Not taking steps to have cybersecurity in companies should be criminalized as well... I am a CEO and thinks CEO's should be held directly criminally responsible for this.
Finally, any nation that allows hackers to operate from within their borders should be subject to 100x over damages caused sanctions. Countries without strong governments to enforce this should have direct airstrikes conducted against the individual hackers.
Any nation that harbors international terrorists by not at least attempting to hold them accountable is implicitly operating an outsourced covert activities team. The actions of any such team should be considered representative of that country and thus this would be an act of guerilla warfare.
Obviously this would be too transparent if done in the span of a week.
All these companies keeping lots of people data or even being relevant to national security having completely no incentive to stay secure. Now There is incentive to test their security.
A single person being able to compromise your company when paid a lot is a security issue that needs to be addressed.
But they would just turn around and add their costs on to the consumer.
I'll get hammered for this, but there's a part of me that would like to just outlaw all bitcoins worldwide, and even that might not work unless every country banned them?
Like dentistry, you can pay a little upfront for a better toothbrush or you can pay the dentist way more to repair your teeth later on.
I'm sure that there's proprietary data. Maybe knowing how much oil / gasoline is flowing might allow some traders to make unfairly informed trades (or maybe not: only inside trading is illegal. If someone figures out the information some other way, its not illegal IIRC).
And maybe employee data should be kept private, but there's no HIPPA requirement on that. Its not like there's payment processors on this thing either, so no PCI compliance here.
So I'm not exactly seeing why backing up data would be an issue in this case.
Also, backups are often taken but rarely is their actual recoverability tested.
The problem is information density.
So long as billions of records that are needed for the business exist in a device the size of a shoebox, we’re fucked. An insider can always take the shoebox, lock the shoebox, etc.
Three stories of paper files in file cabinets can’t be ransomed short of a physical bomb threat.
Don’t know what the solution is. But I do know the problem. Exfiltrarion is similar: the odd quirk of technology that has enabled these massive thefts is the ability to load millions of pages in a few seconds into a thumb drive. Odd pickle we’ve got ourselves into.
There may not be a solution if the problem is untrustworthy people.
The custodians of your ‘independent control’ will eventually get ransomwared themselves.
Then what?
It’s like cash... If you are a sophisticated criminal, do you waste time burglarizing individuals? Or, do you rob the bank where the individuals keep their money for ‘safekeeping’?
How many people at Amazon have access to the database other companies use to store info?
2? 20? 200?
I don’t know, but I bet it’s a lot. And I doubt they get paid enough to make them immune to a generous offer (or a scary threat) from a bad guy.
Seriously, how many individuals at Amazon have the ability — if they wanted - to irreparable corrupt, encrypt, or destroy data?
I think three daily encrypted backups mandated by law would be enough to stop the multi-million dollar ransoms.
We will still see companies paying ransom for a business days loss, but not complete shutouts? And infrastructure specific operations, like this pipe line, should be air gapped.
Which is why thieves rob banks.
But, money is fungible... if it’s stolen, it can be replaced. If the bank can’t replace it without going broke, the FDIC steps in and, essentially, prints more money to make you whole (up to a point.)
But, data is unique and irreplaceable.
If everyone is backing up to a smaller and smaller number of ‘cloud’ companies, it’s just centralizing the problem... putting everyone’s eggs in one basket.
Hopefully every member of DarkSide ends up in court if they're US or friendly nation citizens or in Gitmo otherwise
I prefer to think of them as bug bounties. Too often, bugs are reported now to bug bounty programs and are either grossly underpaid for the bug's actual value, or deflected as not a real issue at all. Ransomware is ultimately the result. "Fuck you, pay me."
A lot of ransomware operators are on sanctions lists. Paying them is already illegal. The US DoJ might want to check if Colonial has violated any laws in making these payments - and if they have, punishing them to serve as an example could well discourage future ransomware payers. As long as ransomware operators know they can get paid for their work, they're going to keep doing it.