Hello everyone welcome to salted hash, my name is Steve Reagan senior staff writer at CSO online today
We're going to be talking about some moral dilemmas when it comes to ransomware
And I'll be joined by Robert Gibbons the CTO of Daddo. I'll be right back stay tuned
Robert how are you welcome to the show?
I'm great. Thanks for having me
I'm very happy to have you this this conversation you and I were having about the
The back ends of ransomware was very intriguing. I liked it so carry that we get to playing a lot and
We work with all businesses. This is the community that's hit by ransomware the worst
Oh yeah, and I would imagine that you know in the SMB space
This is a very common dilemma that they they come up, so let's let's just jump into it real quick. We've got
here lately
Health care has been been targeted pretty pretty bad with ransomware going forward. We've got what Hancock health who paid
$55,000 to recover their files
and you have all scripts who they had an outage that lasted upwards of six days while they went to recover and
At that point when the recovery was happening
You know they were bringing their systems back online just fine
but their patient or
Their customers rather had no access to any of the tools and support wasn't giving them the answers they needed. It was a real mess
so
When you consider your incident response plans? What is your advice to customers when do they know whether or not?
They should pay a ransom when it comes to ransomware
So whether to pay or not is really a function of a lot of prior decisions that you made before you got infected so
Usually pretty clear when you are infected
you either have
what I would call like a continuity strategy a way to keep running, or you don't and
Usually when you see big companies pay up? It's because they had a backup strategy meaning. They had the data
It was archived. They could get it back, but it would take days and days and that's unacceptable obviously in health care context, so
The you know the the pay or not pay really comes down to what are your alternatives and?
Sometimes you have none or the backup
Solution that you have would take too long to actually recover and so that's when you see companies pay the the Hancock
Hospital there their CEO made a really
Really important point to me and when it came to paying the ransom, which was only fifty five thousand dollars
He made a comment to a reporter locally that
They priced it just right now before we started recording you and I were talking about the pricing schemes
Let's circle back to that conversation when he says they priced it. Just right. Where do you see that conversation going?
What do you think about that?
So I he's referring to the ransomware developer. It's nice to just write some crook over
You know somewhere that came up with this software um and we run into this a lot where
$55,000 would be too much for your average home user and home users get infected a lot as well
And so ransomware if you could consider it a business model
They've had to come up with a way to differentiate between different classes of customers, and there's a lot of techniques they use
Having Hospital record software on the machine. That's infected is a pretty good sign that
You're you're gonna pay a lot because you're handling private patient data, so I'm not sure about the particulars of this infection
But it's not surprising that
You know based on the number of machines and the data and the types of applications that were running
That they came in at a number that was
palatable but
Not something every business would necessarily pay so
When it comes to actually paying it's a risk it's almost like you're gambling whether or not you're gonna get it back. I mean
when your customers see something that's moderately affordable to them and
They start to consider the options like maybe this is the right way to go about it. What advice do you have for them?
So I'll say across across the board
I mean, I'm obviously buys
But our customers don't face that choice because um they don't have to they never pay the ransom because they have an alternative
They cannot they can virtualize and spin up and and recover
to you know five minutes ago, so
the types of things that
People think of when they when they consider whether to pay, I'm sorry question was just
No, I ant something you didn't ask I think no no no it's it's all good
So we'll start back over when it when it comes to you know paying the ransom
It's a risk in it like you're kind of gambling at that point so when your customers see
a reason of to take the the CEO at Hancock Health to to say that the
The ransomware author priced it just right in getting their files back versus you know what they need now I understand with your customers
It's a little different
But by and large what advice do you have to the SMB space when they see that?
Reasonably priced ransom versus all the time spent to recover yeah, so we've surveyed our
Partners on this to see how often when the ransom is paid do they actually not get the files back. He's remembered
This is I'm not a legitimate business this was someone
that's trying to steal from people that develop this and you have to trust that they had enough morals to
You know take your money in effect your machine, but if you pay that they'll hold up their end of the bargain
That's not exactly a sure a sure shot so about three out of four times people do get their files back
So it's not a horrible strategy if it's your only alternative, but twenty five percent of the time
you won't get your data back and a
lot of the more modern ransomware variants have
Where you'll get back less of your files over time so if you wait a few hours you get you know ninety percent
If you wait a few more you'll get eighty percent, so we still see situations. Where someone's paid, but they lost some data
Yeah
And I I think those business models for the the ransomware those are
Those are the ones that you actually see on some of the forums where the the criminals fight amongst themselves
Because he's ruining a good thing for everybody else by saying if you don't pay me right now
You're taking a 10 percent loss on recovery or 20 percent loss on recovery
And the other criminals really do get angry at that point. Um there was one guy who had his entire source code kit leaked
everywhere else like they published the the back end so that you can decrypt his stuff because a parent was really weak crypto and they
Did that because what was what he was doing is basically a cash outs camp and people would pay the ransom
But he wouldn't recover any of the files and so they were like aha no and it's in their interest honestly as to
restore your files after you paid because that
encourages other people to pay if they know they're gonna get their files back if they pay and
Earlier you and I were talking again, but this this whole payment thing is
Why the economy is there earlier this year?
so did a report where we looked at the the the economy of ransomware like the criminal business model behind it and
The the person I interviewed at the time Rick
From carbon black he had actually made a really good point that if everybody stopped paying for ransomware. It would probably go away
It's a very fickle business model if one half of the triangles missing its
it's all gone and
as long as people are paying that stuff's gonna still be around and I was very interested in your ear take on this when
You had said that you know it's almost like gambling and sometimes you're gonna lose
And I think that's the really big problem Hancock health gamble and they won this time. They got their files back by paying that
reasonably priced ransom
But then you look at the case of all of the other scientific databases that got wiped out by ransomware when when their
Databases were left exposed to the public and they were literally being it corrupted
Left and right even if they did pay they never got anything back that the data was just gone
At that point and that's that's just horrible so
looking forward
Or forward. I should say when you when you're going with
Advisories and advice to your clients. How do you tell them to prepare for ransomware?
Yeah, um I think
Given the ubiquity of computers and everyone from the person at the front desk. You know into the warehouse at a business will have
Computer connected to a network um it's almost impossible to completely prevent yourself from getting ever
Infected any computer and so it's a response strategy in every case I mean there's tons of steps you can take
But um, you know the list of big businesses medium
And small that have been infected even with protections is enormous
And so this is a you have to plan if this is going to happen eventually and what is your strategy?
And what is your tolerance for downtime when that happens is usually the counsel I give them
And there's a lot of businesses where the only thing they're concerned about is. I don't want to lose my data forever
There's actually an easy problem to solve and and has been solved for a long time so tape backups are a great example
You know like if the building burns down. How do I not lose my data?
But if six days of or one hour of downtime is too much and for a lot of business these days it is
you have to
Move from just worrying about do I lose my data forever to can I use it continually even if something bad happens
Yeah, and that that's a that's a that's a quantum leap and a change in thinking
Yep, so going past the hospital ransomware attack recently all scripts suffered and ransomware attack
And they had the complete opposite response in their IR plan
But there was a really big hiccup and the fact was while they had backups
and they were able to restore from those backups the process took a really long time and
You know after three days of hard core outage on Tuesday following the the previous week's attack
they
Said that their customer that everything was back online except their customers couldn't access a single thing and in the healthcare industry
That's that's really bad, but when it comes to you know the adage of if you have backups and you recover from your backups
You're good to go on rant away. It just doesn't cut it these days, right?
I mean you have to have a continuingly or a continuty
Plan in place to just keep that stuff moving no matter. What what do you advise the customers on that regard?
Yeah, so
I'll try not to make this too much about data, but this is actually the area that like we specialize in which is
we certainly backup data, but also have the mechanics to at any moment bring up any of your machines that got infected and
Virtualize it and allow you to continue using and interacting with that machine from a backup of say five minutes ago
And so that's the second part is you can keep running during a disaster, that's a great strategy
and then usually what you'll do is you'll wipe the infected machine and
At a time of your choosing say in the middle of the night
you can copy back to all your production environment, but having access to a
continuity environment and
being able to plug your backup solution in
with that is is really the key combination that that protects businesses and lets them not have to pay ransom so that
No good
sorry that the example you used of they they had a backup strategy it took them three or six days is not uncommon um
running end-to-end tests of
like a restorer is hard because it usually requires tons of hardware a lot of orchestration and
It's so IDT departments. Don't do it at best once or twice a year
and it's usually a small part not if not a full simulation so
What we do is
Uh every backup we take we actually will boot and and
Verify that that machine can can be virtualized and run and so if you think about it. You've got you know if you do hourlies
All week long you've got tens of times where you've done a mini little restore
And and if you're when you're doing it that much then you have confidence that if something goes wrong
I'll use it if you've just got a solution that once or twice a year you dust off and
and try to do a mock recovery
That's gonna happen. You're gonna. You're gonna find when you actually have to use it
You're not ready
So why don't you why do you think more?
Organizations are doing the instant virtualized backups where you can just spin up the instance and recover right then and there
Versus the the hardened adage of we've got these tapes
let's restore from the tape let's put it back up one server at a time with virtualization being so frequent and
Accessible in the enterprise. Why is that happening more often?
Yes, so
Was an extreme example, but uh there's a lot of instances where a company's gone virtual
So you know Bert's environment VMware hyper-v or whatever, but?
often the recovery environment
They they don't think through so if your production environment is compromised your primary cluster you can't
Recover into that and so their virtual theoretically they could spin it up
But they don't have the mechanics to take a backup image and actually bring it into that environment quickly and bring it up
When the primary environment has been compromised and and so you'd be surprised how many people by our physical appliance even though
They're running a VMware cluster because when you ask question. Hey if you're on VMware what happens if that cluster fails. Oh snap
I can't have my backups on the same thing that's running my production for some reason. That's a learning for some companies
That seems like a really steep learning curve if you get caught out on that one
That's a painful lesson to learn
So before we wrap this up when it comes to the moral argument of paying ransomware. What advice do you have the people out there?
Um I mean, I'd say you know turn your priest your pastor. I'm not a moralist I've
Noticed and I am I I think you should orient yourself to never have to be in that position, but when you are
there there might be some cases where you know what pay up for your sin because
Three out of four times you probably gonna get your data back. I think if that ever happens. It's it's it's indicative of you
Don't have an IT and continuity strategy
And and that should be a wake-up call if you manage to get your data back in fact a lot of our partners
When they when they bring out our solution initially a customer would be like yeah, that's a little too expensive
They get hit with ransomware. Hey, let's talk about that data thing again like that's that happens a lot these days um
Just because it's so prevalent right now excellent. Thanks a lot for taking the time to talk with us Robert
It was a pleasure having you on and I hope you have a good one for those of you don't like to learn more about
Ransomware feel free to look us up at CSO online.com i'm steve reagan's senior staff writer, and this been salted, hash
I'll see you next week