In this video briefing we'll reveal the inner workings of the very modern phenomenon known
as ransomware. No longer a ragtag army of grifters, its increasing impact is now driven
by dedicated teams working within an organized business framework. The US government manages a
portfolio of risk that no corporation can imagine. Some risks are easy to guess: a terrorist attack,
a financial crisis. Then there's a whole new category that sits on its own:
cyber terrorism. In the last few years in America, the two most remote and unexpected events were an
airborne virus that wiped out hundreds of thousands of lives, and a random series of
cyber attacks that left the country without access to vital services. Managing the biggest portfolio
of risks in the history of the world - and yet the US government confessed openly that it hadn't kept
up with the world we live in. Worse still, it spent too much time being bewildered because
such attacks were no longer hypothetical, they had become an actual thing. Cyber warfare has
become the great leveler. On the international stage, it represents an opportunity for non-state
actors to give any superpower a bloody nose. Understandably, major corporations like Apple
were left quaking with their intellectual property and customers now fully exposed. And it turns out
that very few of them wanted to talk about it fearing that acknowledgement of the risk was
an open invitation to be hacked. The mere idea of your business data being encrypted and copied is
insidious. However, no organization should leave ignorance and grievance to drive policy,
so let's rectify misconceptions to one of the most spellbinding yet alarming corporate threats
today... that critical pipeline at the center of the cyber attack it is back up and running this
morning as we are learning the company paid the hackers millions in ransom... On May 7th 2021,
a large chunk of the Colonial Pipeline, running from Texas to New York City, was shut down. The
wall between the 'essential' and the 'inessential' had been breached. The FBI hadn't seen the attack
coming and as the operator put it after paying the hefty $4.4 million dollar ransom price tag:
"Everything we do is coordinated to the minute, when you throw a seven hour wrench into it,
it takes months to reset properly." It isn't the bad intentions of the actors that's the concern
here, in this case the Russian group 'Darkside' - so much as the evolution of the practice itself.
Ransomware operators have evolved their business models. No longer content to solely
target individuals, making only a few bucks at a time. As an entity possessing only moderate
cyber warfare capabilities, they could with a little more organization attack a country
somewhere like the United States. By extension, malware could also stop air traffic in Paris
a grind Philadelphia's trains to a halt. In the end they picked on a Texas pipeline - bringing
South Carolina to a standstill. The first real modern ransomware program dates back to 2005
with the release of PGPCoder. Victims would visit an infected website, which would take
advantage of inherent flaws within the browsers. As time progressed, ransomware strains shifted
from symmetric to asymmetric encryption, further frustrating efforts from the security industry
to create practical decryption tools. The monetization strategy changed too,
with cryptocurrencies replacing other more easily traceable methods. The notorious SamSam malware
that emerged in 2016 did not rely on human error to proliferate. Its conceit was to exploit web and
file servers and was deliberately positioned with public sector organizations in mind...
And of course, no one was quick to calculate the financial risks - because no one dared to make the
evaluation. It's as if a whole new department needed to be set up to combat the attacks
or somehow, to find a security guru who knew how to respond to a particular strain of the attack...
the city of Atlanta is also dealing with a major cyber attack. Hackers froze computer systems and
demanded payment and in a Tweet the city said the attack caused... After the SamSam outbreak in 2018
the city of Atlanta faced a $51,000 demand to unlock all compromised computers. The final
ransom bill topped $2.6 million after accounting for disruption to services and the expense of
remediation. And so, we arrive at the latest generation, with ransomware operators adopting
a franchise model almost akin to a fast food restaurant chain, like McDonald's. So, how can any
organization survive the idea of the "worst thing" that can happen to you? First off. Managing risk
is an act of the imagination and government officials and companies are good at responding to
a crisis, less good at taking actions to prevent them in the first place. Every measure today is
about progress. Progress in society, progress in the economy and because you think the world acts
in this way, the ransomware attack can be a big shock. This is not a trivial point. But progress
is also about keeping up - and in the book of business challenges, this is just one more new
challenge. And if leadership doesn't care about the challenge then the people who really will care
are your stakeholders, because they have an interest in what's going on beneath the soil.
Companies crumble too easily so why wouldn't you try to wrestle the threat down by making
a plan? There are a lot of seriously smart people working around the problem today. Ransomware isn't
the most delightful of considerations, but it is necessary. The key point to understand is that if
you're held hostage, you're not in an impossible position. You just need to get your frame of
reference right. Being vigilant about a ransomware attack is no different to being vigilant about
fraud. Of course, ransomware events attract huge media attention but the events in themselves are
the same. The best place to start is within your own incident logs. A historical analysis of events
will shine a light on where issues are more likely to occur. In most cases, these will boil down to
a handful of key attack vectors. This reality is illustrated by the '100 Threat Intelligence
Report' illustrating attackers' disproportionate preference for social-based tactics.
Note spear phishing accounts for 45% of all incidents recorded. On a more fundamental level,
organizations must practice good security hygiene, ensuring that all systems are running the most
current version of their operating systems with all the associated applications and libraries.
Updates must be performed like clockwork, limiting the time opportunity for an attacker to exploit.
Whether you're working remotely or in an office, what really matters is having a well-organized
plan in place to respond to the contingencies if they hit. Any strategy should include the routine
encryption of all virtual machines and online backups, paired with regular offline backups.
Security insurance can lessen the fiscal impact, with some providers even willing to make ransom
payouts where appropriate. And, because ransomware attacks are almost always public, decision makers
should reconsider their communication strategies and lift their workforce that extra notch to cope
with this kind of sophisticated attack. The key is to spread best practice on the
point and promote this kind of thinking - it's the economically efficient thing to do. Yes,
there are high-tech forces out there managing a new generation of cyber threats - but,
until the court of international justice rules on the use of ethical algorithms, there's a lot you
can do right now to mitigate the ultimate effect of a ransomware attack on your organization.