Cyber Security Awareness Poster
Paying Won’t Save You – The Case Against Ransomware Payments
Ransomware attacks have escalated, targeting organizations across various sectors. When faced with encrypted data and operational paralysis, the immediate reaction might be to pay the ransom. However, authoritative agencies like the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) strongly advise against this course of action.
Why Paying Ransomware Demands Is Detrimental
- No Assurance of Data Recovery – Paying a ransom does not guarantee that you will regain access to your data. There have been numerous instances where victims paid, yet the decryption keys provided were ineffective or never delivered. The FBI emphasizes that paying a ransom doesn’t ensure data recovery and may embolden adversaries to target other organizations.
- Encouraging Criminal Activity – Ransom payments fund and incentivize cybercriminals, perpetuating a vicious cycle of attacks. By paying, victims inadvertently finance the development of more sophisticated ransomware variants, increasing the threat landscape for all. CISA’s #StopRansomware initiative highlights that succumbing to ransom demands fuels the ransomware economy, leading to more attacks.
- Legal and Ethical Implications – Transferring funds to ransomware actors can have legal ramifications, especially if the perpetrators are sanctioned entities. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 mandates that critical infrastructure entities report ransomware payments to CISA within 24 hours, underscoring the seriousness of such transactions.
When a ransomware attack strikes, cybercriminals lock down your files and demand payment for the decryption key. Unfortunately, the pressure doesn’t always end there. Many attackers even use double- or even triple-extortion tactics to squeeze additional money from victims.
Double extortion: After the initial ransom, attackers threaten to release or sell sensitive information unless another payment is made.
Triple extortion: Beyond leaking stolen data, criminals may also demand additional payments from individuals connected to the breach, such as customers or business partners, putting even more people at risk.
Proactive Measures Over Ransom Payments
Instead of considering payment, organizations should adopt the following strategies:
- Regular Data Backups – Maintain offline, encrypted backups of critical data. Regularly test these backups to ensure their integrity and availability during recovery scenarios. Offline backups are crucial, as ransomware actors often target accessible backups to increase pressure on victims.
- Incident Reporting – Promptly report ransomware incidents to relevant authorities. The FBI and CISA can provide guidance and support during such events. Early reporting also aids in tracking ransomware trends and preventing future attacks.
- Implement Robust Security Protocols – Adopt a multi-layered security approach, including regular software updates, network segmentation, and employee training on phishing and social engineering attacks. Proactive defense measures can significantly reduce the risk of ransomware infections.
For a handy reminder on backups to hang in your office, see last month’s free security poster.
Case Study: The Hive Ransomware Takedown
In a notable operation, the FBI infiltrated the Hive ransomware group in July 2022. This covert action allowed the agency to provide over 300 decryption keys to victims under attack, preventing approximately $130 million in ransom payments. This case exemplifies the importance of involving law enforcement rather than yielding to criminal demands.
Conclusion
While the pressure to resume normal operations swiftly can make ransom payments seem like a viable solution, the broader implications reveal significant risks. Paying ransoms not only fails to guarantee data recovery but also perpetuates criminal activities and may entail legal consequences. Organizations are urged to strengthen their cybersecurity frameworks, maintain regular backups, and engage with law enforcement agencies to combat the ransomware menace effectively.
CourseVector grants permission to use this artwork for any non-commercial purpose as long as the CourseVector contact information remains, as is, on any reproduction or use.
