Securing against ransomware

The tenor for ransomware threats changed as attacks flipped from delivering ransomware through consumer-targeted spam to spreading across networks. The threat of extortion and data exfiltration has yet to wane. 

More than half of CISOs said they were hit by ransomware at least once in 2021, according to a Black Kite-sponsored survey of 250 CISOs. More than two-thirds expect at least one ransomware attack this year. 

Though business leaders are more confident employing tactics to prevent ransomware attacks, confronting risk requires an internal commitment starting from the C-suite down to interns. "Businesses must take acceptable and calculated risks each day — the same applies to cybersecurity," said Theo Zafirakos, CISO of Terranova Security. 

As 2022 unfolds, here are three ransomware mitigation tactics to watch and employ: 

Train, train and train again

Whether negligent or malicious, insider threats are a leading cause of security incidents. Leveraging human behavior is a favored tactic for threat actors, especially when they find loopholes in technological safeguards. 

Companies will continue to invest in their employees, working to evolve  their behaviors to become more cyber-aware.  

"To succeed, organizations must invest in processes and people," said Zafirakos. Companies have put more resources toward training employees on ransomware awareness. This includes ensuring employees know how to report suspicious messages. 

Back to basics

Despite the growing sophistication of ransomware, security controls largely remain within security basics, no matter the tools a company adds. 

Up against more security measures, threat actors pivoted their tactics to turning off mitigation capabilities to deploy ransomware, said Jon Clay, vice president of threat intelligence at Trend Micro.  

This means the security basics have had some modifications. Companies are implementing multifactor authentication for administrative accounts and mission-critical business application accounts. Companies are revisiting patch management strategies so they're based on risk, which takes into account "any vulnerabilities with public proof of concepts and any actively exploited vulnerabilities being patched at once," Clay said. 

Vulnerabilities from ProxyLogon, ProxyShell and PrintNightmare drew ransomware actors last year, according to research from Tenable. Basic VPN vulnerabilities remained a top attack vector, with the potential to linger as forgotten flaws among other highly publicized vulnerabilities disclosed and exploited last year. 

Funds might be recovered

U.S. and international law enforcement pursued one of the most prolific ransomware gangs, REvil last year, and partially recovered funds paid by Colonial Pipeline. Law enforcement will likely become more intertwined in incident response for businesses this year. 

"In fact, this will be the theme for the rest of the decade," said Zafirakos. And given the onslaught of high-profile attacks lately, "the stigma of being victim to ransomware has reduced." 

Industry wants to see more action taken against cybercriminals or nation-state threats, but "they fail in their general deterrence effect to the cybercriminal undergrounds from which they operate," said Ed Cabrera, chief cybersecurity officer at Trend Micro and former CISO of the U.S. Secret Service. This is most obvious in the constant rebranding of threat groups.  

"This is not to say [law enforcement] operations are futile or not effective but rather incredibly effective in developing criminal threat intelligence across the broader criminal underground ecosystem," he said. 

Companies are not federally required to report incidents, which leaves gaps in intelligence for law enforcement agencies. "The vast majority of incident reporting today happens due to legal and regulatory requirements rather than the idea that law enforcement can immediately assist in mitigation," Cabrera said. 

Moving forward, industry wants more collaboration with regulatory agencies in developing realistic cybersecurity mandates. Government needs more insight into how regulations could impact businesses. 

For example, "requiring organizations to disclose an attack before they have a better understanding of the situation may put their networks at risk of other attackers targeting them," said Clay. 

The December ransomware attack against workforce management company Ultimate Kronos Group hindered the ability of its customers to process payrolls. The attack, which has far-reaching ramifications, has stakeholders looking for who is to blame.

Tesla, PepsiCo, Whole Foods, and the New York Metropolitan Transit Authority were among many organizations hit by the incident and resulting outage. 

Employees at Tesla and PepsiCo filed a class action lawsuit against UKG seeking damages due to alleged negligence in data security procedures and practices. The case was filed in the U.S. District Court in the Northern District Court of California. 

New York MTA employees filed a separate suit in the U.S. District Court for the Southern District of New York against the MTA, alleging it failed to pay overtime wages due to the Kronos outage.

The response and recovery from the ransomware attack is UKG's responsibility, but failure to make payroll, a potential violation of the Fair Labor Standards Act and any applicable state and local laws, is the fault of the employer.

"The employers are responsible for making payroll," said John Bambenek, principal threat hunter at security firm Netenrich. "If they're using a third-party provider, and it doesn't get the job done, they're responsible for making payroll."

That doesn't leave Kronos off the hook, however. Kronos offers a service and couldn't provide it, so now the company may be liable to its customers, Bambenek said. Employers can sue UKG too.

Assigning accountability

Another key question is whether the contracts that Kronos negotiated with its customers define who might be responsible in the wake of an incident like this. 

In many cases, commercial contracts between a provider and a customer contain an indemnification clause, which protects the provider from legal action or damage for certain events. Here, the contracts may be written in favor of Kronos.

"Every vendor, especially at the level of Kronos," is going to seek an indemnification clause that benefits them in their contracts, Matthew Warner, CTO and co-founder at detection and response provider Blumira, told Cybersecurity Dive. "They're going to do as much as they can to make sure that if something goes wrong, and if there is any sort of interruption associated with it, they're indemnified for it."

Cybersecurity Dive contacted UKG, Tesla, PepsiCo and the MTA asking for comment on the attack and the lawsuits. The MTA said that it doesn't comment on pending litigation. A spokesperson for Kronos's public relations firm pointed to the latest update about the incident and the company's recovery efforts, but avoided comment on the lawsuits.

Public data

Licensing agreements between the vendor and its customers complicate potential liability. 

Looking at some of the contracts that Kronos had with cities and other public entities, Warner found that they require "gross negligence or willful misconduct" to hold the company liable, he said. 

Otherwise, Kronos may be indemnified for its outage.

"Legal responsibility for hacks is still such a murky thing in the U.S.," said Warner. "Often what we see for ransomware is the multi class-action lawsuit. And often they will just settle before it goes much further into law. There may be some success by people suing Kronos, but I'm expecting it to be small settlements."

For now, no one knows how or why the attack occurred. Kronos could have taken all the necessary steps to protect its data and systems but still been successfully breached. The company told Cybersecurity Dive that it has internal security resources and had monitoring in place prior to the incident but has since been supplementing those resources with third-party support and tools.

Kronos took around six weeks to restore access to the core time, scheduling and HR/payroll services for affected Kronos Private Cloud customers. As of March 4, the company was still in the process of restoring additional applications used by some KPC customers, including Citrix and Workforce Analytics. This means that a full recovery has taken longer than the several days or weeks that Kronos initially estimated. That may point to a problem somewhere in the mix.

"Kronos didn't have a good business continuity plan," Bambenek said. "Kronos does one thing — it's a payroll processor. Can you process payroll when this happens? If the answer is no, you did something wrong, or you didn't have something in place."

Warner said he wouldn't be surprised if the employee lawsuits against employers are successful.

"This sounds worse than I intend it to, but it's not Kronos's responsibility to make sure payroll works for Organization A," Warner said. "It's Organization A's responsibility to make sure they can do payroll in the case of there being an outage with your upstream provider."

For now, legal culpability is a matter that will remain murky until the pre-trial phases kick off for the different lawsuits.

"You're probably not going to know who's truly responsible from a legal perspective until discovery," Bambenek said. "And some people are just going to throw money at the problem to make it go away."

The surge in ransomware over the past year has led corporate boards to take a much more active role in overseeing cybersecurity issues, according to an expert panel speaking at the Rubrik Data Security Summit. Major enterprises are facing heightened risks of data breaches, reputational risk and millions of dollars in ransom payments, legal costs, and lost productivity.

Companies that previously had policies to never negotiate a ransom, now see negotiating a payment as a 50/50 proposition in order to maintain business continuity, according to the panel. 

As the risk of a ransom increases, corporate boards are no longer rubber-stamping assurances from chief information and security executives but are bringing in outside experts, asking more probing questions and preparing themselves against the risk of personal liability.

Companies are also facing a crackdown by insurance companies, as payouts from ransomware attacks push the limits of sustainability. In some cases, insurance firms are raising premiums, reducing or eliminating coverage and forcing companies to get pre-approval to make sure an insurance company will reimburse them, according to Ron Plesco, a partner at DLA Piper. 

In prior years, corporate boards usually pushed issues like ransomware preparation down to top executives, so the chief executive and general counsel would talk to CIOs and CISOs directly, but the rise in ransomware has changed that equation, according to Plesco.

"Now they're understanding they want to be informed, one because they have to know 'do we have this'," Plesco said. "If something happened tomorrow — are we good at XYZ Corporation, whatever that corporation is."

In addition, corporate boards and C-level executives are asking for incident runbooks that map out what potential issues top executives and directors will need to respond to in case of a ransomware attack. 

In the past, most companies had runbooks for security operations centers that outlined how they game plan against an attack, but now the incident response questions go to the highest levels of the company to answer questions about whether to negotiate a ransom payment, he said. 

Underwriting rewrite

The surge in ransomware and other high profile data breaches over the past two years has led to major changes in how insurance companies underwrite policies for cybersecurity incidents, Plesco said. For example, Plesco has recently encountered companies being forced to seek pre-approval from insurance companies to determine whether an insurance company would reimburse them on a claim. 

Insurance companies are also running into legal issues over whether they can make a payout to an entity under the Office of Foreign Assets Control, which is a U.S. Treasury Department office that regulates money-laundering and foreign sanctions. 

Insurance companies are putting more direct scrutiny on companies by asking tougher questions regarding existing cybersecurity practices, according to JP Calderon, senior vice president and CISO at PVH Corp. 

In the past insurance companies did not always ask the proper questions or ask questions in the right way about issues like the use of multifactor authentication or data backups, according to Calderon. Now insurance companies are realizing there may be trust and transparency issues over how companies respond to underwriting questions and in some cases are contemplating a certification process to make sure companies are being honest and truthful in their responses. 

"They're losing the battle right now, and they've got to find out the right risk reward for these claims," Calderon said. 

When a ransomware attack hits a business, the recovery doesn't stop at the decision of whether to pay the ransom. 

For businesses, the first step post-hack is to contain the attack. "Evaluate systems that have been affected … [by] the attack and then look to contain and limit that attack," said Asher de Metz, senior manager of security consulting at Sungard AS. "Then once it's contained, they're also going to want to communicate with stakeholders."

Consider the recent Kaseya attack: After triaging and releasing a patch for on-premise customers, the company still had to mitigate the SaaS damage with a separate patch. Weeks after the attack, it's unclear if any backdoors have been exposed, prone to further attack.

With some hindsight, researchers are uncovering where Kaseya went wrong and what the company could've done differently to prevent the attack affecting 1,500 downstream customers. But for businesses watching the drama unfold as another company scrambles with a post-hack response, the lesson is to prepare for the worst. 

"The most critical factor is completely eradicating the threat from the environment," Tim Grelling, director of innovation, security at Core BTS, said in an email to Cybersecurity Dive. "Attempts to 'uninstall' or clean ransomware from systems is rarely successful."

Because of the sprawling damage, recovering from a ransomware attack can be pricey. The average total cost of recovery from a ransomware attack was $1.85 million in 2021, according to a Sophos report.

Post-attack recovery actually begins before a cyber incident ever occurs. Drafting an incident response plan, practicing response tactics and making sure the systems are in place for a full recovery should happen before the attack as a part of the recovery process. 

"Businesses that use the lessons learned from the incident and use them to not just restore services but improve their security policies, processes, tools and architecture will come out of the incident with something positive if they maintain the improved security posture," Grelling said.

When an attack first happens, the security team will lead a business's incident response to contain the issue and stop the bleeding, according to Mark Nunnikhoven, distinguished cloud strategist at Lacework. Most of the time, the decryption will get the data back, but there's still the possibility of corruption and whether back-ups are available in the meantime to restore systems.

Then, the unknowns set in. "Are we still vulnerable? Did we remove all of the malware and things that the attacker did from our network? It's a really long and drawn out process," Nunnikhoven said.

The challenge for businesses is managing the scale and scope of the attack. When attackers have access to the network, they take advantage of it to understand where the more important data is, according to Nunnikhoven. The business has to determine how the attacker got in and also trace for any additional damage or unwarranted access. 

'Plan, plan, plan' 

For a strong post-hack comeback, planning is required. 

Two-thirds of companies estimate it would take five or more days to fully recover from a ransomware attack if they chose not to pay the ransom, according to the 2020 Ransomware Resiliency Report surveying 2,690 IT professionals. A similar number, 64%, say their security measures have not fully kept up with their IT complexity. 

"The first step is, have a plan ahead of time. I know that sounds simple, but so many people don't do it," Nunnikhoven said. "You need to understand how you're going to work if you don't have access to your systems."

In combination with a plan, good cyber hygiene across the business can be preventative and help quickly respond to cyberthreats. For example, businesses can roll out patches more quickly without a massive effort, Nunnikhoven said.

Because of the string of recent high-profile attacks up the supply chain, incident response plans and preparation now include vendors in the process. 

"Supply chain attacks have increased the focus on third-party risk management," Grelling said. "Businesses need to not only manage security and risk in their own environment, but identify those critical vendors and assess security and risk related to those vendors."

If an organization has a strong incident response plan in place — and has spent time practicing it — they'll likely be more successful in the recovery. The business can begin to respond instead of using precious time to plan. 

"Plan, plan, plan," de Metz said. It's worth it to a business to spend the money now on the preventative measures because ransomware can be incredibly destructive.

With ransomware attacks running rampant, companies need to proactively establish ransomware war rooms, using a dedicated physical or virtual space and including all business stakeholders in preparation, according to an expert panel speaking at the Mandiant Cyber Defense Summit. As part of the preparations, businesses should establish processes to handle negotiations with the threat actor as well as manage the legal and public relations fallout resulting from such an attack.

Ransomware gangs will purposefully target companies after work, on weekends or holiday recess in order to catch a company with a minimal security operations team — an event that will disrupt the personal impact of staff and other stakeholders, Jibran Ilyas, a managing director at Mandiant and an adjunct professor of digital forensics at Northwestern University. 

Unless companies are prepared to have the right personnel in place with an understanding of the key issues on the table, that could have a major impact on how successful they are in managing and remediating the attack, according to Ilyas. 

A ransomware attack will also have considerable legal ramifications for a company, according to Dominique Shelton Leipzig, a partner and co-chair of the Ad Tech Privacy and Data Management practice at Perkins Coie. Legal challenges include breach notification requirements at the federal and state level, accurate and timely disclosure to federal regulators, and litigation resulting from the breach of privacy laws. 

Businesses need to align internal stakeholders and outside experts in advance of a ransomware attack, to make sure all of the necessary people are on notice to respond to an attack. 

These include external forensics firms, external counsel as well as key executives from human resources, communications, business continuity, business application owners, help desk personnel and others, according to the panel. 

Companies would benefit from appointing a project manager and hold tabletop exercises with all key stakeholders involved. If brought in early, red team officials can play the role of an adversary, and will essentially be able to warn company executives where there are exploitable weaknesses in the system, according to Evan Pena, the global red team director at Mandiant. 

Building a response plan

A central consideration in a company's incident response plan is preparing for business continuity. Organizations should always set up data backups, however they cannot assume those backups will allow a company to immediately resume normal operations after a ransomware incident, according to Leipzig.

"It's been a rude awakening for certain companies to find out that what is on the BCP (backup file) locations cannot really be used for weeks and months to stand up operations, so you really need to be prepared and understand how quickly you can get back to business with your backup locations," Leipzig said. 

The legal ramifications of ransomware attacks are becoming an even greater concern, Leipzig said. The Securities and Exchange Commission is closely monitoring whether companies disclose cyber incidents in a timely and accurate manner, and have launched investigations against firms that fail to properly disclose cyber incidents. The Department of Justice is also adding timely disclosure requirements for federal contractors.

Regarding potential liability, the California Consumer Privacy Act allows up to $750 in statutory damages for every record that is part of a cyberattack. There are more than 170 class action suits currently underway for these types of data breaches. As previously reported, the massive T-Mobile data breach which impacted more than 54 million customers, is expected to fall under the CCPA. 

Separately, the impact of cyberattacks will open companies to litigation regarding business continuity. Colonial Pipeline is facing litigation from gas station owners who lost business due to the May ransomware attack, Leipzig said. 

A spokesperson for Colonial said the company could not comment on pending litigation but said "we worked around the clock to safely restart our pipeline system following the cyberattack against our company."

The majority of C-suite executives are confident in their organization's protection against ransomware, despite an uptick in recent attacks, research from (ISC)² shows. Just 15% report a lack of confidence. 

The increase in confidence levels may come from an overall increase in communication between business leaders and their security teams, (ISC)² said. The (ISC)² Ransomware Study surveyed 750 C-suite executives from U.S.- and U.K.-based organizations with more than 500 employees. 

Confidence in ransomware preparation can vary by sector but are largely unaffected by the recent increase in ransomware attacks. Organizations in financial services, logistics/supply chain and manufacturing/energy are all slightly more confident in their ransomware protection following the attacks from 2021.

While it's important for non-IT and security leaders to have buy-in, CISOs have the responsibility to level with their C-suite counterparts on the true threat of ransomware. 

"If cybersecurity professionals feel their C-suite is overconfident about ransomware, it's time to speak up and deliver a dose of reality," the report said. 

Regulatory fines caused by a ransomware attack are the top concern for respondents, followed by data or intellectual property loss. With data loss a top risk factor in ransomware — either locked or stolen data — it's up to CISOs to educate other business leaders about the most relevant risks to the threat. 

CISOs can use the top areas of concern to educate their C-suite on what needs the most attention using business terms, benchmarks or comparative analysis to round out the context. 

While it's tempting to show the board what the day-to-day operations and threats the SOC deals with, when speaking to the C-suite and board, CISOs need to understand: 

• What are you asking for? 
• What do you need from the board? 
• How at risk is the business? 
• What areas are lacking appropriate protection? 

Since last year's ransomware attacks increase, organizations in healthcare cited the greatest increase in communication between security and other business leaders, (ISC)² found. However, communication declined in logistics, education, and manufacturing and energy. 

Gartner recommends companies engage in a continual learning process for preventing ransomware attacks, according to Michael Hoeck, senior director analyst at Gartner, while speaking during the virtual Gartner Security & Risk Management Summit in November. 

"You have to be able to run this scenario, you have to play through the scenario, you have to do the tabletop exercises, you have to perform the restore process," said Hoeck. "Take a system down to the bare bones, and reconstruct it to find out how long it really takes, and see how well it matches up to what the business is expecting." 

"A lot has to do with some capabilities you already have today, or technology that's in place today," when it comes to backups, said Hoeck. 

Some of the requirements of a continual learning process is keeping tabs on what applications are mission-critical, knowing the backup capabilities of a vendor and considering a secure isolated recovery environment. 

C-suite executives want visibility into how security works with IT, with 38% asking for assurance that back-ups and restoration plans are unaffected in the event of a ransomware attack, (ISC)² found. One-third of respondents want to know what is needed to restore minimal operations following an attack, including backups, identifying priority systems, and restoring basic functions. 

It doesn't matter how sophisticated a threat group is. They like low-hanging fruit as much as other dark web dwellers. 

The most commonly exploited vulnerabilities are ones hidden in plain, everyday IT tools. The list of CVEs for 2020 and 2021, are dated and largely linked to remote work, according to a joint alert issued by the Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the U.K.'s National Cyber Security Center (NCSC), and the Federal Bureau of Investigation (FBI) last week.

Uncovering initial access to a larger attack is not always straightforward. In some cases, companies have to look for a combination of actions used in an attack, because some malicious tactics often don't appear concerning or trigger an investigation. Others, however, are preventable in a patch. 

When the public thinks of massive cyberattacks, the assumption is hackers were clever and used sophisticated techniques to gain entry. This is not always true. Even the most well-resourced APTs rely on gaps in security left by poor security hygiene.

CVEs dating back to 2017 indicate "companies have struggled to locate and patch vulnerable instances," said Claire Tills, senior research engineer at Tenable. Security teams may lack the authority to deploy updates if they stall business-critical IT tools, like VPNs. 

"Threat actors prefer these vulnerabilities because they exist in ubiquitous products, increasing the likelihood that any sector they target will be vulnerable," said Tills. 

Threat actors can obscure attribution when they use common CVEs as well as cut their access costs, CISA found. "They are not investing in developing a zero-day exploit for their exclusive use, which they risk losing if it becomes known." 

Nation-state actors and other threat groups expect organizations to lack the resources or network visibility necessary to locate vulnerabilities. Highly sophisticated APTs know, "once you own the VPN, ransom deployment becomes trivial," especially if organization's haven't properly integrated the VPN with intrusion detection systems (IDS) or next-generation firewalls, Chris White, CSO of BlueVoyant, said. 

2021's CVEs

CISA confirmed the mass remote work landscape challenged organizations' abilities to "conduct rigorous patch management." And if a company lacks the resources and ability to investigate an intrusion, threat actors become more brazen with their activity — even highly sophisticated threat groups become arrogant and pursue low-hanging fruit. 

"The problem in the pre-COVID[-19] world was prioritization," said White. Companies often remediated threats hackers were exploiting in real time. "So to some extent, the pandemic actually eased the burden because the attack surface pivoted towards endpoints," including VPNs and email, he said. It gave security teams a more focused set of priorities. 

However, companies that have the capacity and resources will be able to prioritize patching — it's more of a challenge for smaller security teams. In March 2020, companies caught off-guard by mass remote work focused on business continuity rather than protection. More than half of companies are still challenged by remote and hybrid management, according to a JumpCloud survey. 

Though the CVEs that defined 2020 were mostly in "perimeter-type devices," vulnerabilities from Q1 2021 had "aggressive exploitation" of Microsoft Exchange servers and Accellion File Transfer Appliance (FTA), according to data from Positive Technologies. 

FireEye identified UNC2546, which has been linked to Clop ransomware, and FIN11 as having ties to the Accellion breach. Morgan Stanley, Kroger, University of Colorado and Jones Day were among the Accellion customers stemming from the breach. 

"The most sophisticated APT organizations, however, are interested in privilege escalation and [remote code execution] vulnerabilities to gain deep persistence within strategic organizations — not for the purpose of ransom or direct attack but for the more impactful supply chain-based attacks," said White. "The way ransomware made its way onto everyone's radar over the past five to six years, the supply-chain-based attacks will do the same in the first half of this decade." 

For now, however, the most dominant threat groups of 2021 specialize in ransomware. 

Ransomware operators Black Kingdom and DearCry latched onto the ProxyLogon remote code execution exploit from Exchange servers, though the initial Exchange hack was conducted by China-based nation-state actors. The ransomware groups challenged the patches Microsoft issued for the original attack on Exchange. The threat of a secondary exploitation meant companies had to update their Exchange servers, and search for intrusions leading elsewhere in their environment. 

At this point, security teams are opening an investigation. As the saying goes, "given enough eyeballs, all bugs are shallow," but not all companies have the resources to have enough eyeballs. 

"Without the right intelligence, vulnerability management can sometimes feel like ghost hunting," said Tills. "Many organizations are likely haunted by CVEs based on their own unique IT history," depending on acquisitions or mergers, inventory and asset maintenance, and intelligence capabilities. 

Most tactics that might trigger an investigation have to be found early in an attack, according to Sophos. Of the tactics Sophos MTR moved forward with an investigation, 31% involved suspicious execution detections, 17% had persistence detections and 16% were in initial access detections. Only 1% of tactics escalated to further investigation involved privilege escalation. In privilege escalation, the most common techniques include process injection, process hollowing and SID-history injection. 

In September ransomware group Ryuk used CVE-2020-1472, or Zerologon, during the Microsoft Windows Netlogon Remote Protocol. The vulnerability allows for privilege escalation after a bad actor uses the Netlogon Remote Protocol to secure a channel connection to a domain controller. 

It's a critical CVE, according to the NIST. The bug has been known since last year with an available patch, however CISA said companies that have found exploitation attempts in their Windows Events Logs will have to investigate further. 

Negotiating a ransom down to $0 is possible.

When COVID-19 began to put serious pressure on healthcare organizations, cybercriminals took advantage, especially ransomware gangs. But in at least one instance, a victim healthcare organization was able to level with their attackers.

"The threat actor basically said, 'Hey, we're actually really sorry about that. We're not trying to hit healthcare organizations, we're just going to give you a decrypter," said Drew Schmitt, principal threat intelligence analyst at GuidePoint Security, who has been partnering with third parties since 2019 to negotiate ransom payment.

Some ransomware groups are "not necessarily just doing what they're doing to watch the world burn. There are varying levels of how some groups feel about their operations," he said. "One of the most notable experiences I've had is having that free issuing of the decryptor."

Not all organizations are as lucky and not all cybercriminals have a moral compass.

Fear lies at the root of the decision of whether to pay a ransom. When considering whether to pay, companies want to know how quickly operations can resume while uncovering the hole that allowed the ransomware in. As for the negotiation, companies have to take a backseat.

"The victim organization is involved very little in the direct negotiations. You don't want the emotions coming through in the negotiations and involving the client directly almost always results in that," said Jake Williams, co-founder and CTO at BreachQuest.

The ransom negotiator business took off in tandem with the rise of ransomware, starting around 2018. As negotiations become a more routine component of incident response, "I don't think it will be its own business for long," said Williams.

Tick tock

When a company onboards negotiators, they hand the reins to professionals with ransomware group experience. There is a sense of familiarity and anecdotes that allow negotiators to adapt to who they're talking to.

The first thing ransomware negotiators do is ensure a secondary backup to communication with the criminals as the actors might disable their email accounts, said Williams.

Historically, ransomware actors would provide the email address for their victims to contact. Now, ransomware actors share a link with instructions on how to interact with them. Once initial contact has been made, negotiations can start.

"Once you reach out and engage the threat actor, that's going to be kind of when your proverbial clock starts," said Schmitt. "That's when they know that you're aware of the situation, you've reached out to them, and they're going to kind of have this timeline in their head of how long this negotiation process should take."

If a company is able to determine what was encrypted or breached during an attack, the negotiator will ask the actor for sample data or screenshots to get a sense of the depth of the infection.

This is the most important role the victim company will play in the negotiation process because "there is no reason to pay if recovering encrypted data has no value. Only the victim company can forecast or ascribe what the value is," said Bill Siegel, co-founder and CEO of Coveware.

Negotiators, at the end of the day, do not make decisions on behalf of the company, Schmitt said. They are there to provide guidance to the victim company, insurance provider, or counsel based on previous interactions with the threat group.

Threat group relations

If a company determines the value of the hacked data could cause harm to the business and there are no effective solutions, fear can return. Payment will feel like the only option, so negotiations proceed.

This is where "we get a temperature check for how amenable the threat actor is to negotiating down the price. We have threat intelligence on groups and know the typical ransom demand movement and timelines for that," said Williams.

Negotiations are seldom linear, though negotiators try to keep the process within a few days of when a ransom note goes live. If a company is tempted to take longer or be more specific in their counteroffers, "it's our experience that that's when a threat actor starts to get a little bit more annoyed with the processor," and even aggressive, said Schmitt. The actors might retaliate and call the whole deal off, revoke the decryption keys, or publish the stolen data.

"Another reason we try to keep it shorter is because we want their attention during that time," especially when the interactions are based on a real-time chat platform, he said. Ransomware actors might lose interest in negotiations lasting longer than a few days and become less communicative.

"At this point, everybody's aware of how busy a lot of these groups are," said Schmitt. "I mean, they have a lot of victims that they're hitting on on a very consistent basis."

The Conti ransomware group, for example, will usually have multiple negotiations going simultaneously. "They're interacting with the client, and not necessarily us. So there's still a little bit more of that veil or obfuscation as to who they're actually talking to," he said.

When the final amount is agreed upon by both parties, they involve a certified money services business (MSB) for the logistics of the payment. The MSB must confirm the group is not sanctioned by the Treasury Department's Office of Foreign Assets Control (OFAC), to secure cryptocurrency and complete the transaction.

Insurance companies become involved when the negotiation and payment processes are complete. "They just process claims when the entire process is over," said Siegel.

Customer service check

Ransomware groups pride themselves on their reputation and customer service, relationships between criminal gangs and negotiators do develop. "We have worked with the same ransomware groups on multiple occasions and we rely on our MSB payment partners to ensure their due diligence negates the chance of paying a sanctioned group," said Williams.

However, ransomware groups that employ affiliates can complicate the negotiator-threat group relationship. Affiliates can go rogue, which gangs would have to answer to. Ransomware group SunCrypt claims healthcare organizations are not one of its preferred targets. But last year SunCrypt operators had to clarify a hack on University Hospital in New Jersey was due to a new affiliate.

Though ransomware groups' customer service tends to be accommodating, trusting criminals is not a perfect science. Industry has seen ransomware groups make false promises before — like when Maze operators claimed its ransomware stopped short of "socially significant services," including "hospitals, cancer centers, maternity hospitals and other socially vital objects" in December 2016, but the group proceeded to target healthcare organizations involved in COVID-19 response in 2020.

A similar empty promise was made by the DarkSide gang. In October, DarkSide operators claimed to donate $10,000 in bitcoin to charities. "No matter how bad you think our work is, we are pleased to know that we helped change someone's life," DarkSide operators said, according to Emsisoft research. It's illegal for charities to collect funds illegally obtained anyway, Emsisoft clarified. DarkSide also has a blacklist of targets; affiliates cannot target hospitals, nursing homes, morgues, funeral homes, schools, non-profits, and so forth.

Regardless of who targeted who and why, affiliates are typically not involved in the actual negotiations, according to Schmitt.

Negotiators have profiles of known threat actors, which includes how those actors prefer to negotiate. These profiles can dictate which negotiation strategies are effective when using anecdotal evidence they're based on.

When negotiators work with groups using affiliates, they might ask the gang if it was one individual working out of line that caused the attack. But even if the group claims it was an individual act, "we of course can't confirm any of that," said Williams. "If we don't have reputational data on the group, it's hard to send significant sums of cryptocurrency with no means to recover it if you don't know you're getting a decryption key.">

Negotiators have to build trust with cybercriminals, unreliable as that sounds. Trust goes beyond a company's chances of receiving a decryption key because the key may not work as promised.

"I've seen [encryption programs] encrypt entire file systems — 100 gigabyte file systems — in about five minutes. The decryption of that same file system took about 36 hours," with some files still missing, said Tyler Hudak, practice lead of incident response at TrustedSec, during a July webcast hosted by NinjaRMM. Costs will accrue despite paying a ransom.

Almost half of organizations that paid a ransom regained access to their data, however, at least some of it was returned corrupted, according to a Cybereason survey of more than 1,200 information security professionals conducted in April. Fifteen percent of respondents said they had no issue with their returned data.

Williams tests the decryption program in a "safe environment" prior to paying, though it's an optional step, he said. "Most malware developers are not software engineers, so there's always a risk that sloppy encryption was performed because the software is buggy."

Whether or not to pay a ransom should never be the first question executives answer. 

When confronted with a ransomware attack, the first thing companies need to understand is their situational awareness; what does cyber insurance look like or what does recovery entail, said Paul Proctor, distinguished VP analyst at Gartner, speaking during the virtual Gartner IT Symposium/Xpo. "Because the next thing that you need to think about, which is arguably more important, is: What is the current business impact?" 

Sophisticated ransomware actors will have done their homework — they know how much to ask for based on a company's annual revenue. But if the ransom demand is greater than the actual temporary loss of business, companies have time to really think about their response. 

"This is a time where leadership qualities show," said Sam Olyaei, director analyst at Gartner, during the virtual discussion. Recently, a Gartner client had a cybersecurity incident (not ransomware) and upon receiving the alert, the executive went to a yoga class. "She had to relax and figure out in a clear mind what these next steps are going to be," as cyberattacks usually create a chaotic atmosphere. 

Because relevant stakeholders, including the CISO, will likely be notified of the attack at the same time, companies need to already know how key executives will work together. The CEO will be the primary source to relay overall business impact to the CIO and CISO. "The business needs to make a decision on behalf of the business," Olyaei said. 

Bad actors do their homework and try to make ransom demands based on individual targets. But executives are better equipped with knowing what they're willing to lose — time, money, customers — to make the best long-term decisions. 

No shame in a breach

As relevant stakeholders work through response efforts, "there's no shame in a breach or any type of cybersecurity," said Olyaei. "We're starting to see a lot of people start to advertise this as sort of a badge of honor that they've been able to respond to a cybersecurity attack and take the organization to the right processes to get back up to speed." 

The technical response is not necessarily where companies feel the brunt of the impact, but it's where some companies can stumble. 

"The impact of cybersecurity attacks isn't necessarily from the tactical domain," said Olyaei. Instead, companies fail to adequately respond in public relations, the customer perspective, or reputational. These are the business areas companies feel the most scrutiny following a cyberattack. 

Colonial Pipeline's ransomware attack led to an emergency pipeline shut down and the company collaborated with relevant parties. The company failed, however, in communicating the consumer impact. 

"It was the gas panic on the East Coast that damaged Colonial a lot more than their response to the cyberattack," said Proctor. 

Though about half of the funds were eventually recovered by the FBI, Colonial paid its attackers. For Proctor, paying is essentially "inviting them to come back again." 

Gartner estimates about 80% of ransomware victims who paid, are targeted again. "You know why? Because you just said, 'I'm a great customer,'" he said. 

Understanding the full impact

When companies fully process the scope of an attack and ransom demand, they will be able to calculate true business impact — and if paying the ransom makes sense. For example, if attackers are asking for $40 million, "and you're currently losing $1 million a week, you have a little more flexibility in negotiating" and recovering, Proctor said. 

The only time Proctor would approve paying a ransom is "if you absolutely, positively cannot bring the data back, if you don't have any backups, which by the way, everybody backs up. If you're not everybody, wow, you are so far behind the curve," he said. 

Responding to cyberattacks is becoming a skill, and if a company is able to determine how much it will cost to recoup data without paying the ransom, "you should jump on that," said Proctor. "Your consideration today is if you looked at that and said 'I can't do it,' you should make the investment to make sure that you could do it." 

As part of that evaluation, companies should try researching available decryptor tools. No More Ransom is a website housing decryptor tools for popular ransomware strains, Olyaei said. Otherwise, the decryptor tool ransomware actors provide may be too slow to offset rising costs, or may not work. 

If a company does decide to do business with its attackers, keep in mind "there is no refund policy in a ransomware attack with a ransomware group," he said. Gartner found companies that paid a ransom were returned with only 8% of their data. Ransom negotiators tend to find that ransomware groups uphold their customer service depending on how reputable the group is. 

A CISO can feel confident they have the best cybersecurity system in place. The organization's employees get regular security awareness training. The security team is strong and built solid partnerships with vendors.

The CISO and the organization have done all the right things to prevent a cyber incident, but what plans are in place to keep business operations running after an incident occurs?

No matter what your plans are, something unique will happen to take your company offline or put the company in jeopardy, according to Bryan Scanlon, principal with Look Left Marketing, and speaker at the Insights S2021 virtual conference.

"You are in an incredible race against time to solve a problem and communicate the resolution and deal with all the inputs and outputs that are happening. Time is really the enemy here," Scanlon said.

In that limited amount of time, while businesses need to move quickly to mitigate the cyber event, they're also starting from behind. Once an incident happens, businesses have to catch up. What often prevents a quick and coordinated effort to address the cyber incident is the lack of communication across the organization during the crisis.

"Some companies won't communicate at all until they have it all figured out. That tends to be a problem because you are impeding management," said Scanlon.

Communication has to take place in tandem with incident response, where all members of the team are on the same page so mitigation isn't hampered, while business operations are able to continue as close to normal as possible while customers are alerted in a timely manner.

This failure to communicate efficiently is frequently due to friction between the security team and business teams.

"Less experienced security teams often see controls and policies and black and white, rather than shades of gray," said Jake Williams, co-founder and CTO at BreachQuest, in an email to Cybersecurity Dive.

When security teams take the time to understand the business, they work together with business unit stakeholders to ensure operations are performed in the most secure manner possible.

"When they don't, the same security teams become marginalized and known as the people who say 'no' to every requirement," said Williams.

Biggest risks to business continuity

The breakdown in communication is often due to a failure to have a plan in place when business interruptions take place.

"This means that on top of responding to a hectic situation they have to remember all the technical pieces and procedures necessary to keep operating," said John Bambenek, Threat Intelligence Advisor at Netenrich, in an email interview.

In a crisis, even the most well-rehearsed actions are forgotten or crucial steps are skipped. This leads to mistakes when the organization can least afford to make them.

Organizations that lack a mitigation plan also tend to lack a plan that deals with potential disruptions. An area that all companies should have a continuity plan for is a ransomware attack.

"At its core, ransomware is a business continuity problem. If you can recover business operations quickly and effectively, paying ransoms is mostly not an issue," said Bambenek. "The fact that we see all these ransomware incidents and disruptions is that many organizations aren't following business continuity best practices largely unchanged since the 90s."

The problem is that most organizations think ransomware recovery is an easier process than it really is. Because ransomware kills many processes when encrypting data, files are already corrupted. Not only does the organization need to recover the encrypted files, but it must also address the failures and vulnerabilities across the entire infrastructure.

Business continuity when systems fail

Data is what keeps businesses moving forward, so beyond having documented continuity plans in place, there needs to be backup and data recovery (BDR) systems.

A proactive approach is needed to be more resilient, according to Dave LeClair, Sr. Director, Product Management with ConnectWise. You want to be able to keep the applications up and running during an incident without the end users realizing there is a problem. BDR today is more about business continuity and resiliency, as much as having secondary files if data is lost.

Because so much BDR is done through the cloud, it is vital to know what the cloud provider does during an emergency and how the provider tests the BDR system regularly to make sure it can seamlessly go online if needed.

"You need to think through all the different scenarios in advance before the incident takes place. You don't want to do it when something bad is starting to happen," LeClair said during an IT Nation Secure conference session.

"Being resilient is being resilient to anything that could happen to your business," said LeClair.

But businesses can mitigate the downtime and keep operations in motion if they prioritize prevention and BDR controls. Cyber incidents will happen, but the impact should never cripple the organization.