Ransomware attacks are a significant and increasing threat to organizations of all kinds. Government agencies have recently issued guidance for preventing and responding to ransomware attacks. Organizations should consider that guidance and take appropriate steps to prevent, and prepare to respond to, ransomware attacks.
Ransomware
Ransomware is malicious software that prevents access to or use of an infected information technology device or system (an "IT Resource") or related data, and demands (typically through an on-screen warning or other form of ransom note) that a ransom be paid (often in virtual currency or other forms of untraceable payment) by a specified deadline to obtain a key to restore the infected IT Resource or data. There are two basic kinds of ransomware: "locker" ransomware (which prevents use of an IT Resource by locking the user interface) and "crypto" ransomware (which encrypts specific files or data so they cannot be used without the required decryption key).
Ransomware is often installed on an IT Resource through fraudulent techniques, such as a deceptive email with a malicious attachment or link (known as "phishing" or "spear- phishing"), surreptitious downloading from an infected website (known as "drive-by downloading") or an infected message on a social media site. Sophisticated ransomware can spread throughout a computer network (including to data stored in cloud services) before the ransomware activates, and can install other kinds of malware on the network.
A ransomware attack can cause significant financial loss and other harm to the victim organization, including: (1) temporary or permanent loss of use of IT Resources and data; (2) business disruption loss and resulting liability to customers and business partners; (3) costs to restore infected IT Resources and data, if possible, and to otherwise respond to the ransomware attack; and (4) harm to the organization's reputation and relations with customers and business partners.
While most hackers profit by using or selling stolen data, ransomware criminals profit by demanding ransom payments from organizations and individuals whose IT Resources and data are affected by the ransomware. The primary result of a ransomware attack is business disruption and loss of use of data to the victim organization, rather than harm resulting from unauthorized disclosure of data, but some ransomware attacks can result in hackers obtaining access to data.
Paying a ransom is risky because the payment encourages ransomware criminals and does not guarantee that required restoration codes will be provided or that the ransomware and other malware will be removed from the infected IT Resource. Nevertheless, ransomware victims often chose to accept those risks and pay the ransom to avoid the cost, delay and other adverse consequences of relying on alternative remedies (e.g. attempting to restore infected IT Resources and data) if any are available. For those reasons, the number and sophistication of ransomware attacks have increased over recent years and are predicted to continue to do so.
Government Guidance
On March 31 and April 1, 2016, the Canadian Cyber Incident Response Centre ("CCIRC") and the United States Department of Homeland Security Computer Emergency Readiness Team ("CERT") collaboratively issued related Alerts(CIRC AL16-005 and CERT TA16-091A) that recommend various measures to protect against ransomware attacks: technological measures (data back-ups, application whitelisting, up-to-date operating systems and application software, up-to-date anti-virus and anti-malware software and user restrictions based on the "least privilege" principle) and user education and training.
The Alerts discourage ransomware victims from paying a ransom. The CCIRC Alert warns: "Paying the ransom does not guarantee the encrypted files will be released; it only guarantees that the malicious actors receive the victim's money, and in some cases, their banking information as well. In addition, decrypting files does not mean the malware infection itself has been removed". In contrast to that advice, a member of the FBI's CYBER and Counterintelligence Program reportedly acknowledged in October 2015 that the FBI often advises ransomware victims to pay the ransom.
In March 2016, the Alberta Privacy Commissioner issued an Advisory for Ransomware to provide recommendations for preventing ransomware attacks. The Advisory recommends that organizations ensure that they have an incident response plan that deals with ransomware, and that they educate users about the plan. The Advisory reminds that if a ransomware attack results in unauthorized disclosure of personal information in the organization's custody or control, then the organization might have a statutory breach reporting obligation under the Alberta Personal Information Protection Act. Breach reporting obligations were recently added to the Canadian federal Personal Information Protection and Electronic Documents Act, but those provisions are not yet in force.
Comment
Organizations should prepare to respond to a ransomware attack by establishing and testing a detailed incident response plan that will enable the organization to make important technical, business and legal decisions in a timely manner. Those decisions may include the following:
- Payment: Should the organization pay the ransom? An organization that is not capable of successfully defending against a ransomware attack may have no choice but to pay the ransom and hope that the ransomware criminal provides the required key to restore infected IT Resources and data. Even if an organization is theoretically capable of successfully defending against a ransomware attack, there might be compelling pragmatic reasons to pay the ransom.
- Reporting: Should the organization report the ransomware attack? An organization may be under a legal obligation (under statute, generally applicable common or civil law or contract) to report a ransomware attack to law enforcement, regulators (including privacy commissioners), insurers, affected individuals (e.g. customers) and organizations (e.g. business partners) and other interested persons (e.g. shareholders and investors). In addition, there might be important business reasons to give notice of a ransomware attack to certain stakeholders even if there is no legal obligation to do so.
- Remedies: Does the organization have insurance coverage for the ransomware attack, and what are the applicable insurance policy requirements? Should the organization seek remedies for its costs and other financial losses against culpable persons (e.g. if the ransomware infection was caused by carelessness of a service provider)?
Organizations should obtain appropriate technical and legal advice when preparing a cyber incident response plan and when responding to a ransomware attack.
