Cybersecurity Insights - Criminalizing Ransomware Payments with Malcolm Harkins

Ransomware is the latest digital epidemic that our connected world is facing, and varying opinions regarding how we should address it have really come up and been debated. And today I'm talking with Malcolm Harkins to discuss some of those different approaches and maybe, maybe even convince him of a path that I think is really the only way forward if we really, really want to get rid of ransomware, not only for one company, but for all companies all over the world. And Malcolm is currently the Chief Security and Trust Officer for Epiphany Systems, formerly with Symantec, formerly with Silence, and has served as the Chief Privacy Officer and CISO for Intel. He's got 20 years of executive leadership experience in the security world. And is very well respected in the community. Welcome, Malcolm.

Hey, thanks. Happy to be here. It's gonna be a good discussion.

I hope so. I hope so. Gloves are completely off. I love this kind of discussion. So a background for the audience here, right? Ransomware's been around for decades. First came out in what, '89, I believe? And attacks really in the past couple of years have skyrocketed. And the scale that we've seen, the sophistication that we've seen of the attacks have gotten greater just as the successes by these cyber criminals. And they're brazen. I mean, they're even attacking government, police stations, all sorts of things. They're going after everything that they can where they think they can get the money from. And we've seen billions of dollars now get flooded in. And that's really kind of spurred an increase of between 6 and 10x year over year. And I don't think it's going to change. I think next year we're going to see at least a 10x. With all that success and all that greed, why would the bad guys stop? And they're now targeting the critical infrastructure pieces because that's where you've got a lot of pressure and presence to say, yes, we need to pay this to get things back up and running. And that, you know, billions of dollars that are being tracked, that's flowing back and forth. That doesn't even count the real impacts, right? When, you know, an electrical grid goes down or sure, they may have to pay, you know, $40 million in ransom, but it's really about all those customers that lose their power for days or weeks. Same thing for food distribution. Same thing for fuel distribution, which we saw. Government services. Atlanta got hit and for a long time, what, almost 3 million people were impacted. For government services. So it's just going up and up and up. And with the attackers, I love attackers because they're greedy, which means they're predictable. It's just not gonna stop and they're gonna keep going after, I believe they're gonna keep going after those critical infrastructures 'cause that's where the money is and that's where people are paying. So hugely controversial, everybody's got a different idea and honestly, I just want the one that works. In kind of looking at it, and you and I have discussed this before, I started kind of narrowing down the field and I came to a single, which is very unusual, a single solution that I think is both incredibly controversial, which I don't think it would ever happen because it is so controversial, but I also see it as really the only way if we truly truly want to destroy, crush, get rid of ransomware within reason, it's the only way. And that would be to criminalize the payments. Yeah, it's already criminal to do the attacks, but to actually criminalize the payments to stop that flood of money. And where there's no money, these predictable threat agents, right? That's their goal. If they can't get paid by using ransomware, they're going to go back to the other, you know, fraud and theft that they're more used to and we have more security around and less overall impactful to the world. So that's what we're going to debate today. And I'm sure you're going to tell me I'm absolutely wrong and we can go at it. But what is your perspective overall on ransomware? Kind of where it's going and, you know, what do you think are some of the big kind of areas that we can work on as an industry?

Yeah, so I think, you know, where it's at and where it's going, you know, as you said, it's been around for a while. And those of us who've been in the trenches for a long time saw it in different forms before it became kind of the ransomware that was more obvious to the public affecting services and capabilities and stuff. I think where it's going, you're right, it's going to continue to grow and expand. The question becomes cause and effect. Certainly, there's the attackers and your big idea that would dry up, in essence, their motivations. While I sympathize with it, we can talk about why I don't think it would practically work and why I think it would actually cause more business disruption. But I look at it and I go, Why is it occurring? Why is it so widespread? Why are the impacts so big? Well, because those of us who have built and sold security technologies frankly did a lousy job of creating technologies that would mitigate the risk. Those of us that are managing organizations and the IT infrastructure that we're in charge with managing well with appropriate level of controls have done a lousy job of deploying controls to manage and mitigate those risks. And then because we also did a lousy job of business continuity-related planning and associated controls, we're the ones actually to blame because our controllable variable, our responsibility, our accountability to our customers and society is for providing the capabilities in an appropriate fashion. And if we're not able to do that, it's upon us. And, you know, so I look at it as we have failed in our management of our infrastructures to do what we should have done to manage and mitigate these issues. And so by just potentially criminalizing the payment of ransomware, we're not getting to the heart of what our accountabilities are in managing those systems in a way that minimizes the material and significant events that could occur.

I hate it when I have to agree with you, but I do agree that, you know, we have failed in many ways and security is nowhere where it needs to be or should be. But I would also counter that and say, even if we did have really good security, I think the attackers see the rewards here as so good, as so lucrative, that they would continue pressing, right? They would still find just the weakest link. The bar may be much, much higher and it should, it absolutely should, but they would still go after it. I mean, we haven't solved fraud in any other area. We haven't solved theft around the world. Even banks with huge vaults get robbed.

No, you're completely right. We have no control over the threat actor and threat agent other than the fact that they're going to keep coming, right? Which is why when I look at it, I look at the problem differently in much the same thing from physical risk. We can't eliminate risk, can't eliminate it physically, you can't eliminate it logically. You can eliminate it from financial markets. Heck, even sitting on cash has risk, inflation risk, as we've all seen from the recent economic changes. There's no risk-free world. And I think what you're trying to do, which I applaud and agree with, is figure out deterrents that start slowing the potential actors or create a level of disincentives for them in what they're doing. I think there's other ways to do that. You look at the Solarium Report. I think there's nation-state actions and economic sanctions that we should be doing more broadly. To countries where that stuff is encouraged, maybe look the other way, you know, or that infrastructure is enabled. Now, the problem even with that is there's infrastructure in the United States that has been a part of ransomware attacks. Yes. Right? Either directly because people procured it and used it or indirectly because I was again sloppy with my infrastructure and my infrastructure was used in an attack. Because of my own sloppiness. It maybe didn't affect me, but it affected others. So, this is where, again, it gets back to what can we control and what we should be driving accountability towards. Now, I agree with you on ways to potentially affect the payment streams. And I think we should figure out ways to disrupt that. I think one of the ways that we should disrupt that, again, getting back to corporate accountability and executive accountability, accountability is a level of transparency. If you pay ransomware, you publicly disclose that you paid it, why you paid it, and own up to the fact that you didn't do a good job in your internal infrastructure. Because I think there's many more ransomware payments that have occurred than what we've seen publicly announced. Because again, if a service is disruptive, a company's not going to go out and say, "We screwed up." They're only going to do it when it's obvious. To the customers and stakeholders. And I think there's a bunch more ransomware payments that have occurred, but they were able to minimize the visible impact to others and did it in a way that, again, nobody noticed. So I think transparency is one way to affect the accountability, not only for the internal controls, but also the payment streams. And let the organizations be held accountable in the court of public opinion, or if they potentially violated a law because they paid somebody that maybe they shouldn't have because it's a violation of the law.

OFAC rules or something.

Yeah. Yep.

Okay, so let me come at that in two different directions. First off, you know, you had mentioned, you know, we're looking to reduce ransomware. And in my mind, I want to clarify things because I think there is such an incredible opportunity because most of what we deal with in cyber, we can't really crush anything. We can reduce it, we can mitigate it, we can transfer risk, we can try and minimize it. I think ransomware is one of those unique situations where we could actually end it. We could obliterate it. And that doesn't happen very often. And so that's really my lofty goal is to seize this very rare opportunity and maybe crush ransomware in its entirety, top to bottom, not minimize the risk, not lessen the attacks, not improve the response. No, stop them from happening, period.

Right?

I want in 5 years from now, people to go, "What's ransomware?" Don't know that. "Oh, let me go look it up in the history books." Right? That would be a perfect scenario in my mind.

And while you're out there— The second thing is—

World hunger too, right? With what?

While we're at that, we're going to solve world hunger too, right?

Yes. Yeah. Well, that's next. I mean, let's not get outrageous or anything. Let's take it one step at a time. But, you know, when we talk about transparency, and I agree, I think transparency is really important from a cyberethics perspective, from accountability. I am all for that, right? I would never say no, we don't want— we should have more transparency. But when I juxtapose that against the objective of crushing ransomware, it doesn't do enough. It doesn't come anywhere close to it. Yes, it can reduce it. Yes, it can. Raise and improve areas. Yes, we can then manage it. Yeah, there's a whole bunch of great marginal things that can happen that I absolutely think should, but it won't deliver to the goal or the objective that we're talking about here.

And this is where, again, I think it's a unique opportunity. Yeah. And this is where I think you and I, while I agree with you, I just don't think it will do what you think it will because I think We can't make it illegal internationally. We can't make it illegal in other ways. So, I think, you know, yeah, let's just say you legislated in the United States illegal for a US company to play blah, blah, blah, blah, blah, blah, blah. Okay, great. Well, I have an entity that's a separate legal entity in another location. I have my supply chain that's coming from a different location. Good. Ransom that affects me. I mean, so there's all this knock-on effect. So I think we'd end up doing is having a balloon squeeze. Yeah, we might shrink the perceived payments that come out of the US, but they balloon in other locations. Net-net, has it really gone down and been eliminated? No, we just made ourselves think that we did. And then I think the other thing is if we hamstring a company in making a decision Let's say I'm the CISO for a healthcare organization. I have an operating room. And let's just say, again, you can't eliminate risk, but I've done a good job. There's a small potential, but that small potential gets weaponized and something happens. And if I don't pay, people are going to die. I don't think we can legislatively say you can't pay. And I think having an exception process would take too long. And then the question becomes, who's the decision maker in that exception process? Which is again, why I default to transparency.

So, well, let's target both of those because the first one is, okay, even if we do legislate it here, and again, we mentioned OFAC, there are actually already rules on the books that say, hey, you can't pay terrorists, you can't pay nations trying to undermine the US government, all those kinds of things.

So the only problem is— And we probably are paying— we probably are paying those people today because—

You're right, but the laws are on the books.

They are, they are not on the open market. Okay. Yeah.

But I think the most important thing in saying, yeah, we can't legislate all over the world. I think the beauty of the way all this rolls out, and again, criminalizing the payments is not the end result. It is the first domino. And from that, a chain reaction happens. And it's really that chain reaction that's important. So I'm only talking about the first domino. But if we look through that chain reaction and we see, okay, if there's an area of the world and let's, let's role play. I'm that ransomware bad guy. I'm evil Matthew. And I'm attacking the US because they have money. They have lots of easy critical infrastructure to attack. And I can get paid insane amounts of money, so I'm doing it. If tomorrow, and again, it's an absurd example, more details we can talk about. But if at some point in the future, American companies simply don't pay, they can't, right? And yeah, I can try and pressure them and threaten them, but legally they're not going to go to jail. The CEO is not going to go to jail, right? And so—

The CEO wouldn't go to jail in almost any circumstances anyways.

Well, yes and no, but you know, the point—

there's been a lot of gray area, illegal actions by companies over the years, whether it be environmental stuff.

Sure, sure. And again, we're at the 10,000-foot level.

But I'm just saying— we'll get into that, but at the 10,000-foot level, what CEOs for laws on the books ever have really gone to jail?

Sarbanes-Oxley was probably the first, and it really criminalized actions.

Right. And has anybody gone to jail because of that? Remember the Enron or the WorldCom? Sarbanes-Oxley was after the fact.

It was after that. Yes. Actually, I think the only person that went to jail is the person that whistleblowed. But there are laws and we have had CEOs go to jail for criminal acts, fraud, theft, embezzlement, things of those sorts. So yes, CEOs are held accountable to the law as well. Now, if you say it's just a regulatory control against the legal entity, the corporate legal entity, that's different. But we're digressing. Let's get back to the role play.

Well, if I'm total Matthew— if the the deterrent is me as an organization is going to face a criminal issue if there's no prosecution.

No, individuals. It's criminalized.

Right. But if it's not actioned, then I would continue to pay as a business owner and deal within the legal wranglings of different entities. And I didn't know, and it was done by this way, and I had all these other things. The likelihood of what you think would happen because you criminalized it, I'm arguing, I think businesses would still pay and they'd figure out a way around it.

Okay. And I'm going to go through that whole flow. And so we can kind of see that. But at a 10,000-foot level from the psyche of the attacker, if country A, the United States, stops paying, just go with me here. What am I going to do? Well, I still want money. I still am going to use the tools that I have available to me. If the US is in pain, I'm going to go to Europe. I'm going to go to Asia. I'm going to go somewhere else that is pain, right? It's human nature of the attacker. And if one area isn't easy anymore, I just go to the next area. I just want the money.

I agree. So how did that actually then eliminate ransomware.

So once one area is done, right, you then see this, this waterfall effect where Europe goes, wait a second, my ransomware attacks just went up 800% this year and US's went down to almost nothing. They enacted a law, right, or a series of laws. They put controls in place. I think it's time we do too. Right? And so now Europe and US, Asia suffers. And that is the way things change. That's the way we've seen it throughout security adoption of major technologies.

So, so cause worldwide calamities in other spots and see if they react.

The calamities are already happening and they're going to get worse. We already said they're going to get worse.

But you just said it's not really happening in some of those other locations as much. So we just, take that action, throw the monkey on somebody else's back and hope they act the same way versus—

Well, things are happening around the world. We're talking about eliminating them in one area, which would then motivate everyone else to also take up measures.

You're eliminating a payment stream. You're not eliminating the motivations. You're not actually creating—

No, I want the motivation to remain.

I think there's other ways to create deterrence. Like I said, from nation-state-level economic sanctions, there could be, as we've seen already, the military getting involved in taking down infrastructure. The consequences need to be there, but the consequences need to be for us as well, again, for not doing a good job in managing our infrastructure. And let's just say you're right. Let's just say you're right.

But deterrence won't get rid of the problem.

But let's just say you're right. And so therefore, the payment of ransomware has dried up, but I'm evil Matthew in Timbuktu with a PhD in computer science, an internet connection, and my family is below the level of sustenance. I still am going to figure out something to do in order to create the economics.

Yes, which is what we want them to do.

So you want them to actually change the notion of—

Right, we want them to move away from ransomware.

But, so you want them to do something that might actually be worse than ransomware.

Well, they're probably going to go back to what all the tools, capabilities, established processes already work for, right? So you're talking about phishing and fraud and business email compromise, all those types of things? So clickjacking—

Oh! I'll change the payment streams. I'll do something else. I'll tell you instead of ransomware, "You need to give me inside information so that I could play your stock price." I go after executive blackmail when I take somebody out at home. And so, I go after somebody who's worth $200 million and I extract a $2 million tag from them. Because I compromise them.

Target space is smaller, it's more difficult to accomplish, and it's less likely to actually be delivered.

I think it's—

Right? No, I think it's all good. We wanna make it more difficult.

I think it's easier to accomplish going after executives at their home systems.

Then why isn't it? If it is truly easier, if it's truly easier, path of least resistance, that's where we'd see the attacks. We're not seeing it there. We're seeing it— Broadly, easy attacks against the service.

There's a difference between what's in the news versus what's occurring. You can't just say we're seeing it because, you know, some security company has a marketing goal is publishing a report on corporate stuff. There are attacks that are happening in people's homes. That's why we need to be doing more on cybersecurity. Cyber executive protection because again, they're critical parts of our infrastructure and our ability to protect our company. Just because their home is not a part of our infrastructure doesn't mean that it's not a soft target that wouldn't be used in some type of cyber blackmail.

I don't disagree, but it's also, you know, when we look at it, it's more of a corner case. It's going after the big companies because they want the $40 million and there aren't that many executives. That are willing to pay $40 million out of their pocket.

Yeah, but let's go to the—

And we can track, we track a lot of it via cryptocurrency, which is a wonderful thing because they're paying in Bitcoin and we can track that.

So again, if we can track that back, then what we should be doing is doing seek and destroy capabilities from a military perspective and other law enforcement actions to take down their infrastructure. We should be holding accountable—

Bitcoin is pseudo-anonymous.

Are managing the Bitcoin operations for money laundering or the equivalent of that, right? Like we would a banking infrastructure.

You can because—

So that's why I say there's other ways to affect the payment streams than hamstringing me as a business owner in making a decision. Even if I've done everything right, you can't eliminate the risk. And so saying I'm not able to get my business up and running, I'm not able to ship goods or services, I'm not able to take care of people because you can't eliminate the risk, you've just constrained my business and potentially harmed people, including my employees and shareholders.

Or the reverse, that this continues to get so bad that it does affect everybody. As we've already talked about, we're all connected, right? It's getting worse. It's going up by double-digit multiples. We are not seeing it getting compressed and all the controls you're talking about is about reducing it a little bit, right? Making it more difficult. What I'm talking about potentially is crushing it.

I think there are ways that we can create a dramatic bend in the curve of risk by better controls. Plain and simple.

Okay. And let's talk about what success is then. Because maybe that's where we're having our difference of opinion. So let me run this out. I think we have a very similar opinion.

We want to dramatically reduce the cyber risk cycle we're seeing. And then the question just becomes, what tools do we have to do that from a deterrent, from a control perspective, from organizational accountability? And it's just different ways in which we can play with all of that.

But the question is, will it hit our goal? Because I can say, "Well, I'll just, you know, improve my firewall and that's fine." Well, it may not get to the goal of success that we want, right? That may reduce another 1 out of 100 attacks, but that really isn't moving the needle. So if we don't define what a goal is, right? What our success criteria for addressing ransomware is, it's really tough to say that path A will work or path B will work. And I think it's important to define success criteria like this because if we say like the first one, we want to stop 95% of attacks occurring, you know what? Upgrading your firewall isn't going to do that. That isn't going to stop it, right? And even transparency isn't going to stop that. It's going to help, but it's not going to—

But I— this is where you and I completely agree. I think we should be setting a goal 95, 97, 98% effectiveness in reduction of ransomware and frankly other information security breaches. I absolutely think we could and should have those design goals. The question becomes then, if that's the design goal, how do you achieve it? Right?

Right.

And the way in which you're looking at it—

So let's just agree on the success criteria.

Look at it as— I look at it as a CISO and go, "That's my accountability. That's my organization's accountability to hit those design goals." And so how do I design my controls so that the impact and effect of ransomware is 2% of what it is today?

I agree. But again, not all companies, especially small and medium businesses, have the CISO, have the resources, And so, they're always going to be attacked. And so, even if all those big companies do all the right things and make themselves bulletproof, we're still not going to hit that success criteria because the small and medium businesses are going to be ravaged. Now, if we can—

We were just talking about the fact that the small and medium businesses don't have the $40 million check to write. They're going to go bankrupt. Again, if you assume the ransomware folks, and I think some of them are are true in the typical organized crime and theft and stuff like that. There are some that are really nation states and other actors that are doing it for other purposes, including funding their governments and terrorist activities and other things. But if you think of theft, by and large, or you go back to fraud and other things, the—

Cybercrime.

The threat actor doesn't want to kill you. Because if you're dead, you can't— then they're the parasite. They need the host to stay alive, right? Agreed. Right. So I think there's a few different ways, depending upon who the threat actor and threat agent is, that you can affect it. And I think your point on small and medium business, well, great. If, let's say, we moved it, the bigger businesses and those could afford it, do a better job and they move there, the payment stream will go down.

Why?

Because just the nature of your argument that they, you know, executives wouldn't be able to write the big check, small and medium business wouldn't be able to write the big check. And then guess what?

Well, no, they can still write a check.

Right. But it's a small business.

And attackers are smart enough. They scale based on the size of the business. And we see that. If it's, they do the research. Hey, I got in, I encrypted the files. They do the research to see, okay, how much money do they make? What's their profit margin? And then they'll come in and as part of the negotiation say, you know, I can't ask for $40 million from you. I can ask for one, right? Company B, you are much bigger, I can ask for $40 million.

They have to go after 100 times more companies to affect the same, right? So guess what? They're now gonna be spreading their resources. And guess what? If we've done a better, bigger job—

Or they can change their model to ransomware as a service, which has grown and the resources come to them.

And so you're making my point. If you dry up one thing, all they're going to do is evolve their ransomware payments and take, they're still going to have an economic motivation. They're just going to do it in a different fashion. That's not what we are going to legislate as a ransomware payment. They'll take it out in a different way.

Exactly. And I think that actually is the goal. We want to get them away from extortion, holding services and digital capabilities, right, in limbo or bringing them down for extortion. If we eliminate that and they have to go back to other types of fraud and I'm going to compromise your account, I'm going to steal your Bitcoin, I'm going to do all this other cool stuff, that's great. We've got a lot more experience, a lot more controls, and the cascade effects of that are much lower. If somebody goes in and hacks your system, puts a keylogger in, steals your private key for your Bitcoin and takes it from you, that's a shame, but it's just Malcolm that's impacted.

You didn't achieve the goal then. You didn't achieve the goal of a reduction in cyber risk. All you did was move it from a ransomware payment to another activity. And I look at it more broadly and I go, I'd rather shrink the total pool of risk, not just focus on one thing.

We can do that because the controls we have around those other mechanisms of somebody hacking your system and putting in a keylogger, we've got lots of different security controls in there, right?

If we had such security controls—

If I hack one fuel company and the Eastern Seaboard goes panic, Right?

If we had such great controls, if I could prevent a keylogger from getting on a system, I can prevent ransomware from getting on a system. If I had that—

Maybe a lot of this is done through social engineering, right? At scale.

Social engineering at scale. Okay, so I clicked on a link, I got socially engineered. Guess what? That still means I'm depositing malware. I'm laterally moving within your company, and I'm shutting you down. If I had good enough controls to prevent those other risks, those same controls would actually minimize the risk of ransomware. And there's a lot of organizations that have low ransomware risk. Why? Because they've done a damn good job of managing their internal security.

True.

And again, we just talked about the Colonial Pipeline thing. Let's just, you know, peel the onion on the Colonial Pipeline thing. The reality of it is, you know, despite what was said in the congressional testimony that, you know, an exposed credential and lack of MFA, that was only the point of initial compromise. They had a daisy chain of other issues within their environment that lacked controls that then led to the billing system getting impacted, which then led to a business system that they didn't want to send fuel without capturing revenue. So because they didn't understand, or maybe they consciously understood that stuff, but they made a business decision, that's what affected, um, the delivery of fuel across the Eastern Seaboard. So let's not confuse what the issue was, what the accountabilities were, and what the business decision issues that caused that problem, as well as the internal control deficiencies that caused that problem. It wasn't just that simple thing that was said in the congressional testimony. It was a lack of understanding and a lack of internal controls and a business decision that led to that impact.

I agree. It was technical, behavioral, and process issues that caused that. So it occurs to me as we're talking here that we're approaching this from two entirely different perspectives. You're talking about at the victims, the controls at where the victim is, right? The security they have, the processes they have, the business decision, even the cyber ethics, right? And that distributed security will protect them. And if we multiply that across all the potential victims, then we've created a landscape that reduces the overall risk, right? And I'm approaching it from an entirely different perspective. I'm actually, instead of trying to harden every potential target in the world now and all the new ones will come up tomorrow, the next day, and every other day, I'm going after the attackers themselves, right? I'm going after— now their motivation will never change. A cyber criminal's always going after personal financial gain. However, I'm separating, I'm putting a barrier with them to say you won't achieve your objective going down this path of digital ransom. And we've seen that be applied in many different instances out there, and it's undermining the motivation of that attacker to pursue a specific path. Look at, um, rhinos, right, in Africa. You've got the hunting of rhinos and they're clipping off their horns because black market is so, you know, they're so profitable there. And they've gone after the markets, right? So you can't sell them, you can't ship them, but there's underground black markets that are still available. So the poachers are still going and killing the rhinos. And you can look at every preserve and try and flood that with security and fences and cameras and response teams and everything else to try and mitigate the risk, which many of them do. And yet rhinos still get killed, unfortunately. Then when we look at some of those preserves that have instead deployed a program to track each of the rhinos and once a year go cut those horns off— doesn't hurt the rhino, they tranq them, they cut the horn off right, it removes the financial incentive. It actually targets the attacker to say, yeah, you want money, but you're not gonna gain anything. And what they've seen is an almost drop to zero for poaching of rhinos. Why? Because you've removed the financial incentive. Okay, now those criminals are still gonna go off and rob stores and do other things, right? But you've effectively managed them based upon their own internal criteria without having to build massive walls in every preserve across Africa and fund thousands of people, armed people, and potentially get into shootouts and everything else. We saw the same thing in Italy back several years in the— it was the '70s and '80s, I think, where the mafia, the organized crime there had this new— it wasn't new, but they started proliferating kidnapping and, you know, basically extortion ransom getting people back. And, you know, it went from just a few per year to— it was over like 600 over the course of a couple of years. It was rampant. And the government actually came out and instituted laws that said it is illegal to pay. And they would actually block financial accounts of victims' families to to force them not to pay. And it was controversial, hugely controversial. But the fallout of that, other than the politics immediately, is it dropped back down to, I think there were like 36 over the subsequent 5 years versus 600 and something.

Right?

So it does work. But we're coming at it from two different directions.

Yeah, I'm glad you brought up those examples. And this is where I think aligned, we just approach it slightly differently. I think, like you said, disrupting the payments and going after that type of stuff, absolutely stuff we could do because that really is going after the threat actor and threat agent. Now, you're mentioning of rhinos and cutting off the horns and stuff. That I would actually be akin to saying, is securing your infrastructure. You want the rhino alive? I've secured the infrastructure. I've removed the quote unquote exploitable component, the vulnerable component that is what they were going after. And so I would say the removal of the worm is actually a control action that reduces the reason to go after it, which is my point of doing a better job of hardening our infrastructure. If I wasn't vulnerable to the attack, then the attacker doesn't have an incentive to attack me.

Well, no, it's actually removing their target, their objective, right? The vulnerabilities are still there. The attackers can still ingress They can still identify and hunt down, right, their target. They can, you know, take the valuable parts of that target and egress.

But the thing that they're going after is no longer available. That's your point. That's my point.

That is true. Actually, actually it is.

We have the same point. The way in which you achieve it is a different way. If I make it so that— Sure. I am less likely to be vulnerable. Your approach of making it illegal still means I am vulnerable and I'm exploitable. And what I'm wanting to do is go after the fact that organizations should be reducing their exploitable elements of their organization. And your approach doesn't do that.

I'm gonna counter and say, I think it actually does. You know what? Let me share one other thing because we talked about criminalizing is just that first domino, right? But in reality, lots of things have to happen and I'm only gonna hit on a couple of things here. But if, for example, we passed a law today that said, we're going to criminalize— you cannot pay digital extortion. Can't pay it. You go to jail. You go to jail. Not your company is fined. You go to jail. And anybody that participated in that goes to jail.

Okay.

Now, you can't just turn on the switch, right? You would have to give a grace period. You want to be able to say, hey, this is coming. Cyber insurance would then have to start shutting down. Hey, we're not going to cover that because that would be illegal. We're not going to support an illegal activity. Okay, so cyber insurance then starts turning it off and we've got this grace period and let's just say a year, right? Whatever it is. But in that year, people are going to be aware, companies are going to be aware this is no longer an option. Okay, what other remaining controls can we do? And obviously we're going to be saying, okay, hey, clean up your act, right? Get stronger. This is no longer your safety net.

If the organization is criminalized from paying, and the attackers then don't attack because they don't get money, the organization's not going to spend money to just spend money to fix control infrastructure they should have done anyways. Why not criminalize it for an organization to have an IT control environment that creates a significant and material event on their customers, stakeholders, shareholders, or society? Why not treat it like Sarbanes-Oxley, where it's criminal if you are not having the internal controls to ensure financial integrity. That's exactly where I'd go. I'm all for criminalizing certain things, but I would criminalize the fact that you didn't do a good job to manage and mitigate a material event from occurring that impacted materially your shareholders, your customers, or society. That would fix the vulnerabilities and exploitabilities in our environment.

I think, yeah, we can't fix everything, right? We don't solve security, we can manage it. And I think there are some risks that organizations should be able to accept. If I get attacked and it only affects— But just not ransomware. Well, no, here's the reason why. That fuel company, right, gets attacked or the food distribution company, right, gets attacked and it only affects them. Okay, that's fine. However, if it affects putting food on the table for 30 million Americans, that is a different risk, right? And that's what we have to protect.

Let's take a food and beverage example. And say, well, what if it's a food safety integrity attack? And it's okay that they had a sloppy infrastructure that allowed food safety data to get compromised and adjusted in a way that killed people? That's okay?

No, that isn't. That isn't, that's my point.

No, we're making the same point. I'm just saying the criminalization of it should be held at the organizational level. For not managing your environments appropriately.

And that goes back to what you were talking about originally with accountability.

Exactly. I just want to criminalize it in a different way and create a level of transparency in a different way.

And I'm not opposed to that, right? As we talked, however, I think we have this jewel, this gem that we can also shift and get rid, wipe away the ransomware. And again, those companies— there are many companies that can afford those security risks that you're talking about, that can afford the security controls. There are also many that aren't. And in the success criteria I was showing before, part of that criteria is not to be a huge financial burden. And if we can target the behaviors of the attackers instead of just putting up bigger and thicker walls everywhere, That is much more efficient and cost effective.

That should be done through other deterrence and disruptions by nation state and law enforcement. Don't hamstring me as a business.

But will it be effective?

Well, to be honest—

It will be effective at that target.

We don't know if it will or won't until we start taking some other actions. And I think there's some early stages in the Solarium recommendations that are starting to take foothold, that we'll see what impact that has. But if we don't go to what we can actually manage, which is our internal control environment, again, all we've done is slow ransomware, but it doesn't mean I don't have exploitable elements in my enterprise that would cause a material event that would impact society. All you've done is reduced the payment stream to the attacker. You haven't reduced the likelihood that I am actually not gonna create a material event. And that's what I'd rather go after, quite categorically in the information security space than just the ransomware payments.

But now you're trying to solve world hunger by making everything so secure that they won't get attacked. And I'm, again, it's a different approach.

It's the equivalent of a Sarbanes-Oxley that says I have to have a state of internal controls for my information systems and data that would prevent a material or significant event that would affect my shareholders, my customers, and society. Material events.

I like it.

Not solving everything.

I like that type of, that type of control. But I don't think it's going to hit these success criteria. I think it will add marginal improvements. And Sarbanes-Oxley doesn't actually apply to everyone, right? The small and medium businesses.

I agree with you on that. However, having said that, 17-ish years past Sarbanes-Oxley, we haven't had substantial financial integrity issues in corporate America. And so I think you could tailor it in ways that it doesn't necessarily just have to be public companies. It could be organizations above a certain size. And guess what? If I'm a small mom-and-pop shop, the likelihood that me having an issue that would create a material event that would affect society is small.

And what would the cost on that be? Because if I recall, Serbians Oxley cost a whole lot of money because again, we had had to go out and those controls had to manifest at each of those organizations. And my approach is not to target those directly, but to target the attackers.

In some cases, it cost a decent amount of money, but guess what? Did it harm the stock market? No. Did it harm shareholders? No. Did it increase transparency? Yes. Did it hold corporate executives accountable? Yes. Did it manage the risks that was intended? Absolutely.

I agree for what it was intended. I think we're talking about a little different beast here, and I think the costs are going to be too high.

But well, it'll be—

again, my approach, I want to change the attackers. I want to go after them.

And I, and I absolutely think we should go after them and we should use law enforcement and our military and cyber capabilities offensively to do that.

I'm in agreement with you there. I just, I don't believe that'll hit us at 95% effectiveness. I think we do have to use the internal thinking of the attackers against them, their own motivations. And you take away that objective, they go somewhere else. And I think that's the more cost efficient and effective path. But we are at our time. Any last thoughts? I wanna give you the last word here, Malcolm. Any last thoughts in regards to ransomware approaches, recommendations?

You know, I'll give you a quote from General George Marshall. The only way human beings can win a war is to prevent it. And this is a war in a different way, which is why I go, we have to figure out ways to prevent it, detect it earlier, and then have the response mechanisms to prevent material harm from affecting our companies, our shareholders, and society.

And with that, I agree. I mean, you know, cyber and everything that's coming and our reliance and dependency on it, it is no longer an inconvenience when attacks happen, right? It's security, privacy, it's now safety, life safety, it's way of life and potentially even how, you know, people are governed and ruled moving forward. It's important. So I agree with you on that point. Thank you so much for a lively debate as always. I owe you coffee next time and hopefully we can have another chat soon.

All right, awesome. Thank you.

Thanks for watching. If you like these cybersecurity videos, please click the like button, leave a comment, and subscribe to the Cybersecurity Insights channel. I put out a video about every week on various cybersecurity topics, risks, ideas, events, and best practices. Let's continue to communicate and collaborate together. That's how we make cybersecurity strong in protecting the global digital ecosystem.