Will we ever see an end to ransomware attacks?

Question

Answer

You have to assume it's going to happen. The news on Colonial Pipeline is too fresh to be able to say anything about their response actions. It’s all speculation as to whether or not the malware really propagated through the environment and got to the devices that manage the flow of the gasoline, or whether or not they pulled the plug on it all. We don't know if their cure was worse than the disease.

Answer

I think ransomware attacks happen more than we hear about. One of my friends is a CFO of a building company and they got hit by a phishing attack. An IT administrator fell for it and the attackers got access to the machines. What’s interesting about how it spread is that they use Office 365 for email collaboration and none of the cloud services were compromised. It was their construction accounting software that was running on older Windows servers.

Those machines got destroyed and encrypted. They hired a crisis response company to come in and kind of negotiate with the hackers, but it was like negotiating to buy a car. And they paid to get the encryption keys back. I feel like that could have happened to any company with any software/equipment combination. I don't know if Office 365 was just that resilient, if they were lucky, or the legacy construction accounting software was just low-hanging fruit.

Answer

Some devices, whether they're supervisory control and data acquisition (SCADA) devices, or programmable logic controllers (PLC)—even a quarter-sized Arduino microcontroller—can be penetrated so easily. What I wonder about the pipeline is, along such a long stretch of equipment, who could have stuck a third-party, homemade set of boards together and used the pipe itself for transportation back into the network?

Resource companies have been testing how serious a problem this is because there was a mining operation recently that used all-digital machines made by a huge equipment manufacturer. They had a close call where people were almost killed because the operator could not stop the vehicle. A crew was working in its path and it had no way to steer or break. It was just by luck that nobody was killed, but more of these incidents are coming. In situations where you have that many devices, it's not a bad idea to look to the IIoT for some of the things happening recently and the fixes that have been emerging, even those as simple as building a device with no plug, à la Apple. We tend to overlook the simple fixes because we're so involved in the technology.

Answer

As long as people / companies continue to pay the ransom, the attacks will continue.

Answer

I don’t think ransomware attacks are going anywhere.
With more and more tech adaptions the attack surface is ever expanding.

Today your data is encrypted, tomorrow your digital wallet or your IOT landscape may be the hostage.

Tactics may change but the war will continue

Will we ever see an end to ransomware attacks?

Content you might like

What technology solution are you using for your employee experience platform? How does it integrate with your HCM solution and intranet solution? Any do's and don'ts, lessons learned to share?

Where do HR and other non-security/IT departments fit into your insider risk management strategy/program? What role do they currently play?

What are your CEO's top priorities for you this year?

If you had a magic wand - what's the #1 daily business challenge you'd eliminate?

What is the #1 threat to cloud security at your organization?