7 ms·

So a hacker has your data, and demands money. The government's proposal: 1. If you pay the hacker, we want money because you paid a hacker. 2. If you don't p

by slver 5y ago

So a hacker has your data, and demands money. The government's proposal: 1. If you pay the hacker, we want money because you paid a hacker. 2. If you don't pay the hacker, we want money because you leaked your users' data. The bottom-line is that if you're a victim of ransomware, the government joins the hacker, both of them kicking you while you're down and demanding money.

californical 5y ago
Or, you can think of it as increasing the incentive to take security seriously. And it seems like they’d have to pay the fine for (2) regardless of if they pay to get the data back in this case.
- slver 5y ago
  It's also an incentive to pay immediately, and tell no one about it.
adrianN 5y ago
The government should fine the company either way for not properly securing their user's data. Security is serious business, it's time companies took it more seriously.
- HPsquared 5y ago
  The ransomers seem to perform this function rather effectively.
  - fpoling 5y ago
    No necessary so as the company may just pay for insurance from future attacks. Granted insurance companies then will demand some compliance with security check lists, but this feedback loop is very slow.
  - ozim 5y ago
    Not anymore because latest business was, if you don't pay they will leak the data: https://www.forbes.com/sites/thomasbrewster/2021/05/13/ransomware-hackers-claim-to-leak-250gb-of-washington-dc-police-data-after-cops-dont-pay-4-million-ransom/ https://www.forbes.com/sites/thomasbrewster/2021/05/13/ranso...
- slver 5y ago
  You say this as if a disgruntled employee can't compromise the security of literally any system at all. Remember Snowden didn't hack the CIA. He just worked there. And has a user/pass.
  - throwawaygh 5y ago
    Part of a good security posture is protecting yourself against insider threats. If you're not doing this, you're not taking cybersecurity seriously.
    - JadeNB 5y ago
      > Part of a good security posture is protecting yourself against insider threats. If you're not doing this, you're not taking cybersecurity seriously. How do you protect yourself? There are ways to mitigate, surely, but any failure can be a catastrophic incident, and it is literally impossible to protect against all internal threats (in the sense of guaranteeing that no such threat is ever acted upon). All else aside, it just shifts the responsibility one level up: now you have to worry about a compromise of the people responsible for protecting from internal threats.
      - throwawaygh 5y ago
        Security is hard, and the difficulty of answering this question in any particular org probably takes up a lot of the time of any competent and properly staffed CISO office. But, basically, the only mechanisms in play are some combination of limiting access and, where that's not possible, decreasing employees' ability/incentive to defect.
        slver 5y ago
        This is a bit like the question how to have a system that promotes honest, smart politicians. As you might guess, nobody has figured that out yet. Ultimately the only way is an omniscient, omnipresent CEO who does all the important stuff alone. Which is probably the core reason why no one has leaked God's files on the Universe, yet.
woah 5y ago
Sounds good to me. Why should companies be allowed to save money by exposing our personal data and then pay for it by funding terrorist organizations, organized crime, and totalitarian governments?
- slver 5y ago
  You imply as if there's a store where you can go and buy yourself 10 pounds of security for 20 money, and that's that, your data is safe for life. Security is a heuristic based on millions of variables other than a simple price label. You can pay a lot and still get everything leaked.
- FpUser 5y ago
  Why do you assume that it is personal data that are at risk? Maybe it is your new super-duper tech that hackers will threaten to leak to the rest of the world?
63 5y ago
Then the incentive is to avoid becoming a victim to ransomware in the first place by making it more cost effective to hire decent security than to take the risk and end up getting targeted.
- powersnail 5y ago
  Or to find more sneaky ways of completing the transaction...
mcny 5y ago
> your data I think it helps IT departments to go to upper management and put a dollar figure to information security. Personally, I’d prefer the CEO and the board go to prison for a few years for paying ransom.
hvis 5y ago
Shouldn't you pay the fine for leaking user data either way? Even if you square things with the blackmailer, there's no good way to ensure they don't sell the data to someone else as well.
deep-root 5y ago
You may be presenting a false choice: Even if you pay hackers off, there was still a data breach.
_adamb 5y ago
This will ultimately just create a larger market for ransomware insurance. Insurance premiums are likely the lowest cost compared to 1) paying the fines or 2) actually improving security. Most businesses already have some form of insurance covering their liability in these situations and those will just price in whatever fines might need to be paid.
- whydoyoucare 5y ago
  This is the most likely outcome in my opinion. I won't be surprised if the insurance lobby has made this happen. :-)
- DyslexicAtheist 5y ago
  > This will ultimately just create a larger market for ransomware insurance. CEO of Swiss Re to said this[1]: > He observed that the cyber insurance market is currently worth around $5.5 billion in premium, compared to “gigantic” yearly losses that extend into the hundreds of billions of dollars. “There’s a cyber market that’s very tiny compared to the total exposure,” he told CNBC. “It’s going to grow but only a tiny minority of cyber is actually insured.” “And I would actually argue that overall the problem is so big it’s not insurable,” Mumenthaler continued. It’s just too big. Because there are events that can happen at the same time everywhere that are much more worrying than what you just saw.” [1] Pipeline cyber attack not surprising, says Swiss Re https://www.reinsurancene.ws/pipeline-cyber-attack-not-surprising-says-swiss-res-mumenthaler/ https://www.reinsurancene.ws/pipeline-cyber-attack-not-surpr...
throwaway6734 5y ago
What's wrong with this? Secure your users data and your infrastructure
wpietri 5y ago
That's the first-order effect. The second-order effect is companies paying less to ransomware creators, making it a worse business to be in. Over time this should result in less business pain.
kevmo 5y ago
Am i the only one who think this sounds fine? If you're collecting user data, then yeah, you should be held to heightened level of responsibility.
brandonmenc 5y ago
> if you're a victim of ransomware ftfy: if [corporation is] a [target] of ransomware I don't feel sympathy for them the way I would a person.
throwawaygh 5y ago
> The bottom-line is that if you're a victim of ransomware, the government joins the hacker, both of them kicking you while you're down and demanding money. The rationale for outlawing ransom payments is that it eliminates the incentive for ransomware attacks. The real question is whether "no-concessions" policies reduce the incidence of ransomware attacks. The answer to that question isn't obvious. However, conditional on no-concessions working in the case of ransomware, "kicking corps while they're down" is not a relevant consideration. The cooperate-cooperate quadrant of the game has higher expected value than the defect quadrants, so you force cooperation by whatever means necessary, even if that means some actors don't get the best possible outcome from their own perspective. NB: there's some evidence that no-concessions policies don't work particularly well in the case of kidnapping [1]... I'd take care extending this finding to ransomware gangs. If you read the whole PDF, it'll become clear why this behavior is interesting but might not transfer to today's ransomware gangs. That said, when crafting policy on ransomware attacks, it's worth keeping in mind that ransomware attackers may or may not be of the homo economicus species. At the very least as an assumption that you start with but are open to dropping as new evidence prevents itself. [1] https://www.rand.org/content/dam/rand/pubs/perspectives/PE200/PE277/RAND_PE277.pdf https://www.rand.org/content/dam/rand/pubs/perspectives/PE20...
- slver 5y ago
  Penalizing you for being blackmailed doesn’t force cooperation. Because an alternative is paying quietly and not informing the authorities. This is what this model encourages in practice. Less cooperation.
officeplant 5y ago
Hopefully this leads to companies taking IT security seriously for once. Hit them where it hurts the most.
ozim 5y ago
Option: 3. Pay your IT/Security department or hire a consultant Pay for licenses and updates of software and hardware Don't expect job of 5 people to be done by 1 Don't let bunch of trainees run your infra Government should make companies pay even more so other companies understand what the proper way to "not getting ransomed" is or spend money finding out. Instead of money going god knows where to finance god knows what. SolarWinds was blaming some intern for a bad password, if it would be up to me, I would close down whole company for such utter bullshit. I understand at their scale it is still possible to have some loose ends but no one was doing any audits, no one was doing any security awareness? I bet you could blame at least 10 managers there for not even thinking about security and not some intern.

by slver 5y ago

californical 5y ago

Or, you can think of it as increasing the incentive to take security seriously. And it seems like they’d have to pay the fine for (2) regardless of if they pay to get the data back in this case.

slver 5y ago
It's also an incentive to pay immediately, and tell no one about it.

adrianN 5y ago

The government should fine the company either way for not properly securing their user's data. Security is serious business, it's time companies took it more seriously.

HPsquared 5y ago
The ransomers seem to perform this function rather effectively.
- fpoling 5y ago
  No necessary so as the company may just pay for insurance from future attacks. Granted insurance companies then will demand some compliance with security check lists, but this feedback loop is very slow.
- ozim 5y ago
  Not anymore because latest business was, if you don't pay they will leak the data: https://www.forbes.com/sites/thomasbrewster/2021/05/13/ransomware-hackers-claim-to-leak-250gb-of-washington-dc-police-data-after-cops-dont-pay-4-million-ransom/ https://www.forbes.com/sites/thomasbrewster/2021/05/13/ranso...
slver 5y ago
You say this as if a disgruntled employee can't compromise the security of literally any system at all. Remember Snowden didn't hack the CIA. He just worked there. And has a user/pass.
- throwawaygh 5y ago
  Part of a good security posture is protecting yourself against insider threats. If you're not doing this, you're not taking cybersecurity seriously.
  - JadeNB 5y ago
    > Part of a good security posture is protecting yourself against insider threats. If you're not doing this, you're not taking cybersecurity seriously. How do you protect yourself? There are ways to mitigate, surely, but any failure can be a catastrophic incident, and it is literally impossible to protect against all internal threats (in the sense of guaranteeing that no such threat is ever acted upon). All else aside, it just shifts the responsibility one level up: now you have to worry about a compromise of the people responsible for protecting from internal threats.
    - throwawaygh 5y ago
      Security is hard, and the difficulty of answering this question in any particular org probably takes up a lot of the time of any competent and properly staffed CISO office. But, basically, the only mechanisms in play are some combination of limiting access and, where that's not possible, decreasing employees' ability/incentive to defect.
      - slver 5y ago
        This is a bit like the question how to have a system that promotes honest, smart politicians. As you might guess, nobody has figured that out yet. Ultimately the only way is an omniscient, omnipresent CEO who does all the important stuff alone. Which is probably the core reason why no one has leaked God's files on the Universe, yet.

woah 5y ago

Sounds good to me. Why should companies be allowed to save money by exposing our personal data and then pay for it by funding terrorist organizations, organized crime, and totalitarian governments?

slver 5y ago
You imply as if there's a store where you can go and buy yourself 10 pounds of security for 20 money, and that's that, your data is safe for life. Security is a heuristic based on millions of variables other than a simple price label. You can pay a lot and still get everything leaked.
FpUser 5y ago
Why do you assume that it is personal data that are at risk? Maybe it is your new super-duper tech that hackers will threaten to leak to the rest of the world?

63 5y ago

Then the incentive is to avoid becoming a victim to ransomware in the first place by making it more cost effective to hire decent security than to take the risk and end up getting targeted.

powersnail 5y ago
Or to find more sneaky ways of completing the transaction...

mcny 5y ago

> your data I think it helps IT departments to go to upper management and put a dollar figure to information security. Personally, I’d prefer the CEO and the board go to prison for a few years for paying ransom.

hvis 5y ago

Shouldn't you pay the fine for leaking user data either way? Even if you square things with the blackmailer, there's no good way to ensure they don't sell the data to someone else as well.

deep-root 5y ago

You may be presenting a false choice: Even if you pay hackers off, there was still a data breach.

_adamb 5y ago

This will ultimately just create a larger market for ransomware insurance. Insurance premiums are likely the lowest cost compared to 1) paying the fines or 2) actually improving security. Most businesses already have some form of insurance covering their liability in these situations and those will just price in whatever fines might need to be paid.

whydoyoucare 5y ago
This is the most likely outcome in my opinion. I won't be surprised if the insurance lobby has made this happen. :-)
DyslexicAtheist 5y ago
> This will ultimately just create a larger market for ransomware insurance. CEO of Swiss Re to said this[1]: > He observed that the cyber insurance market is currently worth around $5.5 billion in premium, compared to “gigantic” yearly losses that extend into the hundreds of billions of dollars. “There’s a cyber market that’s very tiny compared to the total exposure,” he told CNBC. “It’s going to grow but only a tiny minority of cyber is actually insured.” “And I would actually argue that overall the problem is so big it’s not insurable,” Mumenthaler continued. It’s just too big. Because there are events that can happen at the same time everywhere that are much more worrying than what you just saw.” [1] Pipeline cyber attack not surprising, says Swiss Re https://www.reinsurancene.ws/pipeline-cyber-attack-not-surprising-says-swiss-res-mumenthaler/ https://www.reinsurancene.ws/pipeline-cyber-attack-not-surpr...

throwaway6734 5y ago

What's wrong with this? Secure your users data and your infrastructure

wpietri 5y ago

That's the first-order effect. The second-order effect is companies paying less to ransomware creators, making it a worse business to be in. Over time this should result in less business pain.

kevmo 5y ago

Am i the only one who think this sounds fine? If you're collecting user data, then yeah, you should be held to heightened level of responsibility.

brandonmenc 5y ago

> if you're a victim of ransomware ftfy: if [corporation is] a [target] of ransomware I don't feel sympathy for them the way I would a person.

throwawaygh 5y ago

> The bottom-line is that if you're a victim of ransomware, the government joins the hacker, both of them kicking you while you're down and demanding money. The rationale for outlawing ransom payments is that it eliminates the incentive for ransomware attacks. The real question is whether "no-concessions" policies reduce the incidence of ransomware attacks. The answer to that question isn't obvious. However, conditional on no-concessions working in the case of ransomware, "kicking corps while they're down" is not a relevant consideration. The cooperate-cooperate quadrant of the game has higher expected value than the defect quadrants, so you force cooperation by whatever means necessary, even if that means some actors don't get the best possible outcome from their own perspective. NB: there's some evidence that no-concessions policies don't work particularly well in the case of kidnapping [1]... I'd take care extending this finding to ransomware gangs. If you read the whole PDF, it'll become clear why this behavior is interesting but might not transfer to today's ransomware gangs. That said, when crafting policy on ransomware attacks, it's worth keeping in mind that ransomware attackers may or may not be of the homo economicus species. At the very least as an assumption that you start with but are open to dropping as new evidence prevents itself. [1] https://www.rand.org/content/dam/rand/pubs/perspectives/PE200/PE277/RAND_PE277.pdf https://www.rand.org/content/dam/rand/pubs/perspectives/PE20...

slver 5y ago
Penalizing you for being blackmailed doesn’t force cooperation. Because an alternative is paying quietly and not informing the authorities. This is what this model encourages in practice. Less cooperation.

officeplant 5y ago

Hopefully this leads to companies taking IT security seriously for once. Hit them where it hurts the most.

ozim 5y ago

Option: 3. Pay your IT/Security department or hire a consultant Pay for licenses and updates of software and hardware Don't expect job of 5 people to be done by 1 Don't let bunch of trainees run your infra Government should make companies pay even more so other companies understand what the proper way to "not getting ransomed" is or spend money finding out. Instead of money going god knows where to finance god knows what. SolarWinds was blaming some intern for a bad password, if it would be up to me, I would close down whole company for such utter bullshit. I understand at their scale it is still possible to have some loose ends but no one was doing any audits, no one was doing any security awareness? I bet you could blame at least 10 managers there for not even thinking about security and not some intern.