down this pipe, and you're going to turn that gas pipe back on like you said you would. Then here's what happens next... we're going to give you an integer number of minutes running head start before the drone strikes start raining down on these 12 sites we've identified as likely candidates for your location, ... now how many millions was it that you were asking for from us again?" Doesn't really matter how much it was, either, if it has really been seized already in less than 24 hours. Was it enough to convince the boss guy or gal to take the bait and risk revealing themselves? (Probably not, but IMHO that wasn't likely to happen anyway, at least not since the heat started getting turned up on them all.)
  - sudosysgen 5y ago
    There is basically a zero percent chance that the US knew where they were physically. The servers that were claimed to be seized were on cloud platforms. And even then, we don't know if this is true or if it's just an exit strategy.
    - yebyen 5y ago
      It's easy to say "basically zero chance" when we're armchair quarterbacks and not the ones in the hot seat. I'm inclined to agree that our cyber-security apparatus is not up to the task, but it's also true that nobody has perfect OpSec, (and I'd guess there are few out there have deeper pockets to track down and make sure the perpetrators regret this, than the combination of US government + oil companies.)
      - throwawayboise 5y ago
deleted 5y ago
[deleted]
grumple 5y ago
The cost of shutting down this pipeline for a week is a lot more than 5 million. At 3 million barrels per day going through it, in 6 days that's 18 million barrels. At $65/barrel that's 195 million worth of oil that didn't transit and it probably has huge knock-on effects throughout the affected regions (things that didn't ship, trips not taken, etc).
- inasio 5y ago
  I believe it was a gasoline pipeline, so the price per barrel is a lot more than that.

by yebyen 5y ago

rebuilder 5y ago

Well, if it's more expensive to prevent the attack than to pay the ransom, what's the point? ;)

g_p 5y ago
I think you're right - as I said on a sibling comment, if beans are all you count, and bean-counters rule the roost, you can write this off as a one-off, and point out you had 30 years without a ransomware, and therefore we don't need to do anything...
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- Jeff_Brown 5y ago
  That's surely how it would be represented in order to retroactively justify negligence. But a more precise calculus would take into account that (1) the proliferation in ransomware is recent and explosive, and (2) getting hit by one ransomware group doesn't mean a second group won't strike soon. (Although I'm guessing the second wouldn't be allowed to use the same ransomware-as-a-service platform, as that would harm the platform's reputation.)
bluGill 5y ago
Until the attacks get more expensive. Some companies never settle law suits even when it is obvious they will lose in court. As a result they only have to deal with courts in cases where it is obvious they will lose since no lawyer will bother a with a case that isn't obvious. (the end result is about the same lost overall - when they lose they tend to be punished in court for not settling)
mywittyname 5y ago
I know you're saying this in jest, but that's the calculus. The outcome here shows that executives made the right call. The $5MM fee was easily paid, less than the costs of security, and the insurance company will probably cover it anyway. And the government/people were so outraged that the attackers were met with fucking swift justice. The company will probably get some grants or something to cover the cost of "securing their infrastructure." Never let a good crisis go to waste.
- pixl97 5y ago
  Which is why the company needs a significant fine for failing to secure infrastructure.
- rebuilder 5y ago
  I wasn't really saying it in jest. The ";)" was more of an "oh, the horror" signifier, meaning I don't really think it's great that the cost-benefit analysis here is so short-sighted. Any employee choosing to spend millions to avoid the cost of a heretofore unencountered cyberattack would be making a strategic decision, while probably not being empowered to make decisions at that level. So they do not take action. Bureaucracies do not take visionary action. They stay the course.
blackearl 5y ago
Now that they've outed themselves as an easy mark, should be simple to hit them again and demand more money. At some point it'll be less expensive to improve their security infrastructure.
- hooande 5y ago
  Ransoming Colonial basically put Darkside out of business. no one is going to hit them again
  - rebuilder 5y ago
    Or, so they say... We really don't know enough to say anything here. It might just as well be that whoever controls the funds at Darkside pulled an exit scam.
  - Jeff_Brown 5y ago
    Their stuff may have been seized, but their business model has not to my knowledge been invalidated. Ransomware is not a capital-intensive business. A new generation of ransomware groups will quickly spring up to replace DarkSide.
vsareto 5y ago
They did get some free help from the US amplifying all of this and the media essentially tying DarkSide to the pipeline shutdown (even though they likely only set out for the business side). Maybe now utilities going to the US for a similar reason will be in everyone's DR/IR plan (even if Colonial didn't reach out to the US admin).
- Jeff_Brown 5y ago
  Expecting the company to continue operating after freezing data on the "business side" seems strange to me.
jethro_tell 5y ago
This is why it's a problem. What's the point is the business side, but when taken as a whole, this type of infrastructure is too important to the country as a whole. Everyone want's to make the calculation and hope it's not them, but if it's everyone at once, or there is no ransom option it's a completely different ball game. This is a situation where we are asking private companies to take responsibility for something outside of a profit motive and the results are some what less than surprising.

g_p 5y ago

I think you're spot-on here - the ransom is seen as a "cost of doing business", and until recently security was seen as "a problem that happens to other people". Sadly my experience is that organisations like this will take their $5m ransom (or other remediation cost), assume it's a one-off, then divide it by their number of ransom-free years, and proclaim it was better value for money than hiring 2 or 3 senior security gurus on $300k /yr with 60 vacation days, and letting them bring in a team to deliver meaningful security. Beyond taking security out of the hands of bean-counters though, I'm not sure how you address this. Pursuing organisations that pay ransoms and prosecuting senior CEO/CFO-type executives for conspiracy to commit money laundering (and pushing for criminal convictions) could discourage paying ransoms. If it's left to businesses as something they can write down as a "cost", I don't see it getting better - there has to be a risk to the liberty of the CEO/CFO before they'll take security seriously in my experience. 90 days in federal prison would certainly sharpen their focus in future.

briffle 5y ago
Even better, they will take the cost of their Insurance Deductible, and then do those calculations. Most businesses have insurance for this stuff.
- g_p 5y ago
  Interestingly, it looks like (some) insurers may be responding to this. > In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals. https://www.insurancejournal.com/news/international/2021/05/09/613255.htm https://www.insurancejournal.com/news/international/2021/05/...
- aerostable_slug 5y ago
  And DarkSide has stated they target businesses with that insurance. It's smart. They were hosed the moment Colonial's infosec (or whomever) recommended closing the valves on the pipelines. Until that moment they'd been doing reasonably well (for criminal scum).
- deleted 5y ago

mgfist 5y ago

TBH I was shocked $5 million was all it cost.

yebyen 5y ago
I imagine it went something like this "OK, now that you have our attention, and the eyes of the entire international media apparatus are on us, here's how we're going to do this. We're going to send some integer number of million money dollars down this pipe, and you're going to turn that gas pipe back on like you said you would. Then here's what happens next... we're going to give you an integer number of minutes running head start before the drone strikes start raining down on these 12 sites we've identified as likely candidates for your location, ... now how many millions was it that you were asking for from us again?" Doesn't really matter how much it was, either, if it has really been seized already in less than 24 hours. Was it enough to convince the boss guy or gal to take the bait and risk revealing themselves? (Probably not, but IMHO that wasn't likely to happen anyway, at least not since the heat started getting turned up on them all.)
- sudosysgen 5y ago
  There is basically a zero percent chance that the US knew where they were physically. The servers that were claimed to be seized were on cloud platforms. And even then, we don't know if this is true or if it's just an exit strategy.
  - yebyen 5y ago
    It's easy to say "basically zero chance" when we're armchair quarterbacks and not the ones in the hot seat. I'm inclined to agree that our cyber-security apparatus is not up to the task, but it's also true that nobody has perfect OpSec, (and I'd guess there are few out there have deeper pockets to track down and make sure the perpetrators regret this, than the combination of US government + oil companies.)
    - throwawayboise 5y ago

deleted 5y ago

[deleted]

grumple 5y ago

The cost of shutting down this pipeline for a week is a lot more than 5 million. At 3 million barrels per day going through it, in 6 days that's 18 million barrels. At $65/barrel that's 195 million worth of oil that didn't transit and it probably has huge knock-on effects throughout the affected regions (things that didn't ship, trips not taken, etc).

inasio 5y ago
I believe it was a gasoline pipeline, so the price per barrel is a lot more than that.