Dr. Georgianna Shea
Source LinkExecutive Summary
Ransomware attacks are a lucrative practice for hackers. In just one attack in June against meat processing company JBS, hackers extorted an $11 million payment.1 In the wake of the May 2021 Colonial Pipeline ransomware attack, Secretary of Homeland Security Alejandro Mayorkas said, “More than $350 million in losses are attributable to ransomware attacks this year. That’s a more-than-300 percent increase over last year’s victimization of companies. And there’s no company too small to suffer a ransomware attack.”2
Ransomware is a type of malware that encrypts the target’s files and data or even its entire system, preventing users from accessing the data until they pay the ransom. After receiving payment, the hacker provides the decryption key in the form of a password. The hacker may also engage in double extortion, threatening to leak the stolen data if the victim does not pay.
Prevalent strategies for dealing with ransomware emphasize defensive measures, even though experience shows that one cannot thwart a well-resourced adversary determined to penetrate a target’s system.3 To the extent that current strategies seek to build resilience, they call for maintaining system backups, which may not prevent substantial data loss. For example, the ransomware best practices guide from the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) begins with an admonition “to maintain offline, encrypted backups of data and to regularly test your backups.”4 The CISA guide then turns to cyber hygiene measures for preventing infections.5
