At least 170 local or state government systems in America have been hit with ransomware, and the French Interior Ministry received reports of 560 incidents just in 2018, according to Phys.org. (Though the French ministry also notes that most incidents aren’t reported.)
But when a government system is hit by ransomware, do they have a responsibility to pay the ransomware to restore their data — or to not pay it?
“You have to do what’s right for your organization,” said Gregory Falco, a researcher at Stanford University specializing in municipal network security. “It’s not the FBI’s call. You might have criminal justice information, you could have decades of evidence. You have to weigh this for yourself.” Josh Zelonis at Forrester Research offered a similar view, saying in a blog post that victims need to consider paying the ransom as a valid option, alongside other recovery efforts.
But Randy Marchany, chief information security officer for Virginia Tech University, said the best answer is to take a hardline “don’t pay” attitude. “I don’t agree with any organization or city paying the ransom,” Marchany said. “The victims will have to rebuild their infrastructure from scratch anyway. If you pay the ransom, the hackers give you the decryption key but you have no assurance the ransomware has been removed from all of your systems. So, you have to rebuild them anyway.”
Victims often fail to take preventive measures such as software updates and data backups that would limit the impact of ransomware. But victims may not always be aware of potential remedies that don’t involve paying up, said Brett Callow of Emsisoft, one of several security firms that offer free decryption tools. “If the encryption in ransomware is implemented properly, there is a zero chance of recovery unless you pay the ransom,” Callow said. “Often it isn’t implemented properly, and we find weaknesses in the encryption and undo it.”
Callow also points to coordinated efforts of security firms including the No More Ransom Project, which partners with Europol, and ID Ransomware, which can identify some malware and sometimes unlock data.
of this story at Slashdot.
Source:: Slashdot