A CISO’s perspective on ransomware payments

A debate is raging about how organizations should respond to ransomware attacks, particularly if victims should pay, or just rely on cyber insurance. The recent Biden administration executive order on cybersecurity and other proposed bills that limit or ban ransom payments and mandate reporting of ransomware attacks put pressure on enterprises to update their strategies and prepare for change.

But Anne Neuberger, deputy national security adviser for cyber and emerging technology, said during a wide-ranging interview with the Silverado Policy Accelerator that banning ransomware payments would be a “difficult policy position.” So, should businesses make their own decision on ransomware or take cues from eventual federal legislation?

Until recently, I was subscribed to the “never pay the ransom” school of thought — partly informed by being a DC native, my proximity to the Department of Justice, and the prevailing attitudes within my professional groups. My stance was also motivated by my professional responsibility of managing vulnerabilities associated with ransomware attacks. I could not control the threat actors or their motivations, but I could control my organizational vulnerability to their ransomware arsenal by rearchitecting our security.

My position took a U-turn when a ransomware attack impacted a family member and small business owner in 2019. The business had an office staff of seven people, and the executive secretary fell victim to a phishing email. The company worked with its outsourced IT administrator to recover the data while the ransomware author offered to fix its problem for $4,000. The small business had an annual revenue of just over $2 million and relied completely on customer appointment data and files that were encrypted and held captive. The IT contractor worked over two days but that didn’t yield data recovery or restoration.

I was then asked to examine the environment for a second opinion. I found myself amid a moral conundrum: Would I acquiesce to what was, at that time, my firm belief against ransomware payments? I validated the contractor’s assessment that data recovery and reconstitution were not possible due to a lack of a recent backup. I weighed the business impact of not being able to service customers on Monday morning with scheduled appointments and decided it made more financial sense to pay. I prepped my family member in the negotiation for the ransom demand, which he and his business partner facilitated, and reported the incident to the Internet Crime Complaint Center (IC3). We received evidence that the data decryption was successful on a sample, made the cryptocurrency payment, and reported the incident to local authorities.

To read the complete article, visit Dark Reading.