48 ways you can avoid file-scrambling, data-stealing miscreants – or so says the Ransomware Task Force

The Institute for Security and Technology’s Ransomware Task Force (RTF) on Thursday published an 81-page report presenting policy makers with 48 recommendations to disrupt the ransomware business and mitigate the effect of such attacks.

The RTF, formed last December and populated by representatives from companies like Microsoft, Palo Alto Networks, and Rapid7, and government organizations like the FBI and US Secret Service, has nothing to do with the RDETF, or Ransomware and Digital Extortion Task Force, assembled last week under the auspices of the Justice Department. However, the RTF and RDETF can be expected to cross-pollinate one another.

The report, provided in advance of publication to The Register and due to appear here, attempts to provide guidance for dealing with the alarmingly popular scourge of ransomware, which generally involves miscreants who obtain access to poorly secured systems and steal or encrypt system data, thereafter offering to restore it or keep quiet about the whole thing in exchange for a substantial payment.

“Ransomware is not just financial extortion; it’s a crime that transcends business, government, academic, and geographic boundaries,” the report says. “It has disproportionately impacted the healthcare industry during the COVID pandemic, and has shut down schools, hospitals, police stations, city governments, and US military facilities.”

Ransomware funds criminal organizations, the report says, and supports their activities like human trafficking and the proliferation of weapons of mass destruction. And it has gotten the attention of federal officials.

“Let me be clear: ransomware now poses a national security threat,” said Alejandro Mayorkas, Secretary of Homeland Security, in a March speech that promised steps to address ransomware in the coming weeks.

The RTF report notes that in 2020, there were nearly 2,400 government, healthcare, and academic organizations in the US affected by ransomware. The average ransom paid has varied substantially from quarter to quarter but is nonetheless substantial: $111,605 in Q1 2020, $178,254 in Q2, $233,817 in Q3, and $154,108 in Q4. The total amount paid in 2020 increased 311 per cent to reach around $350m in cryptocurrency.

The report’s recommendations focus on four areas: deterring attacks, disrupting the ransomware business model, helping organizations prepare defenses, and helping organizations respond effectively if attacked.

Without major intervention, the situation will only get worse

The report proposes interventions such as internationally coordinated investigation and enforcement, political pressure on complicit nations, and encouraging or forcing greater cryptocurrency exchange cooperation with law enforcement. It also suggests applying legal tools used against organized crime to ransomware developers, affiliates, and infrastructure providers.

Other ideas include: tax breaks for organizations as an incentive for adopting secure IT practices; empowering some authority to declare a cyber-disaster to trigger federal aid and intervention; and centralizing expertise in cryptocurrency seizure.

“Without major intervention, the situation will only get worse as ransomware criminals continue to evolve their tactics and the proliferation of devices through the internet of things dramatically expands the attack surface,” the report concludes. ®

READ MORE HERE