Ransomware: Should You Pay The Ransom?
Security professionals dread the day when they get the call that ransomware has infiltrated their network and has already started encrypting files, drives and network shares.
After the initial shock has worn off and the ransomware is no longer encrypting new files, the decision quickly turns to whether to pay the ransom in order to (maybe) recover the files.
Noticeably absent from this article is the actual answer to that question. That is because there are lots of issues and questions that go into this decision. I want to highlight some of the issues you will face and help work through the answers.
1. Can you live without the files?
Files encrypted by ransomware are locked and cannot be viewed or accessed by anyone in the organization. It is important to catalog the extent of the loss. Files can be grouped based on how critical they are to the organization.
2. Do you have backups, and if so, how recent?
The existence of backups for encrypted files gives you options. You might have the ability to recover encrypted files through your own backups. The existence of backup varies by company and by type of system that has been compromised.
3. Recovery
If you have backups of the encrypted files, how quickly can you recover from backup? Companies have varying strategies for backup/storage and retrieval. Recovery can take multiple days. When that happens, paying the ransom may be a viable alternative to restore files more quickly.
4. Do you have an obligation to outside parties?
File availability requirements may impact your decision-making. If you need to have files available quickly, that may tilt the balance in favor of paying the ransom for the possibility of recovering them quickly. Obligations may be to customers, suppliers, regulatory organizations, legal entities and many others.
5. Is it possible to decrypt the files without paying the ransom?
Some ransomware is not well written. If you are lucky enough to have become infected with a weaker variant of encryption, it is possible to use a recovery pack. A good resource for identifying and remediating some types of ransomware can be found in this list of decryptor tools.
6. Assess the likelihood of getting the encryption key after paying the ransom
Not all ransomware organizations are trustworthy (big surprise). Some will take your money and not provide you with the decryption keys.
On May 20, 2016, Kansas Heart Hospital paid a ransomware organization an undisclosed amount, only to have the organization extort them for a second time for additional money. The hospital refused to pay the second ransom, stating: “The policy of the Kansas Heart Hospital in conjunction with our consultants, felt no longer was this a wise maneuver or strategy.”
7. Other risk factors
You need to consider reputation, regulatory and financial risk when deciding whether to pay or not pay the extortionists. Make sure you’re considering all angles.
The recommendation from the FBI and several non-government organizations is to never pay a ransom. Some reasons to not pay the ransom include:
- There is a possibility that you will not get the files recovered after you pay.
- It encourages bad actors to continue developing ransomware.
- You fuel a perception that you are weak by giving in to the bandits.
- You fuel a perception that you are inept if you don’t know how to prevent/resolve security breaches.
- In the real world there are other issues that need to be evaluated when deciding to pay the bad guys.
- Locked files are critical to your business or represent a significant investment.
- Operations are compromised because of the locked files.
- There is no backup, so the files would be lost forever.
- Restoration of the files will take a significant amount of time and will impact business.
- Need to divulge lost files to customers.
- Regulatory consequences for the lost files.
So while it is easy to say, “Never pay the ransom,” sometimes there are practical considerations that need to be evaluated.
Ransomware victims pay less than they expect!
However, if you’re a cyber-criminal looking to enter the ransomware game, but not sure how much money you should demand for the unlocking of a victim’s files, don’t worry. Kaspersky Lab has done the research for you.
The security firm, together with B2B International, says people value their smartphone data, on average, at $682. In 39 percent of cases, the figure exceeds $1,000. On the other hand, cyber-criminals which have managed to lock a victim’s device through ransomware, usually demand $300.
"These figures explain why so many people are willing to pay extortionists, and once again, demonstrate the need for preventive protection measures against online threats", the two companies say.
The ransomware situation has been called an epidemic quite some time ago, and it is obviously going to continue, as long as people pay ransom. And in that respect, things aren’t looking too bright. At least 40 percent of victims decide to pay, Kaspersky Lab says.
They do that, mostly because they don’t backup their device, and then fear things like photos would be lost forever.
