3 ms·

Make insecure software the problem of its producer, so that except for gross negligence by the user, the software vendor is on the hook (reimbursing customers)

Make insecure software the problem of its producer, so that except for gross negligence by the user, the software vendor is on the hook (reimbursing customers) and will want to prevent ransomware from being a thing in the first place.

RNCTX 5y ago
Bingo. It's high comedy to me that 90+% of ransomware is targeted at Windows, and yet beyond the year 2020 you can still find corporate-speak in the wild that all basically boils down to a hare-brained assumption that the corporate vendor will in some way be liable if the customer suffers a breach. When in fact the largest of software vendors sits in plain sight, obviously liable for poor designs that invite these breaches, and no one has held them to account for it.
- spywaregorilla 5y ago
  What percent of ransomware on windows is driven by software vulnerabilities rather than careless users?
  - RNCTX 5y ago
    All of it, because Windows is closed source. A user cannot be responsible for a black box's contents.
mschuster91 5y ago
Even the most secure piece of software - assuming such a thing even exists! - can't do a thing against incompetent users. Even a perfectly patched Windows instance can't be reasonably protected against an user executing an attachment of an email that then goes ahead and encrypts all files writable by the user. The only option is to ban the user from anything executable and interpreters as Apple does on their iDevices, but we all rightfully and regularly complain about that one. As for vulnerable software: I agree, some pressure on Microsoft to open-source or at least provably audit their software would be nice - but it's rare to have a definitive attribution on how a piece of malware entered your organization, at least not in places where record-keeping and retention is restricted by laws like the GDPR.
toast0 5y ago
> gross negligence by the user Not having tested, well scoped, and reasonably frequent backups for business critical corporate operations is gross negligence.
- pgeorgi 5y ago
  Not having updated the system (within reason: it _can_ take a week, but it should _not_ take a year) is gross negligence as far as vendor liability would be concerned. But by all means, let's limit the minimum liability for software vendors for such scenarios to "costs of downtime and effort for reinstalling backups and getting everything up again": That should provide an incentive to make backup procedures effortless and have the systems make some noise if they aren't backed up (with regular recovery testing etc). As it stands, software vendors say "users are to blame" as if their shitty software isn't enabling ransomware, users say "can't do anything about it, we're down for the next 6 months" as if ransomware is some force of nature (or act of God or whatever), when both positions, while not entirely untrue, are mostly lazy.
- rich_sasha 5y ago
  I think a constructive thing for governments to do is to gently push people in that direction. Make high-quality, audited backups a legal requirement, or offer strong incentives for it, and much of the problem goes away. Companies may be able to outsource it, which arguably just shifts the attack vector elsewhere, but you would hope people who specialise in backups are better at it than their amateur clients.

RNCTX 5y ago

Bingo. It's high comedy to me that 90+% of ransomware is targeted at Windows, and yet beyond the year 2020 you can still find corporate-speak in the wild that all basically boils down to a hare-brained assumption that the corporate vendor will in some way be liable if the customer suffers a breach. When in fact the largest of software vendors sits in plain sight, obviously liable for poor designs that invite these breaches, and no one has held them to account for it.

spywaregorilla 5y ago
What percent of ransomware on windows is driven by software vulnerabilities rather than careless users?
- RNCTX 5y ago
  All of it, because Windows is closed source. A user cannot be responsible for a black box's contents.

mschuster91 5y ago

Even the most secure piece of software - assuming such a thing even exists! - can't do a thing against incompetent users. Even a perfectly patched Windows instance can't be reasonably protected against an user executing an attachment of an email that then goes ahead and encrypts all files writable by the user. The only option is to ban the user from anything executable and interpreters as Apple does on their iDevices, but we all rightfully and regularly complain about that one. As for vulnerable software: I agree, some pressure on Microsoft to open-source or at least provably audit their software would be nice - but it's rare to have a definitive attribution on how a piece of malware entered your organization, at least not in places where record-keeping and retention is restricted by laws like the GDPR.

toast0 5y ago

> gross negligence by the user Not having tested, well scoped, and reasonably frequent backups for business critical corporate operations is gross negligence.

pgeorgi 5y ago
Not having updated the system (within reason: it _can_ take a week, but it should _not_ take a year) is gross negligence as far as vendor liability would be concerned. But by all means, let's limit the minimum liability for software vendors for such scenarios to "costs of downtime and effort for reinstalling backups and getting everything up again": That should provide an incentive to make backup procedures effortless and have the systems make some noise if they aren't backed up (with regular recovery testing etc). As it stands, software vendors say "users are to blame" as if their shitty software isn't enabling ransomware, users say "can't do anything about it, we're down for the next 6 months" as if ransomware is some force of nature (or act of God or whatever), when both positions, while not entirely untrue, are mostly lazy.
rich_sasha 5y ago
I think a constructive thing for governments to do is to gently push people in that direction. Make high-quality, audited backups a legal requirement, or offer strong incentives for it, and much of the problem goes away. Companies may be able to outsource it, which arguably just shifts the attack vector elsewhere, but you would hope people who specialise in backups are better at it than their amateur clients.