Buying or Selling IPv4 Addresses?

Watch this video to discover how ACCELR/8, a transformative trading platform developed by industry veterans Marc Lindsey and Janine Goodman, enables organizations to buy or sell IPv4 blocks as small as /20s.

Avenue4 LLCRead Message Promoted Post

Home / Blogs

Should You Pay Ransomware Demands?

Rachel Gillevet

In 2016, ransomware became an increasingly serious problem for small and medium businesses. Ransomware has proven a successful revenue generator for criminals, which means the risk to businesses will grow as ransomware becomes more sophisticated and increasing numbers of ethically challenged criminals jump on the bandwagon.

Every business must take steps to protect itself from ransomware, but talking about prevention doesn't help ransomware victims decide whether to pay to get their data back.

It's an unpleasant position in which to find oneself. No-one wants to pay criminals for access to their own data, but nor do they want to permanently lose access to information vital to their business.

To pay, or not to pay? As you might expect, there's no definitive answer, but we can think through some of the factors that should influence your decision.

The FBI's position on ransomware payments is straightforward: don't pay. The FBI believes paying doesn't guarantee access to the encrypted data, that it "emboldens" criminals to target more organizations, and that it encourages more criminals to join the ransomware industry.

All of that is true, but business owners are understandably more interested in getting their data back now than whether paying encourages future attacks.

Nevertheless, before paying, business owners should consider that by paying, they paint a target on their back. Criminals will bleed a victim dry if they're able. If you make a payment, you show the attacker that you're the sort of person who pays, and that can only encourage the attacker to find out how much more they can extort.

If you choose to pay, you may or may not receive the keys to unlock your data. There is no guarantee that the keys will ever be delivered. But, counter-intuitive as it may sound, the ransomware model is based on trust. Victims have to trust that attackers will release their data — otherwise there's no incentive to pay.

In most cases, people who pay get their data back. In fact, the largest ransomware operations provide excellent customer service. They will help you pay and decrypt the data.

Ultimately, your decision to pay should be predicated on a simple calculation: is the data I stand to lose and any future risk caused by paying worth the price being asked?

The best way to avoid paying is to make sure that you never become the victim of a ransomware attack in the first place. That might seem like a truism, but it's surprising how many business owners don't take the simplest steps to keep their data safe.

Educating employees about ransomware and phishing should be a high priority, but the single most important action a business owner can take is the creation of regularly updated offsite backups.

Ransomware is only effective if it deprives the business of data; if that data is duplicated in a place the attackers can't reach, they have no leverage and you won't have to pay them a cent.

By Rachel Gillevet, Technical Writer
Related topics: Cybercrime, Cybersecurity
SHARE THIS POST

If you are pressed for time ...

... this is for you. More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Vinton Cerf, Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Share your comments

Do you think that a company not Alex Tajirian  –  Jan 11, 2017 2:39 AM PST

Do you think that a company not smart enough to have data backups would have the necessary analytical skills to do a cost-benefit analysis of pay/no pay? Should they immediately get the FBI involved?

To post comments, please login or create an account.

Related

Topics

IP Addressing

Sponsored byAvenue4 LLC

Cybersecurity

Sponsored byVerisign

DNS Security

Sponsored byAfilias

Mobile Internet

Sponsored byAfilias

Promoted Post

Buying or Selling IPv4 Addresses?

Watch this video to discover how ACCELR/8, a transformative trading platform developed by industry veterans Marc Lindsey and Janine Goodman, enables organizations to buy or sell IPv4 blocks as small as /20s.