By Kurtis Minder, CEO, GroupSense
During the pandemic a parallel threat began permeating, driven partially by COVID itself. Ransomware attacks have increased exponentially over the last year and a half, impacting businesses of every size and profile. Yet, many companies believe it won’t happen to their business. For every Colonial Pipeline on the news there are thousands of small-to-medium enterprises impacted. Many of these go unreported.
Ransomware is not new. Some of the earliest iterations of ransomware attacks occurred as far back as the 1980s, using floppy disks and money orders. In the early 2000s it shifted to internet-based attacks and gift cards. Ransomware evolved and accelerated around 2010 with the advent of cryptocurrency. This afforded the attackers ease of transacting, anonymity, and was devoid of regulatory oversight. As ransoms went up, the frequency of attacks also increased. The latest surge has been impacted by the reduced sophistication required to carry out attacks, and the COVID remote work model. Because of this, remote workers will be the main target of cybercriminals throughout 2021 (Security Magazine, 2020.)
Today, Executing ransomware requires very little technical aptitude. A would-be attacker only needs the capability to access the dark web, where one can buy stolen network access from any number of businesses and then license ransomware deployment capability from Ransomware-as-a-Service platforms. The attack surface of victims is also plentiful, as many companies set-up remote access to provide systems connectivity to remote workers without proper security controls.
As a ransomware negotiator, I have had the bittersweet job of being in the middle of these attacks. My team and I are brought in post-attack to help businesses assess the business impact and understand the adversary, so that the impacted business can decide whether to engage with the ransomware operator. Should the business decide to do so, myself and my team act as a liaison, assisting with the negotiation, compliance, and settlement. While we have worked with some of the largest, newsworthy companies, it is the small-to-medium enterprises that concern me the most, as those businesses’ ability to recover from the operational, public relations, and breach fines are minimal.
Read More...