The age old adage of giving an armed robber your wallet when he asks for it is creeping into cyberspace with the FBI advising that companies which fall victim to file encrypting ransomware infection should simply pay the ransom.
That was the message delegates to Boston’s Cyber Security Summit 2015 were told by Joseph Bonavolonta, an assistant special agent with the FBI.
“To be honest, we often advise people just to pay the ransom. The ransomware is that good,” Bonavolonta says.
Bonavolonta says he was referring to ransomware programs like Cryptowall, Cryptolocker, Reveton and other malicious programs that encrypt a victim’s hard drive contents and other directories accessible from the infected system. The victim is then asked to pay a ransom for the key to decrypt the data.
He says other than paying up, the options for those whose systems get infected with ransomware, were to revert to back up systems, or contact a security expert.
His comments started as an online debate among cybersecurity experts.
However, some says that the ransomware threat companies receive are a scam and paying up perpetuates the scam. Others were less inclined to believe that real victims can bounce back from ransomware infestations, which they said affected smaller businesses as well as consumers.
Chief exec of security awareness training firm KnowBe4 and author of a ransomware rescue manual,Stu Sjouwerman,says victims can waste a lot of time fruitlessly trying to undo the damage caused by ransomware, so from a strictly pragmatic perspective, Bonavolonta’s advice made sense.
“Eastern European cyber criminals are furiously competing and innovating their ransomware code,” Sjouwerman says. “CryptoWall, the current leader in ransomware, is highly sophisticated and uses unbreakable encryption. If you have no current backups you are toast, and the FBI’s comment to pay the ransom is a pragmatic business decision.”
Stay Connected
