The recommendation by the FBI that victims of
ransomware pay up to have their files decrypted created a buzz within IT folks
of all kind. It’s time to ask: Should paying the ransom really be considered an
option?
Joseph Bonavolonta, an assistant special agent with
the FBI, speaking at the Cyber Security Summit 2015 in Boston, surprised the
audience during his presentation: “To be honest, we often advise people just to pay the ransom, because the
ransomware is that good.”
“What’s wrong, however, is
to consider paying the ransom as an alternative to prevention.”
The FBI’s recommendation seems to be in stark
contrast with the position of the IT security industry, which
believes that “paying the ransom should not be an option”.
Don’t get me wrong, we do not claim that there is
no chance that paying the ransom would indeed buy victim the decryption keys
and prevent huge damage from losing their data.
What’s wrong, however, is to consider paying the
ransom as an alternative to prevention. Dealing with extortionists is different
to dealing with, for instance, traffic police. You might think you can save
time by speeding and consider the risk of paying a fine as a better
option to being late to a job interview. It can seem reasonable and
legitimate to you (don’t tell this to the cops).
In such a case you can be sure that paying the fine
solves your problem. But when paying the ransom, you can quite easily end
up empty-handed, with your bitcoins gone and your files still encrypted.
Another reason for favoring prevention over paying
the ransom is that in most cases the former requires no significant effort.
Prevention in this case means that internet users adhere to basic principles of
safe behavior (including having their systems fully patched, installed and
updated) and that a data backup and recovery solution is implemented and fully
functional.
Doing that does not only help to avoid falling
victim to ransomware attacks, it also helps to keep other threats at bay (from
viruses, through to employees going “mad”, to natural disasters).
“Europol considers
ransomware the greatest threat ints latest issue of Internet Organised Crime
Threat Assessment.”
Europol, the law enforcement agency of the European
Union, considers ransomware the greatest threat in its latest issue of Internet Organised Crime Threat Assessment; the FBI said earlier
this year that between April 2014 and June 2015 it had received nearly 1000
complaints related to CryptoWall, one of the most prolific forms of ransomware,
with total reported losses around $18 million; and according to a panel
discussion at Georgetown Law’s Cybercrime 2020: The Future of Online Crime and Investigations
conference in December 2014, ransomware represents the future of consumer cybercrime.
Undoubtedly, ransomware is on the rise. But it
still represents only a fraction of threats that systems and data of both
organizations and consumers face. This is why the idea of “At worst, we’ll pay
up the ransom” is so bad. Ransom should not be considered a price for a very
special form of a security audit.
Remember: it’s not “mere 500 bucks” that is at
stake. It’s your data that can be lost, and your customers that can lose their
trust in you, and your compliance that can be questioned, and …
Do you really wish to see yourself totally
dependent on ‘cybercriminals’ customer service’?
If not, stop considering the ransom an option and
improve your IT security and resilience.
