How to counter ransomware? Have a plan ready, and work fast

Refael Franco, former Deputy Director-General of the Israel National Cyber Directorate, allow me to ask you the question every CEO struggles with - Should I pay or not pay the ransom?

"For those who prepare for an attack in advance and know how to operate against an attacker - the question of whether to pay will become redundant. We at Code Blue use trickery and deception against attackers so such questions won’t be relevant. The deception is both psychological and about the legitimacy of the attacker. It is also possible to carry out counterattacks, but it is more complicated and expensive."

Code Blue founder Rafael Franco

"If you paid - they will return. Moreover, statistics show that in 23% of the cases, even if you paid a ransom, you will not get your files back. After all, these are criminal organizations and not righteous people.”

“It is not a question of if, rather a question of when. Just as you have an insurance policy, a lawyer, and an accountant - you must have a cyber crisis manager. It is impossible to learn it while in motion, you must be prepared in advance. It's a profession, a new one though, but it is a profession I acquired through many operations I participated in."

“In 2020, the cyber defense paradigm has changed. Israel is a target for three types of attackers: First, Iran, interesting but not enough; Then there is BDS (The Boycott, Divestment and Sanctions movement against Israel); And the third, cybercrime. All of the security organizations in the world did not pay enough attention to the third one. And then came Covid, which brought a formative event: the transition of the entire world, all systems, and all commerce towards digital, and organizations had to adapt and act hastily, many organizations were exposed to new technology and the need for cyber defense, but just as the Hebrews rushed out of Egypt so did some of this organizations, and the last thing that was on their mind was security. The result was that massive organizations had to build entire defense systems within one year, compared to the five years it requires.”

“Organizations are in the process of internalizing, but that is not enough. It should be understood that a ransomware incident is not a problem for the information systems manager or the security manager, rather it is a problem for the CEO. You have to change the perception from cyber defense to cyber crisis management. What is damaged in a cyberattack is not just the computer systems, but the business itself. Is the production line being locked? So this is a problem for everyone. If the company does not know how to work together in a crisis, it will not be able to minimize the damage."

So it is not enough to have the best software?

“It is impossible to hermetically close a system, but in the past, the slow pace of attacks allowed enough time to close the holes, but that is not the case anymore. Therefore, you have to prepare in advance for a cyberattack so as not to think about what to do as it happens. This means analyzing in advance what a shutdown will mean, which information is important and which is less crucial, where there are backups, and where there are none. Once you prepare in advance - you know what to do, and if you shoot from the hip it can cost you tens of millions and sometimes even reach insolvency. Studies show that the stock of a company attacked drops by 3% immediately, in the first year it drops by 8.6% and five years later by 15%, which means that investors and customers lose confidence over time."

"Both. There are those who knock on every door and there are those who check out the 500 largest companies in Israel. In the past year, we saw more focused attacks, but every criminal organization has its own methodology.”

"Israel leads in cyber defense"

What do you need to attack? Electricity, access to YouTube because there are hacking tutorials, a basic understanding of the Darknet, and time. There is no shortage of bored 17-year-olds sitting at home for the past year, with an emphasis on the third world. Nothing is required of them, except to be faster than those they attack. You can imagine it as a board on which both sides run and whoever arrives at the end faster will win."

“Israel knows how to protect its critical infrastructure. But this is not the case everywhere else. For example, something like the cyber attack and shutdown of the oil pipeline in the U.S. two weeks ago cannot happen in Israel."

"Israel is ahead of every other country in regards to the cyber defense of critical infrastructure. There is no oversight in the U.S. of critical infrastructure because everything is privatized. In Israel, we do not look at whether the infrastructure is privately or publicly owned, but at its level of criticality for the state, at the level of Maslow's scale of needs."

"Just because there are more cops doesn't mean the crime is beaten, I do not see criminal organizations simply disappear. We will see more complex social engineering: emails coming from familiar people, often senior ones that give the feeling that you must open, and the systems are having a hard time finding those. It is true that seniors' accounts are often hacked into because valuable information can be extracted from them, and they carry more permissions. Social engineering is the number one cause of breaking into an organization."

It is very difficult to find clues inside the Darknet. There is now an international effort to catch those criminal elements, but so far without the expected results. Attackers currently enjoy full immunity. Countries from the evil axis can also send more hackers without leaving any footprints. So far there is no deterrence, in North Korea for example, it is estimated that 20% of the country's GDP comes from cybercrime."

"There is no chance in the world that someone who has made such good progress will stop it now."