Cybersecurity: Ransomware

Ransomware is malware that employs encryption to hold a victim’s information at ransom. A user or organization’s critical data is encrypted so that they cannot access files, databases, or applications. A ransom is then demanded to provide access. Ransomware is often designed to spread across a network and target database and file servers, and can thus quickly paralyze an entire organization. It is a growing threat, generating billions of dollars in payments to cybercriminals and inflicting significant damage and expenses for businesses and governmental organizations.

Ransomware is a form of malicious software used by cyber criminals to hijack a user's computer or mobile device and keep it under their control until the user pays for its release. Cyber criminals use various strategies to try to extort money from unsuspecting users with ransomware, such as encrypting files saved on the user's device; threatening to erase important files; denying access to key programs and applications; and entrapping the user by linking them to extreme or illegal pornographic material. The user will then be instructed to submit some form of untraceable payment to the cyber criminals behind the ransomware attack, though anti-fraud authorities stress that making such a payment does not guarantee the release of the user's device.

A joint product from CISA and the Multi-State Information Sharing and Analysis Center (MS-ISAC), which is a customer centered, one-stop resource with best practices and ways to prevent, protect and/or respond to a ransomware attack. The guide, published in September 2020, aims to inform and enhance network defense and reduce exposure to a ransomware attack, and it includes two resources: 1) Ransomware Prevention Best Practices; and 2) a Ransomware Response Checklist.

Ransomware attacks are big business. By the end of 2021, it is estimated that a business will be targeted by a ransomware attack every 11 seconds, causing up to $20 billion in damage. Ransomware attacks are not just a concern for organizations such as businesses, governments, and healthcare providers – they also affect customers and employees, whose data is often the collateral damage of these types of attacks.

Ransomware is a growing threat to companies big and small. The total global cost of cybercrime hit £3.5 trillion in 2015. The annual cost is expected to double to £7.5 trillion in 2021. Ransomware represents a huge proportion of this growing criminal industry.

The next major conflict between world powers may not begin at sea or along a disputed border, but in cyberspace. In the past decade, hackers have targeted voting systems in the United States, electrical grids in Ukraine, uranium enrichment facilities in Iran and hospitals, universities and major corporations around the world. The attacks have focused new attention on whether the United States is acting quickly enough to protect computer networks serving critical infrastructure, from military bases to power plants. Cybersecurity experts say companies holding sensitive data are particularly vulnerable to digital attacks, such as the recent hack of the Equifax credit reporting agency that potentially affects 145.5 million U.S. consumers. The United Nations is working to develop international rules for cyberwarfare, but the effort faces major hurdles, including deciding how even to define a cyberweapon. Allegations that Russia used social media to disrupt last year's presidential election are another focus of concern as the United States prepares for the 2018 congressional elections.