Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

ciphercue.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#51

Post by jacquesm »

ozim wrote: post #43
bigfatkitten wrote: post #6

Earlier quoted context omitted.

It’s not a popularly held mindset, either within the security industry or outside of it. This piece seems to be pitched at salespeople whose only job is to extract money from other companies. Basic hygiene security hygiene pretty much removes ransomware as a threat.

OK I agree basic security hygiene removes ransomware as a threat. Now take limited time/budget and off you go making sure basic security hygiene is applied in a company with 500 employees or 100 employees. If you can do that let’s see how it goes with 1000 employees.

And just as dangerous: 50 employees. Because quite frequently these 50 employee companies have responsibilities that they can not begin to assume on the budgets that they have. Some business can really only be operated responsibly above a certain scale.

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#52

Post by nradov »

mewpmewp2 wrote: post #29
shrubble wrote: post #15

I don't think there is a reasonable correlation, since stopping ransomware doesn't require that much of an increase in spending; it's a culture thing more than a money thing.

What do you need to do to improve culture in the correct way?

All senior leaders need to visibly spend time on areas of cultural focus. Employees will ignore an email from some random IT department middle manager. But if they see C-suite executives putting sustained effort into something then they'll pick up on that and start to do likewise.

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#53

Post by qzw »

nradov wrote: post #45
entuno wrote: post #17

Earlier quoted context omitted.

It's one of those ideas that sounds nice in theory, but doesn't survive contact with the real world. In the same way that many people would say that you shouldn't negotiate with terrorists or kidnappers; but if it's their loved one who's being held and tortured they'll very quickly change their mind. Getting to a world where no one pays ransoms and the ransomware groups give up and go away would be the ideal, and we'…

That's fine, those are acceptable casualties. Make paying any sort of ransom a criminal offense.

You know what's an even more acceptable casualty that would greatly reduce ransomware? Cryptocurrencies.

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#54

Post by jamiemallers »

mschuster91 wrote: post #9
bigfatkitten wrote: post #6

Earlier quoted context omitted.

It’s not a popularly held mindset, either within the security industry or outside of it. This piece seems to be pitched at salespeople whose only job is to extract money from other companies. Basic hygiene security hygiene pretty much removes ransomware as a threat.

> Basic hygiene security hygiene pretty much removes ransomware as a threat. It does not. The problem is, as long as there are people employed in a company, there will be people being too trustful and executing malware, not to mention AI agents. And even if you'd assume people and AI agents were perfect, there's all the auto updaters these days that regularly get compromised because they are such juicy targets. And n…

[dead]

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#55

Post by billypilgrim »

ArcHound wrote: post #11
mschuster91 wrote: post #9

Earlier quoted context omitted.

> Basic hygiene security hygiene pretty much removes ransomware as a threat. It does not. The problem is, as long as there are people employed in a company, there will be people being too trustful and executing malware, not to mention AI agents. And even if you'd assume people and AI agents were perfect, there's all the auto updaters these days that regularly get compromised because they are such juicy targets. And n…

AFAIK the idea is to have backups so good, that restoring them is just a minor inconvenience. Then you can just discard encrypted/infected data and move on with your business. Of course that's harder to achieve in practice.

Modern ransomware are not just encrypting data but uploading them somewhere too, the victim is then threatened with a leak of the data. A backup does not save you from that.

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#56

Post by mhurron »

mschuster91 wrote: post #9
bigfatkitten wrote: post #6

Earlier quoted context omitted.

It’s not a popularly held mindset, either within the security industry or outside of it. This piece seems to be pitched at salespeople whose only job is to extract money from other companies. Basic hygiene security hygiene pretty much removes ransomware as a threat.

> Basic hygiene security hygiene pretty much removes ransomware as a threat. It does not. The problem is, as long as there are people employed in a company, there will be people being too trustful and executing malware, not to mention AI agents. And even if you'd assume people and AI agents were perfect, there's all the auto updaters these days that regularly get compromised because they are such juicy targets. And n…

> all mounted network shares where the user has write permissions

This is very literally what 'basic hygiene prevents these problems' addresses. Ransomeware attacks have shown time and again that they way they were able to spread was highly over-permissioned users and services because that's the easy way to get someone to stop complaining that they can't do their job.

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#57

Post by aswegs8 »

alopha wrote: post #3

The idea that the spending needs to grow linearly with the growth is a damning indictment of the mindset of the vast ineffectual mess that is the cybersecurity industry.

Was looking for the comment that addresses the clickbait-y headline, found this top comment by you, was not disappointed.

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#58

Post by wslh »

There is a publication making a related point in the DeFi security context: as TVL rises, the incentive to attack rises too, and defenses do not (or cannot) automatically scale with it[1].

[1] https://web.archive.org/web/20240911103423/https://www.bittr...

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#59

Post by supertrope »

ArcHound wrote: post #11
mschuster91 wrote: post #9

Earlier quoted context omitted.

> Basic hygiene security hygiene pretty much removes ransomware as a threat. It does not. The problem is, as long as there are people employed in a company, there will be people being too trustful and executing malware, not to mention AI agents. And even if you'd assume people and AI agents were perfect, there's all the auto updaters these days that regularly get compromised because they are such juicy targets. And n…

AFAIK the idea is to have backups so good, that restoring them is just a minor inconvenience. Then you can just discard encrypted/infected data and move on with your business. Of course that's harder to achieve in practice.

If the important data is in a web app and the Windows PC is effectively a thin client, this lowers the ransom value of the local drive. Of course business disruption in the form of downtime, overtime IT labor cannot be mitigated by just putting everything online.

The next step is just to move to security by design operating systems like ChromeOS where the user is not allowed to run any non-approved executables.

If tricking a single employee can cause an entire company to stall out, it's a process issue. Just like how a single employee should not be able to wire out $100,000.

Re: Ransomware Is Growing Three Times Faster Than the Spending Meant to Stop It

#60

Post by ninininino »

alopha wrote: post #3

The idea that the spending needs to grow linearly with the growth is a damning indictment of the mindset of the vast ineffectual mess that is the cybersecurity industry.

Apply that to any other war or arm's race. "The fact that the US' defense spending needs to grow linearly with China's is a damning indictment of the mindset of the vast ineffectual mess that is the defense industry".

Do you just expect one side to magically be more dollar-efficient than the other? I'm confused.

Post reply on HN