8 ms·

Well, if it's more expensive to prevent the attack than to pay the ransom, what's the point? ;)

g_p 5y ago
I think you're right - as I said on a sibling comment, if beans are all you count, and bean-counters rule the roost, you can write this off as a one-off, and point out you had 30 years without a ransomware, and therefore we don't need to do anything...
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- Jeff_Brown 5y ago
  That's surely how it would be represented in order to retroactively justify negligence. But a more precise calculus would take into account that (1) the proliferation in ransomware is recent and explosive, and (2) getting hit by one ransomware group doesn't mean a second group won't strike soon. (Although I'm guessing the second wouldn't be allowed to use the same ransomware-as-a-service platform, as that would harm the platform's reputation.)
bluGill 5y ago
Until the attacks get more expensive. Some companies never settle law suits even when it is obvious they will lose in court. As a result they only have to deal with courts in cases where it is obvious they will lose since no lawyer will bother a with a case that isn't obvious. (the end result is about the same lost overall - when they lose they tend to be punished in court for not settling)
mywittyname 5y ago
I know you're saying this in jest, but that's the calculus. The outcome here shows that executives made the right call. The $5MM fee was easily paid, less than the costs of security, and the insurance company will probably cover it anyway. And the government/people were so outraged that the attackers were met with fucking swift justice. The company will probably get some grants or something to cover the cost of "securing their infrastructure." Never let a good crisis go to waste.
- pixl97 5y ago
  Which is why the company needs a significant fine for failing to secure infrastructure.
- rebuilder 5y ago
  I wasn't really saying it in jest. The ";)" was more of an "oh, the horror" signifier, meaning I don't really think it's great that the cost-benefit analysis here is so short-sighted. Any employee choosing to spend millions to avoid the cost of a heretofore unencountered cyberattack would be making a strategic decision, while probably not being empowered to make decisions at that level. So they do not take action. Bureaucracies do not take visionary action. They stay the course.
blackearl 5y ago
Now that they've outed themselves as an easy mark, should be simple to hit them again and demand more money. At some point it'll be less expensive to improve their security infrastructure.
- hooande 5y ago
  Ransoming Colonial basically put Darkside out of business. no one is going to hit them again
  - rebuilder 5y ago
    Or, so they say... We really don't know enough to say anything here. It might just as well be that whoever controls the funds at Darkside pulled an exit scam.
  - Jeff_Brown 5y ago
    Their stuff may have been seized, but their business model has not to my knowledge been invalidated. Ransomware is not a capital-intensive business. A new generation of ransomware groups will quickly spring up to replace DarkSide.
vsareto 5y ago
They did get some free help from the US amplifying all of this and the media essentially tying DarkSide to the pipeline shutdown (even though they likely only set out for the business side). Maybe now utilities going to the US for a similar reason will be in everyone's DR/IR plan (even if Colonial didn't reach out to the US admin).
- Jeff_Brown 5y ago
  Expecting the company to continue operating after freezing data on the "business side" seems strange to me.
jethro_tell 5y ago
This is why it's a problem. What's the point is the business side, but when taken as a whole, this type of infrastructure is too important to the country as a whole. Everyone want's to make the calculation and hope it's not them, but if it's everyone at once, or there is no ransom option it's a completely different ball game. This is a situation where we are asking private companies to take responsibility for something outside of a profit motive and the results are some what less than surprising.

g_p 5y ago

I think you're right - as I said on a sibling comment, if beans are all you count, and bean-counters rule the roost, you can write this off as a one-off, and point out you had 30 years without a ransomware, and therefore we don't need to do anything...

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
Jeff_Brown 5y ago
That's surely how it would be represented in order to retroactively justify negligence. But a more precise calculus would take into account that (1) the proliferation in ransomware is recent and explosive, and (2) getting hit by one ransomware group doesn't mean a second group won't strike soon. (Although I'm guessing the second wouldn't be allowed to use the same ransomware-as-a-service platform, as that would harm the platform's reputation.)

bluGill 5y ago

Until the attacks get more expensive. Some companies never settle law suits even when it is obvious they will lose in court. As a result they only have to deal with courts in cases where it is obvious they will lose since no lawyer will bother a with a case that isn't obvious. (the end result is about the same lost overall - when they lose they tend to be punished in court for not settling)

mywittyname 5y ago

I know you're saying this in jest, but that's the calculus. The outcome here shows that executives made the right call. The $5MM fee was easily paid, less than the costs of security, and the insurance company will probably cover it anyway. And the government/people were so outraged that the attackers were met with fucking swift justice. The company will probably get some grants or something to cover the cost of "securing their infrastructure." Never let a good crisis go to waste.

pixl97 5y ago
Which is why the company needs a significant fine for failing to secure infrastructure.
rebuilder 5y ago
I wasn't really saying it in jest. The ";)" was more of an "oh, the horror" signifier, meaning I don't really think it's great that the cost-benefit analysis here is so short-sighted. Any employee choosing to spend millions to avoid the cost of a heretofore unencountered cyberattack would be making a strategic decision, while probably not being empowered to make decisions at that level. So they do not take action. Bureaucracies do not take visionary action. They stay the course.

blackearl 5y ago

Now that they've outed themselves as an easy mark, should be simple to hit them again and demand more money. At some point it'll be less expensive to improve their security infrastructure.

hooande 5y ago
Ransoming Colonial basically put Darkside out of business. no one is going to hit them again
- rebuilder 5y ago
  Or, so they say... We really don't know enough to say anything here. It might just as well be that whoever controls the funds at Darkside pulled an exit scam.
- Jeff_Brown 5y ago
  Their stuff may have been seized, but their business model has not to my knowledge been invalidated. Ransomware is not a capital-intensive business. A new generation of ransomware groups will quickly spring up to replace DarkSide.

vsareto 5y ago

They did get some free help from the US amplifying all of this and the media essentially tying DarkSide to the pipeline shutdown (even though they likely only set out for the business side). Maybe now utilities going to the US for a similar reason will be in everyone's DR/IR plan (even if Colonial didn't reach out to the US admin).

Jeff_Brown 5y ago
Expecting the company to continue operating after freezing data on the "business side" seems strange to me.

jethro_tell 5y ago

This is why it's a problem. What's the point is the business side, but when taken as a whole, this type of infrastructure is too important to the country as a whole. Everyone want's to make the calculation and hope it's not them, but if it's everyone at once, or there is no ransom option it's a completely different ball game. This is a situation where we are asking private companies to take responsibility for something outside of a profit motive and the results are some what less than surprising.