A digital pandemic swept the world in 2021. Prominent ransomware attacks struck Colonial Pipeline, the operator of the largest fuel pipeline on America’s east coast, as well as the largest meat-processing company in North America and Ireland’s health-care system. Attackers scramble an organisation’s files and demand a payment to unlock them. American firms lost hundreds of millions of dollars to the problem in 2021 according to the Department of Homeland Security. The topic even dominated the first summit between Presidents Joe Biden and Vladimir Putin in June. In 2022 governments and firms will fight back, but the pandemic will rage on.
Tired of the economic disruption caused by ransomware, governments will strike back. Many countries have developed offensive cyber-forces run by military and intelligence agencies. These have been designed with state adversaries in mind, but they are perfectly capable of being turned on smaller fry.
In March 2021 eight Western countries, co-ordinated by the European Union’s police agency, attacked and disrupted the Emotet botnet, a network of hijacked servers used by cyber-criminals. The fbi has conducted similar operations. Such aggressive tactics will become more common. Indeed, some states may find that muscle-flexing against criminals is a low-risk way to demonstrate their cyber-capabilities to their rivals.
The line between cyber-crime and cyber-war is blurry
If governments cannot hunt down the attackers, then recovering the ransoms is the next best thing. In most cases, ransoms are paid in cryptocurrency, held in anonymous accounts that are hard to unmask. Even so, America’s government was able to recover the majority of the ransom paid by Colonial Pipeline by somehow acquiring the password to the attacker’s stash of Bitcoin, the cryptocurrency in which the ransom was paid. This success will encourage other law-enforcement agencies to monitor cryptocurrencies more closely.
In most cases, though, ransoms will be gone for good. So some companies are seeking other means of redress. More than a third of senior executives surveyed in March 2021 by Munich Re, a reinsurer, are considering taking out a cyber-insurance policy, which pays out for ransomware-related losses. The global cyber-insurance market was worth $7bn in gross premiums in 2020. It is expected to exceed $20bn by 2025, according to GlobalData, an analytics firm, as firms rush to cover themselves against crippling losses.
But the line between cyber-crime and cyber-war is a blurry one—some attackers are free agents, some are backed by states and others hover in between. So victims risk losing payouts if an attack is deemed an act of war, traditionally exempt from coverage. Many governments are concerned that insurance payouts are enriching cyber-criminals and fueling more ransomware.
Some attackers are even exploiting the market by determining precisely how much a firm is insured for, and then tailoring their ransomware demand to that amount, notes James Sullivan of the Royal United Services Institute, a think-tank. He says that insurers need to agree to minimum security standards, so that companies cannot simply choose laxer providers. This should also prod policyholders into beefing up their defences.
Governments may even consider a more drastic option: banning digital ransoms entirely, in the same way that many countries criminalise the payment of terrorist ransoms for kidnapping. At present, businesses can largely do as they like; some cyber-ransoms are even tax deductible. Several American states have pending legislation that would ban such payments. More will follow.
Yet ransom bans are unlikely to work. They will penalise smaller firms, who lack the resources and expertise to fortify their networks, and will drive ransom payments underground. A more useful approach would be demanding that companies report both breaches and ransom payments, forcing the issue into the open. Over time, more companies will also realise that paying ransoms is no guarantee of recovering their data.
Ransomware is part of a larger problem. Cyber-criminals are versatile and their methods are fungible. Illicit access to a system can be used to hold data hostage as in ransomware, or to mount a digital heist. Ransomware gangs are realising that crippling an American pipeline is not the best way to stay unnoticed. Should ransomware grow too risky, or less profitable, hackers may turn their attention to, say, stealing cryptocurrency.
Curbing cyber-crime ultimately requires getting the basics right: educating employees to be wary of suspicious emails; keeping software up to date; and backing up data. That sort of prosaic cultural change is not as sexy as cyber-retaliation or as satisfying as a ransom ban, but it is the only solution in the long term.
No comments:
Post a Comment