Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

cyberscoop.com

Post reply on HN
Print view View original

91–100 of 105 posts

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#91

Post by arbuge »

IG_Semmelweiss wrote: post #87

I don't see this being true as hackers targetting. Cyber insurance is not generally public information. Moreover, there are different flavors of cyber insurance. Some of which cover ransom pay and some do not. Having knowledge at such a thing means only 1 thing: Someone in the hacker group has access to insider information. Only select people have access to such policies. Call me a skeptic but i would assume 1 of 100…

> Cyber insurance is not generally public information.

It might not be required to be, but it might still be disclosed anyway for various reasons in public market filings, on investor calls, employees talking in social media, and so forth.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#92

Post by abakker »

IG_Semmelweiss wrote: post #87

I don't see this being true as hackers targetting. Cyber insurance is not generally public information. Moreover, there are different flavors of cyber insurance. Some of which cover ransom pay and some do not. Having knowledge at such a thing means only 1 thing: Someone in the hacker group has access to insider information. Only select people have access to such policies. Call me a skeptic but i would assume 1 of 100…

I find it difficult to believe that CEOs and their advisors would not read insurance contracts. This may seem true, but any business with a corporate council and a team contemplating buying insurance is likely to take care to ensure that they contract for, and purchase, the product they intend to purchase.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#93

Post by nefitty »

DavidPeiffer wrote: post #77
Aeolun wrote: post #73

Can’t we just disallow email messages from anyone that is not either in the organisation or messaged by a user before? No more ransomware, or at least not as easily.

There are often classes of employees where external email is completely unnecessary. I know of one financial institution who has implemented this. It wouldn't work well for many employees though. For example, try signing up for a legitimate service and guessing what email address the confirmation link will be sent from.

In a strict security environment, shouldn’t the employee request permission or, at the very least, give IT a heads up that they’re going to sign up for an external service? IT would vet the service and then apply the domains to the whitelist.

I know how bad it sucks to have to ask permission for every little thing, but if the alternative means risking ransomware attacks, then the case should be laid out transparently to everyone in the org so they understand why the rule is in place.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#94

Post by RcouF1uZ4gsC »

"Millions for defense, but not a damned penny for tribute."

- Charles Cotesworth Pinckney when asked for tribute by the Barbary Pirates

Maybe we need to start treating ransonware attacks more like this. Spend money on hardening targets. Also pursue an policy of economic sanctions against countries that tolerate these types of activities in their borders. Maybe we need to make it possible to quarantine countries from the rest of the Internet who abuse the commons.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#95

Post by nefitty »

nickpp wrote: post #50
m3at wrote: post #44

Earlier quoted context omitted.

Interesting argument, though forcefully selecting a donnor does not increase organ failure rates for others, whereas paying ransom does increase risks of future attacks.

It does modify behavior though: I am more likely to engage in risky activities like heavy drinking and overeating if I know a replacement organ (like a liver) is readily available thanks to the wisdom of the government.

On its face, this sounds like an extreme behavioral reaction to having “replacement organs” available, but it actually tracks with my own anecdotal experience.

I was not comfortable skateboarding again until I had good insurance as I do now. I don’t go crazy, but it is definitely a weight off my shoulders knowing that if I break a bone I’ll be able to get help without wrecking my finances. On the other hand, my brother doesn’t currently have insurance, and in the past he was super advanced at skateboarding. He is very hesitant to skate with me because of his fear of getting hurt. It’s pretty wild to see that play out in my own life, and it has made even more empathetic to the decisions other people make and the sorts of high-level factors that come into play there.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#96

Post by wjnc »

abakker wrote: post #92
IG_Semmelweiss wrote: post #87

I don't see this being true as hackers targetting. Cyber insurance is not generally public information. Moreover, there are different flavors of cyber insurance. Some of which cover ransom pay and some do not. Having knowledge at such a thing means only 1 thing: Someone in the hacker group has access to insider information. Only select people have access to such policies. Call me a skeptic but i would assume 1 of 100…

I find it difficult to believe that CEOs and their advisors would not read insurance contracts. This may seem true, but any business with a corporate council and a team contemplating buying insurance is likely to take care to ensure that they contract for, and purchase, the product they intend to purchase.

Well, from the industry, re-insurance contracts aren't hard to read, but they are written in legal prose that's quite far from your average readers day to day reading. Let's say that in 50 pages of boiler plate only twenty items mark the exact risks covered. That's why most firms use brokers to translate the T&C to PowerPoint. Obviously important contracts get read and negotiated by teams. And then ten years and a few renewals pass, people move on and suddenly you've got a coverage on a historic part of your portfolio that nobody groks. We're all human.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#97

Post by bluGill »

takeda wrote: post #85
paxys wrote: post #6

Earlier quoted context omitted.

Do you have any proof of that (or even cases where that has happened before), or are you just making it up?

Proof already was provided, but even without it's just common sense. If ransomware was implemented correctly (like using asymmetric cryptography for encryption). There's hardly anything you can do if you don't have backups.

I'm sure companies will backups could use qualified IT help if they suddenly need to restore all their computers from backups quickly. Even if the backups all work, there is a lot of effort to restore them.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#98

Post by fouric »

yodelshady wrote: post #68
StavrosK wrote: post #64

Earlier quoted context omitted.

Why is your data executable?

I'm really not sure that has a serious answer. https://en.wikipedia.org/wiki/Infrastructure_as_code https://en.wikipedia.org/wiki/Virtual_machine https://en.wikipedia.org/wiki/Disk_image https://en.wikipedia.org/wiki/Shadow_IT https://en.wikipedia.org/wiki/Von_Neumann_architecture Separation of code and executables is a nice idea that approximately 0% of organisations fully adhere to.

> https://en.wikipedia.org/wiki/Infrastructure_as_code

> "definition files"

Not executable. Text. Readable by humans. Inspectable by humans so you can root out rootkits. Not even the valuable data that cyber criminals go for anyway - they go for personal and financial data, not k8s config files.

> https://en.wikipedia.org/wiki/Virtual_machine

> https://en.wikipedia.org/wiki/Disk_image

Neither of those are relevant. You don't back up virtual machines or image disks - you take afore-mentioned plain-text, audited config files and spin up new instance from scratch.

> https://en.wikipedia.org/wiki/Shadow_IT

If those are actually shadow IT, they won't be in the backups anyway.

> https://en.wikipedia.org/wiki/Von_Neumann_architecture

This is irrelevant snark. If you back up a data file, it doesn't matter that it's stored in the memory of a Von Neumann architecture - it's only going to be used as a data file.

> Separation of code and executables is a nice idea that approximately 0% of organisations fully adhere to.

Citation needed. Also, you just said:

> If the ransomware operators follow best practices

...so are we considering the ideal case, or not?

> I'm really not sure that has a serious answer.

Being snide is bad by itself, but it's even worse when you're wrong on top of it.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#99

Post by fouric »

jve wrote: post #25
viraptor wrote: post #18

Earlier quoted context omitted.

> You are aware that paying ransom may or may NOT work. The ransomware campaigns are pretty good on support. You will get a key for a sample of your data as a proof. You can sometimes pay progressively to get more trust. Getting your data back is just as important for the criminals as encrypting it in the first place - otherwise their business goes down.

Oh, good to know they provide support. I just remember some ransom (was it notpetya?) that had a broken "pay" thing or some invalid mail... anyway, you couldn't get the key. And encryption your data doesn't help if you don't have backups. Edit: Here is the story: https://www.theverge.com/2017/6/27/15881110/petya-notpetya-p... So email provider blocked their email...

> And encryption your data doesn't help if you don't have backups.

Actually, it does. "We'll delete your data." is not the only ransomware threat - the other one that's not quite as big, but growing, is "We'll leak your data."

Backups prevent denial. Encryption prevents dissemination.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#100

Post by oneplane »

curryst wrote: post #78
oneplane wrote: post #59

Earlier quoted context omitted.

And if the interviews on infosec podcasts are any indication, insurance also means complacency on a management level because "we have insurance", and the insurers don't require you to actually make your security better. So being cyber-insured: - likely to have money to pay the ransom - probably not really implementing strong security policies - management more important than reality, so engineering buy-in unlikely wh…

I think there's a net benefit to both sides here. The insurers probably charge a lot, in part because the risk is so hard to estimate and changes constantly with changes as well as new CVEs. I doubt they're losing money. The insured company gets benefits in terms of opex instead of capex, but more importantly, gets the expertise of the insurer in dealing with the situation. In that interview, the hacker also talks ab…

That's a perspective I probably heard before but completely forgot about. Nice summary!

I suppose having an efficient resolution to any 'problem' would be a net benefit for all parties involved, even if we would think all sorts of negative thoughts about it from a technical perspective. The same goes for botched negotiations or indeed people who don't even know how to deal with cryptocurrency.

It does make me wonder when thinking about hostage negotiations if that parallel insurance concept has different requirements on the company in question. Say you ship expensive employees to a facility in a country where they are likely to be captured for ransom, you'd expect some training for the employees to deal with 'being held hostage', or 'reducing the likelyhood of being taken'. If that is the case, something similar would be sensible in the ransomware scenario, right?

Post reply on HN