Kaseya decided to work with the FBI and the United States Cybersecurity and Infrastructure Security Agency (CISA). Nineteen days later, they got a universal decryptor key, gave it to the organizations that were impacted, and returned to business. However, it wasn’t—and may never again be—“business as usual.” Similar to their servers in July 2021, Google searches for “Kaseya” return results plagued with the term "ransomware." For everyone else, the Kaseya saga is a sobering reminder: If a cybersecurity company can be breached, anyone can.
This reality raises an uncomfortable question: What should you do if you get attacked? And more specifically, what’s the best way to negotiate with digital terrorists?
Let's take a look at the ransomware negotiation process in the event someone holds all your files hostage. We understand this is a complex issue not easily solved in a single blog post. But this is a pressing issue as you might be hit tomorrow or . . . never. While we do cover what to do during the negotiations, and how to manage the aftermath, every situation is different. If you're reading this while systems are down; contact us immediately to get started at John.Bassett@getgsi.com or 877-474-4262 x703.
Ransomware is a kind of malware that’s able to prevent users from accessing a computer or network until they pay a ransom. If the company or user pays, they have to trust that the attacker will provide them with a decryption key to unlock their system—or that the hacker will unlock the system from their end. While
There were 304 million ransomware attacks around the world in 2020, and through 2021, 68.5% of organizations surveyed had been attacked.
Statistically speaking, if you choose to pay the ransom, you stand a decent chance of getting your files back: 60% of organizations that made the first ransom payment regained access to their systems. However, your chances of getting your system back will vary depending on the attacker. Some cybercriminal organizations, such as REvil, have a reputation for fulfilling their end of the bargain and granting access after payment. Some others may take the payment and disappear.
It’s important to note that the federal government’s position on whether or not to pay the ransom is clear: The FBI’s website says, “The FBI does not support paying a ransom in response to a ransomware attack.” They reason that paying “encourages perpetrators to target more victims.”
That being said, a lot of companies have decided to pay, and there are some legitimate reasons why.
Paying the ransom, for some companies, has been a difficult but effective decision. In many situations, the effect of an attack, when stretched out over days and weeks, costs far more than what the attackers are asking for. The data and systems the attackers are holding hostage have both tangible and intangible value, prompting the ransomware negotiation process.
For example, companies can avoid losing customers if they regain control of their systems soon enough, and they can protect their reputations if they can prevent hackers from releasing sensitive information to the public.
In addition, many companies carry cyber insurance. This covers ransomware attacks, so if they pay up, their insurance policy can reimburse them for some or all of the money. In addition, paying the ransom quickly can make it easier to hide the breach from authorities, which, in turn, helps prevent it from becoming a widely known—and potentially embarrassing—event.
As soon as you get hit with an attack, your first step should be to ascertain the value of the files or systems that have been hijacked. After a careful valuation of your hijacked digital resources, which is often best performed by a professional cybersecurity company like GSI, you may discover the following best-case scenarios:
However, your analysis may also reveal that you don’t have adequate backups or redundant or parallel systems in place, and the data or infrastructure that’s been hijacked is essential to your business. Therefore, you may be faced with paying the ransom.
If you decide that paying is an option, your first step is to gain an understanding of who you’re dealing with, particularly their track record when it comes to decrypting files and systems. Using a professional tone:
After the negotiation, the work of preparing for the next attack and mitigating the damage begins, including any public relations fallout. You should take the following steps:
Of course, prevention is better than a cure, but considering the sophistication of cybercriminal groups, nearly any organization is vulnerable, regardless of the security measures they have in place. When this happens, it’s best to seek help from experts in ransomware negotiations.
Cybersecurity by GSI can help with pre-attack defenses, post-attack analysis, and negotiation strategies. GSI's cybersecurity experts can position your organization to minimize the impact of an attack—or prevent it altogether. Connect with GSI today to learn how.
ABOUT THE AUTHOR