5 ms·
Would it? For some businesses, the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is o
by not_kurt_godel 5y ago
Would it? For some businesses, the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is off the table?
- JumpCrisscross 5y ago> the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is off the table? Insurance. Back-ups. Bail outs. Go out of business. That ransom paid has negative externalities that manifest nationally.
- deleted 5y ago[deleted]
- OminousWeapons 5y agoYou won't even be able to get private insurance if the industry has to insure against complete destruction of a given business. Are you expecting the US gov to backstop every business regardless of size against ransomware? Who is going to pay for that? Additionally, how do you protect against the obvious opportunities for fraud and abuse (business deliberately attacks itself to collect the insurance payout, business hits their competitors to drive them out of business, etc)?
- samstave 5y ago>"insure against complete destruction of a given business." Isnt that what fire/flood insurance is for?
- OminousWeapons 5y agoFire and flood insurance protect against discrete or regional risks whereas ransomware will potentially disrupt operations globally, and actually most private insurers won't offer flood insurance to large swaths of the US because the risk has been deemed to be too high. The US gov insures against coastal flooding at GREAT expense to the tax payer.
- detaro 5y agoI wonder what the biggest company is that's totally dependent on a single location (or locations in the same flood zone) and at the same time is usefully insured against such destruction.
- samstave 5y agoPorts? Take out a port, and screw an entire region.
- Workaccount2 5y agoYou would be able to get affordable private insurance if you had a cyber security team.
- detaro 5y agoVarious providers of "cyber insurance" are right now busy getting rid of ransomware coverage because it turns out offering that isn't working for them. and yes, they do require companies to have cyber security infrastructure and audits.
- Workaccount2 5y agoThat would imply that cyber security isn't effective in mitigating these attacks then, no?
- OminousWeapons 5y agoIt suggests it is a difficult problem to stop. As I understand it, attackers now frequently perform an initial compromise and then manually escalate privileges before launching a ransomware attack for greater impact. Alternatively, the attacker will sell privileged access to a ransomware group. This isn't someone from HR opening a malicious attachment and getting the whole company owned via eternal blue.
- detaro 5y agoAt least it suggests that the current standards and auditing practices are not sufficient, and apparently formulating testable requirements is difficult.
- deleted 5y ago[deleted]
- api 5y agoA few businesses die. The rest get the message that security matters. The ransomware industry is deprived of revenue.
- MattGaiser 5y agoThis is a government agency. https://en.wikipedia.org/wiki/Steamship_Authority https://en.wikipedia.org/wiki/Steamship_Authority
- api 5y agoThe physical ferries still exist, right? Transfer them to a new agency.
- orblivion 5y agoThe followup controversy will be government agencies and massive companies getting "too big to fail" exemptions.
- DFHippie 5y agoIf we're allowing government agencies to fail we're in pretty crappy shape.
- kwhitefoot 5y agoIn which case there are no investors so just wipe all the computers and start again.
- orblivion 5y agoHow about, companies who pay ransoms get a fine that's 10x the ransom. It slides up toward 1000x over two years. Kind of like deprecating an API slowly by decreasing its responsiveness.
- deleted 5y ago[deleted]
- TheCoelacanth 5y agoThen you go out of business. That's what is supposed to happen in capitalism when you run your business badly.
- not_kurt_godel 5y agoSounds like maybe not the best for people who work at the company and whose livelihoods depend on it (especially, of course, those whose purview has nothing to do with cybersecurity).