Ransomware: Should you pay or not?

Ransomware is a type of malicious software that encrypts the victim’s data and demands a ransom for its decryption. It can cause significant disruption, damage, and financial losses to individuals and organizations. As a result, while comprehensive security plans prioritize defence, they must also tackle essential queries: “How should the organization respond to a ransomware attack?” and “When should the possibility of paying the ransom come into play?”

[FREE E-BOOK] The Definite Blueprint for Cybersecurity in Manufacturing

What are the key factors to consider when seeking a solution?

Considering Ransom Payment: Key Considerations

1. Financing Cybercriminals

The act of paying ransoms contributes to hackers’ profitability through ransomware attacks. Furthermore, the decision to pay becomes public knowledge, potentially eroding customer trust by creating an appearance of collaboration with cyber criminals. Thus, paying, although occasionally unavoidable, is generally ill-advised.

2. If you pay once, you’ll probably pay again.

Once a business complies with a ransom demand, it increases the likelihood of future attacks. Cybercriminal groups take note of successful payments, heightening the chances of the same business becoming a target once more. Opting to pay a ransom should come with the understanding of potential future threats.

3. Balancing All Considerations

In some instances, businesses face the necessity of carefully assessing all factors at play. Some organizations struck by ransomware lack the means to swiftly recover their data or online presence independently. In such scenarios, it becomes imperative for groups to calculate the cost of downtime during an attack. Understanding the hourly cost of downtime and potential losses resulting from a ransomware incident—spanning aspects like reputation, contracts, stock value, and workforce efficiency—is crucial. When the ransom demanded pales in comparison to these potential losses, the notion of paying may emerge as a viable short-term financial decision.

4. Comprehensive Data Retrieval is Uncommon

Contemporary malware groups employ diverse strategies to extract funds from victims. Beyond merely encrypting data and systems, these groups often resort to data exfiltration, demanding payment to prevent the sale of sensitive information to third parties. This tactic proves particularly effective when attackers gain access to private customer data such as financial records or health information. Opting to meet ransom demands involves engaging with criminals. Yet, one must seriously question the likelihood of these attackers, who resort to hostage tactics, honouring their commitment to return the data without exploiting it for their gain.

Regaining full access to all data is an infrequent outcome, and even if achieved, the process can span several months. Hence, paying doesn't guarantee swift online restoration.

Considerations Against Ransom Payment

1. Ethical Considerations

Choosing not to pay a ransom aligns with ethical principles and is the appropriate course of action. This approach is grounded in moral responsibility. In certain jurisdictions, paying ransoms is even prohibited by law. However, while it's a morally sound choice, it may not always align with the organization's best financial interests.

2. External Recovery Challenges

Despite the potential drawbacks of ransom payment, the consequences of data loss due to an attack can be catastrophic. Achieving complete data restoration often demands months of effort and entails reconstructing data from various sources.

Regular backups are commonplace for most businesses , yet there may be a timeframe where data remains unsaved. Data loss can vary from manageable to irreparable depending on the business's scope. Regardless, refraining from ransom payment might prolong the data recovery process, potentially straining IT teams.

3. Existential Threat to Businesses

In the direst scenarios, ransomware has the capacity to force businesses into closure. Disregarding ransom demands could lead to unrecoverable losses, ultimately causing business failure. Before rejecting ransom payments after an attack, a thorough evaluation of the severity of the situation is imperative.

Navigating the Solution

When confronted with ransomware attacks, companies often find themselves in a position of limited control. They are subjected to the whims of hackers, who can strike at any time and in various ways.

A two-pronged strategy encompassing defence and resilience is crucial to effectively prepare for such attacks.

Defensive Measures:

• Educating employees about ransomware, its intrusion methods, and user account vulnerabilities.
• Incorporating robust patch management practices while supplementing them with aggressive red teaming exercises.
• Establishing routine backup procedures and consistently testing backup and data-recovery protocols.
• Implementing network and system segregation to prevent the spread of attacks post-infiltration.

Furthermore, organizations must contemplate optimal responses to minimize disruption as they develop security plans. Swift event size determination aids in conducting forensics to ascertain survivability against the attack or the feasibility of ransom payment.

Security programs should primarily strive to heighten barriers against system breaches and streamline responses to attacks, thus eliminating time wasted on deliberating whether or not to pay. The overarching goal remains twofold: thwart attackers' entry and expedite reactions to prevent undue delays.