Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/17/2020
02:00 PM
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

To Pay or Not to Pay: Responding to Ransomware From a Lawyer's Perspective

The threat of data extortion adds new layers of risk when determining how to respond to a ransomware attack.

Ransomware has grown an additional gnarly tentacle: data extortion. It was gruesome enough with threat actors encrypting data in place but has morphed and added data extortion to the mix. Cases are emerging with a two-part payload of data encryption and data extraction, where data is encrypted in place while a small portion of unknown data is ferried offline under the threat of publication. (Or, in the case of cybercriminal organizations such as the now defunct Maze group, actual publication of a portion of the data — with threats to publish more on the way.)

Related Content:

How Healthcare Organizations Can Combat Ransomware

The Changing Face of Threat Intelligence

The Double-Edged Sword of Cybersecurity Insurance

In previous ransomware scenarios, an organization just had to decide whether to pay a ransom to get the key to unencrypt the data. But now it must consider making what is essentially a "forever promise" with a criminal organization. The threat actors are demanding payment in exchange for alleged proof that they deleted the data. In practice, they are saying "trust us" to delete data that they previously threatened to publish. It's not a great situation to find yourself in.

Having lived through this several times with my clients, I have learned some immediate tactical considerations any organization must keep in mind before deciding how to respond to a ransomware attack.

1. Negotiate? If so, should you do it yourself or use a professional negotiation company? Even when you have logging in place, it may be impossible to discern exactly what the threat actor removed from the network. Even if the threat actor claims they took only a small portion of data, they often leave you guessing about what else they may have in their possession. Therefore, you're racing to determine what information may be dumped into the Dark Web. So, do you negotiate? This may be wise — even if you don't plan to pay — so that you can buy time to determine more about what information may have been lost. The decision to hire an outside negotiation company is really an incident-by-incident decision. Often, skipping the extra cost can be the best bet but it can be very circumstance specific. Work with your legal team on strategy before engaging an outside negotiation company.

2. Deleting the data doesn't alleviate your legal risks. Even if the threat actor deletes the data they exfiltrated from your network, this does not alleviate your legal responsibilities or risks. Generally, the law will look at whether the data was both "accessed and acquired" or, in the case of other statutes, accessed with some proof of misuse. Given that a threat actor has taken the data, there is no way to dodge the "acquired" component of the law. You are legally required to notify any individual whose information was taken — even if the threat actor deletes the data.

3. Will you pay? Or pay and face a sanction? The US Department of Treasury Office of Foreign Assets Control issued an advisory opinion on Oct. 1, noting that there are risks of sanctions associated with certain ransomware payments because ransoms often fund criminal activities. So, if you are considering making a ransom payment, analyze the issue thoroughly with counsel to make certain you do not jump from the frying pan into the fire.

Cyber data-extortion incidents are wicked. And because they are fraught with liability, it's best to work through these issues with your lawyer to cloak your investigation and actions with attorney-client privilege while navigating the legal risks associated with the extortion.

Beth Burgin Waller is a lawyer who knows how to navigate between the server room and the board room. As chair of the cybersecurity & data privacy practice at Woods Rogers, she advises clients on cybersecurity and on data privacy concerns. In this capacity, she ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25159
PUBLISHED: 2020-11-24
499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
CVE-2020-25654
PUBLISHED: 2020-11-24
An ACL bypass flaw was found in pacemaker before 1.1.24-rc1 and 2.0.5-rc2. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went throu...
CVE-2020-28329
PUBLISHED: 2020-11-24
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.
CVE-2020-29053
PUBLISHED: 2020-11-24
HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
CVE-2020-25640
PUBLISHED: 2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.