3 ms·

It creates additional conditions for blackmail of the target. Some would pay, and then could be induced into future payments because they can now be leveraged f

It creates additional conditions for blackmail of the target. Some would pay, and then could be induced into future payments because they can now be leveraged for having committed a criminal offense. A better law would be one that requires institutions above a certain size to create backups every 24hrs and maintain basic security practices to prevent this sort of thing.

andrewla 2y ago
Better? I guess there are two ways you could implement this, the legal and the regulatory route. The legal route would say that upon discovery of the lack of said backups, they would be subject to penalties. So if they get hit by a ransomeware attack, then while they are down, they get kicked. Pretty rough. The regulatory route would say that every company above a certain size needs to document its policies around backups, and either standardize on a fixed set of backup techniques or have an auditor that verifies that the backup technique used by a company satisfies some set of requirements. The former approach means a ton of paperwork for the company to get the certification, and the latter approach means that the regulatory body has to be very large and have a great deal of subject matter expertise. All of this is fairly horrible. I'm not sure that either of these would be "better" than making the payments themselves illegal. Not to say that such a law would be "good" either -- it basically means that companies will have to not involve the authorities because recovering their data is more important (and may be essential to the continuity of the company). Bad as it is, the best solution here is probably to keep going like we're going -- law enforcement will try to hunt down the ransomers and bring them to justice (since this is already illegal), companies are incentivized to follow some sort of best practices around backups.
briandear 2y ago
[flagged]

andrewla 2y ago

Better? I guess there are two ways you could implement this, the legal and the regulatory route. The legal route would say that upon discovery of the lack of said backups, they would be subject to penalties. So if they get hit by a ransomeware attack, then while they are down, they get kicked. Pretty rough. The regulatory route would say that every company above a certain size needs to document its policies around backups, and either standardize on a fixed set of backup techniques or have an auditor that verifies that the backup technique used by a company satisfies some set of requirements. The former approach means a ton of paperwork for the company to get the certification, and the latter approach means that the regulatory body has to be very large and have a great deal of subject matter expertise. All of this is fairly horrible. I'm not sure that either of these would be "better" than making the payments themselves illegal. Not to say that such a law would be "good" either -- it basically means that companies will have to not involve the authorities because recovering their data is more important (and may be essential to the continuity of the company). Bad as it is, the best solution here is probably to keep going like we're going -- law enforcement will try to hunt down the ransomers and bring them to justice (since this is already illegal), companies are incentivized to follow some sort of best practices around backups.

briandear 2y ago

[flagged]