Organizations should be legally prevented from being able to pay these ransoms and should instead receive funding to help them recover from the damages. It funds an entire industry that can just grow and grow because it pays off
Once the well is sufficiently poisoned, no victim has an incentive to participate. They don't know if they're paying a defector or a cooperator.
No state can take this action. Any hero who does so will be prosecuted. But if they /dev/null their bitcoin address private key, they can rest easy that what they did was purely selfless.
Now it only costs the victim $10 to pick a random section and buy its key. If that works they can pick another and buy it’s key, and so one until they are confident the seller can be trusted and they can then buy the remaining keys.
It's usually ~$1000 per machine. Sometimes more for machines with big disks or depending on which active directory groups they're in.
That tells you that UCSF paid for data recovery on 1000+ machines probably...
Perhaps it is sufficient to simply ransomware the data in the first place and then refuse to give it back. Any measure that makes the victim immune to that will make them immune to the true ransomware folks as well.
That way, they could build up a sort of "reputation".
Isn’t a simpler solution insurance? The insurance company becomes a specialist in pricing and reducing this risk. And the malware writers become, in effect, ersatz pen testers.
Like a ban, you’re reducing the incidence rate. Unlike the ban, you’re extracting a public good from the ransom era’ work in the form of better infosec.
How does buying an insurance policy reduce the incidence of ransomeware?
I think the bright spot of the ban would be that if it was legally enforced then all hackers would see this and quickly realize it wasn't worth the risk.
(Not sure if I'm for this 100% - but I think it is worth considering)
Interesting point. If this kind of insurance became widespread, that would be great news for the attackers.
It's mostly because there aren't a lot of good measurements for assessing how likely a company is to get hacked / hit by RW (I'm not a believer in infosec through Q&A / self-assessment).
These are of course growing pains and especially for SMB some form of insurance + cybersecurity tooling basics will be the dominating approach to managing cyber risk.