Not exactly network but maybe, but certainly operational. Shouldn't this just be handled like disaster recovery? I haven't looked into this much, but it sounds like the only way to stop it is to stop paying the crooks. There is also the obvious problem that if they got in, something (or someone) is compromised that needs to be cleaned which sounds sort of like DR again to me.
Mike
The goal is to make your business very difficult to hack that it is no longer economically viable for terrorists to attack it in the first place.
That’s the best insurance you can give to your business.
And yet, so often their system is vulnerable owing to ineptness, cluelessness, or laziness. For example, when the City of Baltimore's system got locked up, the attacker exploited a vulnerability for which MS had issued a patch *2 years earlier* (if memory serves).
Anne
A lot of the payments for Ransomware come from Insurance Companies under “Business Interruption Insurance”. It in fact may be more cost effective to pay the ransom, than to pay for continued business interruption.
Of course along with paying the ransom, a full forensic audit of the systems/network is conducted. The vector for many of these attacks is via a worm triggered by someone opening an attachment on an email or downloading compromised software from the Internet. Short of not allowing email attachments or blocking Internet access, the best method is to properly train users to not click on attachments or visit “untrusted” sites, but nothing is perfect.
Shane
So what is the industry standard if there is one for DR recovery? Shouldn't this just be considered another hit by the Chaos Monkey?
Mike
Incompetent insurance companies combined with incompetent IT staff and under-funded IT departments are the nexus of the problem.
Nah, it’s even simpler. It’s just dollars all around. Always is.
Agreed.
From this company’s point of view, the cost to RECOVER from the problems is so much smaller than it would be to prevent the problems from happening to begin with, so they are happy to let you guys handle it. From the insurance company’s point of view, they are collecting premiums, but no claims are being filed, so they have no incentive to do anything differently.
I’m sure that’ll change drastically if either of these conditions are true:
I think it’s reasonable to expect at least one of those things will happen in the next year.
-A
I wonder if this is preying off the firewall hard-on-the-outside-soft-on-the-inside? At this point I'm not sure how you can justify that because so many people are using their own equipment. It's not just the operational side of the business they can target, after all.
Mike
If that's a concern, you've *already* totally screwed the pooch regarding DR planning.
Here are some facts that it’s important to not pay them.
80% of ransomware victims suffer repeat attacks, according to new report
https://www.cbsnews.com/news/ransomware-victims-suffer-repeat-attacks-new-report/
published June 17th 2021
Don’t pay them. Just clean your mess. 
Jean
fre. 25. jun. 2021 21.33 skrev Aaron C. de Bruyn via NANOG <nanog@nanog.org>:
Incompetent insurance companies combined with incompetent IT staff and under-funded IT departments are the nexus of the problem.
Nah, it’s even simpler. It’s just dollars all around. Always is.
Agreed.
From this company’s point of view, the cost to RECOVER from the problems is so much smaller than it would be to prevent the problems from happening to begin with, so they are happy to let you guys handle it. From the insurance company’s point of view, they are collecting premiums, but no claims are being filed, so they have no incentive to do anything differently.
I’m sure that’ll change drastically if either of these conditions are true:
- A claim is filed
- An audit is required
- Ransomware surges throughout 2021 and payouts go through the roof
I think it’s reasonable to expect at least one of those things will happen in the next year.
-A
Or they do business in the EU where huge fines are becoming the norm. The ransomware does not matter but the implied data breach does.
NEW ZEALAND HEALTH EXPERIENCE AND DISCUSSION
Some of you may be aware that one of our major hospitals was taken off line with 680 compromised servers.
Discussion on one local list is that the systems have been open for some time and the rnasom hackers didn't open the systems, they have just caused them to be cleaned up and locked.
I was in one of our other hospitals this week. I was presented with Windows 2000 systems. These people don't seem to understand the concepts of a dated DLL stack, combined with inter system networking. They don't leave me with the impression that we've been presenting object level compromise data for decades now. They don't seem to understand that we've made that public facing for, what I would have thought, fairly obvious reasons. By 'we', I don't mean any special, crazy, conspiracy theory, tin foil hat wearing groups, I mean just plain old every day computer geeks who write software.
In the NZ hospital case, it looks to me, and I don't know, this is just pure speculation, like someone is going around global hospitals and making them clean up stuff that they should have been upgrading.
I personally accept that there are groups around the world with vested interests to have access to our hospital systems, if for no other reason that just to see who's coming and going... you never know when that might make a cool media story ea?....
I keep reading how this is a training issue of staff in hospitals who shouldn't be clicking on email attachments. It's a comment that just strikes me as bonkers. It's not a training issue at all, other than training management that systems have to be patched, updated, and upgraded.
Call me crazy, but you can't go around telling kids that IT has great jobs, ask them (make them) pay for education, and then not actually give them jobs to do the work that clearly has to be done.
Yes, you can call this a conspiracy theory, but I venture that when old people cry out for young people to learn IT so they can make better health systems, and then 'investors' don't actually upgrade to those 'new systems' and just leave the doors wide open to personal information, at some point some folk are going to get their noses out of joint.... a fairly obvious theory that to many in management are just discounting as conspiracy until things get broken.... then they blame the user for using email.
Going back a number of years our whole social services system was found to be wide open because a vendor couldn't make their software work without giving it a 'few more permissions'. Couple that kind of thinking with decades old, compromised, DLL stacks... interests who like to just quietly watch... and a lack of good, reasonably paid IT work... and I have one question....
" Can somebody explain these ransomwear attacks?" ...I don't know... can I?
HTH
D
It gets tricky when 'your' company will lose money $$$ while you wait a month to restore from your cloud backups.
So Executives roll the dice to see if service can be restored quickly as possible keeping shareholders and customers happy as possible.
But if you pay without finding how they got in, they could turn around and do it again, or sell it on the dark web, right?
Mike
Ransomwear - the latest fashion idea.
"Pay me money or I will continue to wear these clothes"
I reckon I could make a killing just by stepping out in a knee-length
macrame skirt...
Regards, K.
It gets tricky when 'your' company will lose money $$$ while you wait a
month to restore from your cloud backups.
So Executives roll the dice to see if service can be restored quickly as
possible keeping shareholders and customers happy as possible.
Lol. Thanks, I knew that didn't look right. Maybe with a crop top to complete the ensemble.
Mike
In my humble opinion, the hidden assumption beneath this question seems to be incorrect. Ransomware is not a single event, with assumed similarity to the kind of failures, we regulary see at our network world.
The key abstruct differences, might be summed up as follows:
A. First and foremost, ransomware attack is not a single failure, such as failing NAS or power outage might be. In fact, it takes enormous amount of time, just to be remotely sure, how this thing got into your network, in the first place. Cause simply bringing your backup network (i.e. your backup solution and its’ storage) online, otherwise presents not only you with the ability to revert all files to their saved backups - but more importantly, may allow the ransomware to encrypt your backups, too. It’s not a single event. First, you must be sure you plugged the holes and eliminated the threat, before you can even bigin considering, connecting your backups. Think of it this way: ransomware is a program, running on some computer, just looking for more files to encrypt. Without properly removing this threat first (how do you find, which computers have it in the first place?), every new disk connected somewhere at the network, with chances of 99%, will be promptly encrypted.
B. Usually (and you may suspect it as much), another hacking initiatiatives are also involved. Recently, we see data theft accompanying ransoware efforts. Mainly with high stakes events (i.e. not that random phishing email that your neighbor clicked on, believing he has relatives stuck in Nigeria without money, since 1985). Simply bringing your backups online, is rushing to action without fully evaluating the threat and hackers/ATPs “just love” rushed and not fully thought thru actions. Once again, it is far-far more complecated question, than just bringing the backups online and starting copying the files over. Without proper security (not network!) action, you more likely allowing the bad guys access to more stuff, than simply recovering your operation.
C. High stakes ransomware events (i.e. not the same neighbor from above) are complex security events, not just loosing some data. To gain initial access, not the ransomware tools are the tools which used. Moreover, some ATPs deploy surveilance/hacking tools, also during the peak events (such as discovery, your IT/Security folks initial response, ransom negotiations themselves, hiring outside specialists etc.) to (a) maximize their profit from the operation and (b) try and avoid law enforcement. Those might be (and usually are) completely silent tools (such as diskless viruses) whose whole purpose is monitoring your response and give the bad guys as much surveilance power, for their advantage, as they can possibly use.
In short, serious ransomware events, are multy faceted, nothing like we at the network level are accostumed too, outages. Sure, there are many similarities and in some cases, may even be complete likeness, but those are usually smaller events. Adittional difference, might be that our outages at 99.9999% are lacking malice while ransomware events are - and you may think to yourself, ah … it’s simply a so small, theoretical question, but it isn’t - the most important practical consideration, is that network outage is not actively trying to hide it tracks (remember the question, how you find the PC running his software and clean it up?). I never met power outage, which constantly deleting log files. Especially not after everything presumably went up.
So, yes - we should never pay the crooks, but’s unfortunatelly, a very simplified outlook. I wish, we could allways follow that simple solution but our life, is unfortunatelly much more complicated.
Ah … and one more thing. Gladly, it is not our (network folks) life’s complicated. It’s system/DBA/and security folks, lifes. But I don’t want to get cocky. We got SDN 
Alex.
בתאריך יום ה׳, 24 ביוני 2021, 17:44, מאת Michael Thomas <mike@mtcc.com>:
Hi!
On Fri, 25 Jun 2021 18:56:36 +0300, "Alex K." <nsp.lists@gmail.com> may
have written:
Ah ... and one more thing. Gladly, it is not our (network folks) life's
complicated. It's system/DBA/and security folks, lifes. But I don't want
to get cocky. We got SDN
Yet. Probably.
Ransomware gangs /do/ target infrastructure - currently known to be DNS
servers (Microsoft), hypervisors, backups, etc. I wouldn't assume that they
wouldn't try attacking the network itself today or in the future.
