To Pay or Not to Pay? Getting Your Ransomed Data Back
By: Jim Stickley and Tina Davis
December 10, 2019
Many businesses struggle with whether or not to pay for ransomed data on a daily basis. Ransomware attacks are increasing, especially among targets like healthcare and financial institutions, law enforcement, universities, and entire cities. Opinions vary on strategy and it brings up many questions, the least of which is what is the ransomed information worth to the victim? Any business has many factors to consider before making that critical decision, among them: If they do decide to pay up, usually in Bitcoin, what guarantee do they have the data will be unlocked?
Some believe the answer is a calculated determination that puts business and financial interests first, while other victims such as hospitals must consider the cost to patient health. Either way, paying a ransom or not is never an easy decision.
The FBI has made no secret about its take on the subject: Never pay a ransom demand, it only encourages further attacks. While many security experts agree, others have alternate opinions.
Experts at Forrester Research look at why and when it makes sense to pay a ransom demand. In a recent report they “…now recommend that even if you don't end up paying the ransom, you should at least consider it as a viable option. The average ransomware attack lasts 7.3 days.” The harsh reality of having city services gridlocked or vital healthcare information unavailable for a week or more is crazy-making for most victims. But according to report authors, there’s an alternative.
Being prepared for a cyberattack like ransomware may be the best alternative yet. Regularly backing up system data provides an attack victim the option to restore what has been locked by a ransom–but that’s easier said than done. Data backups should be separate from the operations network where the company’s servers and networking equipment are located. If possible, they should be completely free of any internet access. Ongoing tests for the backups are necessary to make sure that when needed, backups function properly and successfully restore the data. Other considerations like cybersecurity insurance and response teams dedicated to ransomware attacks can also help a business make the decision whether paying a ransom is in its best interests.
Whatever the choice, it should be considered seriously and put into place as part of an organization’s overall cybersecurity strategy. There is no right or wrong answer, but there should be consideration about what to do should it hit.
SUBSCRIBE TO WEEKLY NEWSLETTER
