Ransomware Explained - 3 Fundamental Ways to Stop Cyberattacks

There are only 3 fundamental ways to stop attacks from motivated and intelligent adversaries. Today, we are going to identify and explore those options and discuss how they may be applied to ransomware. Now, stopping cyberattacks is really difficult. In many cases, it's nearly impossible. Part of the challenge is the constantly shifting technology landscape. And the other is the creative and adaptive nature of the adversaries themselves. Now, digital technology is not static or a fair playing field. In fact, it's a continuous state of rapid change in various levels of implementation. Imagine, if you will, a football game, right? And the field itself is constantly changing its shape and size? That would— that chaos would throw everything into disarray. And if you started to have water hazards and sand traps and other terrain that just would appear at random, that also would cause chaos. And what if you added on top of that that the rules, well, they're a little vague and different for each team, and that they can change at any time, where innovation actually plays a timely role as teams can introduce new equipment before the other side. This is like the ever-changing landscape of the digital playing field where cybersecurity and attackers currently operate. Now, the other big challenge is is the opposing team, the attackers. They are numerous, creative, highly motivated, and in some cases better skilled and resourced than their defensive counterparts. And these attackers, they anticipate and they adapt, possibly better and faster than the defenders. Now attackers have a number of tactical advantages. They can choose their targets, often either selecting easy targets or those of significant value. They have a wide variation of different methods that they can employ, uh, across technology and people and processes. They can apply creativity, uh, their persistence and adaptability it pays off. Intelligent attackers adapt to the methods that are used to try and stop them. And if we look at the difference between what attackers look as successful versus defenders, it's night and day. Defenders normally measure their success by avoiding loss. Right? Any exploitation by attackers is considered a failure for defenders. Essentially, the defenders must win all the time to be viewed as successful. That's unfortunate. But on the attacker's side, they have it a lot easier. They take a completely opposite point of view. For them, any win, regardless of the number of failures, is considered a success. Therefore, they have the law of large numbers on their side, where eventually saturation will occur. Now, the real goals behind cybersecurity shouldn't be about stopping all loss. That is a perception, and it's not a good one. It really should be about managing to an acceptable level by finding the optimal balance between risks cost and friction. But again, perceptions, mm, that's different than reality. So often we are faced with particular types of attacks or specific threat agents that represent a major problem. And we've seen it in the past with worms and nation-state attacks, APTs, elite hacking groups, and most recently ransomware, which is really what the entire focus of this entire web series is about. So the question is, how do you fundamentally stop attacks from those intelligent adversaries? And again, there are 3 ways. Now, instead of going down the rabbit hole and discussing the minutia of different technologies and attacks and responses and processes and, uh, behavioral weaknesses and all of those things, let's discuss it in a simplified way. Alright, let's take it at the highest level, and there really are only 3 methods, and everything that we see in the industry done to undermine attacks, it falls into one of these 3 methods. So let's start from the beginning here. The first method, it's about removing the attackers, and that could be arresting them and putting them in prison. It could be relocating them somewhere that they can't attack attack from. In warfare, it's a little bit more extreme in removing the attackers, but really it's about removing the opposition from the field of play. If you're playing a chess game, if the person in front of you can't get to the table, right, they can't play. You don't have to worry about their attacks. Now, when we think about this, right, we Typically, in terms of cybersecurity and ransomware, we're talking about investigating crimes and attacks and pursuing them, arresting them, prosecuting them, and somehow incarcerating them for a temporary period of time. And that's difficult. That's time-consuming. And there really is no guarantees of success or longevity. And it's not— a good use of resources. It's not scalable. Going after every single attacker every single time, it's just nearly impossible given limited resources. Now, it can have a deterrence effect. If you're able to get a few, it can deter others from maybe going down that path. And, you know, we see that sometimes in making the penalties high or highlighting a case but in general, it's very, very difficult to have a meaningful impact. Now, the second one is something we're all much more familiar with, and it's really combating the methods of the attackers. And this is the never-ending vulnerability whack-a-mole game where the defenders are constantly chasing the vulnerabilities. They're constantly looking at the new and innovative ways that the attackers are coming in and trying to close those doors, trying to build the walls ever higher, the moats deeper and wider. It's an escalation. It's an arms race. And these efforts really just focus on avoiding the loss, or on the back end, on minimizing it when an attack does happen. And this is the most difficult, the most arduous of all the three methods, because the defenders have to constantly be vigilant to understand the emerging methods, to see when they're being used, and then to somehow move rapidly to undermine them before they get out in any great scale. And over time, unfortunately, This is the least successful, especially in how we view success on either side. It is really tough for defenders, and eventually a vulnerability will be exploited. Human behaviors will be leveraged for the detriment of the environment, or operational processes will be abused. Attackers have the greatest advantage in this type of area, and especially when the playing field is so dynamic because they can jump on the newest technology and look for vulnerabilities or weaknesses. They can take the initiative, and it is an expensive war of attrition for defenders. They're constantly having to update, to change, to impact the environment, having to invest in new tools and new services. It can be expensive, especially when it comes to staffing and ever-growing your staff to be able to defend against these types of vulnerability attacks. This is a great showcase of asymmetric opportunities for the attackers and This is where all the advantages, the inherent advantages that attackers have, it applies here. So it is difficult to win. But this is what we normally see in the environment. And by the way, for static environments, this actually works pretty well. It takes some time, but, you know, as you consistently close more and more and more of the vulnerabilities, you get stronger and stronger. However, when it's a dynamic environment and new technologies are constantly being introduced and adopted, you never get ahead of that curve. So this becomes the day-to-day firefight slog that cyber defenders are constantly in nowadays. This is what we're familiar with. But let's go to the third one now. There is a third method, and that's undermining the objectives of the attackers. And this is about shifting the thinking of the attacker to dissuade or deter them from attacking in the first place. Make it so that they don't want to attack. This is about demoralizing or putting the goal out of reach Now it goes back to the Willie Sutton principle. Now Willie Sutton was a famous bank robber many, many years ago in the United States, and a reporter asked him, you know, why do you rob banks? And the answer, which was attributed to Sutton even though it wasn't really him, was because that's where the money is. Think about that. Money was in the banks, and that's why he would rob them. That's where the money was. And that fundamental really can play because, you know, if you take away the honey, you don't have bears. For digital crime, you take away the money, why would cybercriminals then attack? And if we use a different example, right, um, rhino horns, right? Park rangers will cut them off so poachers won't target the rhinos. And this is about targeting the reason for an attack to actually be initiated. And knowing what those reasons are is very powerful, especially if you can achieve this. Unfortunately, unfortunately, it's rarely possible because we're often trying to protect what is valuable, not remove it, not get rid of it. Right? In a chess game, your most valuable piece is the king. You don't want to get that off the table. You need it there. So in most cases, you just can't do this. But in some cases, you can. And when you can, it is tremendously powerful. It's, it's sweeping, game-changing, and that can be hugely cost-effective and it's sustainable over time. It fundamentally, fundamentally can change what is perceived as normal. So don't underestimate the possibilities if this can be achieved. Okay, so let's apply these three, these three methods, right? Let's, let's go back to the Rhino example. And I think this is actually kind of interesting, right? Poachers are seeking rhino horns for sale on the black markets because rhino horns are wildly expensive and it's very tough to get a hold of. The problem is so grave, rhinos are now in danger of becoming extinct. So, you know, governments have established safe areas and hired rangers to protect these areas and the rhinos themselves. From being poached. But the poachers have been very persistent, and they go out, they kill the rhino, and then they take the horn and they go and they sell it for a small fortune. Okay, so let's think about the three ways again. First was removing the attackers. So in this case, it's about arresting and jailing the poachers, and laws have been established to allow that. Rewards have been posted for information that lead to arrest, so You can get some potentially good tips, but ultimately they need to catch the poachers first before they can remove them from the equation. And that's been very problematic because again, these horns are very valuable, uh, life-changing to people in their economies. And so there are more and more poachers all the time, and there's just not enough rangers. There's so much area to cover, so many wild animals roaming around It's nearly impossible. The second thing would be to combat the poachers' methods. And they've done a lot of work in this. They've created protected zones. They've put up fences. They audit the security controls. They do surveillance monitoring on the perimeter. And they actually have rangers roaming around these vast areas where these wild and majestic animals live looking for poachers. But again, the poachers still try. They come in at night, and they come in on vehicles, and they come in from the air, and they're stealthy, and they're looking out for the rangers. They're— the reward is simply too great, and the animal's too accessible, and they're willing to adapt very easily to the rangers' controls and tactics. They'll watch to see when the rangers are going out or coming back. They'll test perimeter controls, and it's a continuous battle where a single loss of one of these animals is hugely impactful. It's been very, very tough with that method to protect the animals. So then we get to the third area, right? And this is about undermining the objectives. And the first thing they did is they tried to close down some of these black markets. And okay, that went fine, but you know, these horns are also sold and traded one-to-one, and those transactions, they're really tough. So there are still black markets, there are still ways to offload these things, unfortunately. But the other thing that they tried to do and it's worked pretty well, is the rangers themselves initiated a program to go and remove the horns from the rhinos without hurting them, right? So they would tranquilize them, they would cut the horns off, and then let them go, uh, you know, run off and, and live their lives. And they would have to do it periodically because the horns would grow back. But in doing so, that essentially took away what the attackers were seeking. This is what they were pursuing. They were going after the horns. Therefore, attacking the rhinos really kind of became pointless, risking themselves and putting all that effort in to go in there and go after the rhinos, but there's no horns. They separated the objectives from the attackers. The attackers couldn't get to it. Now, It didn't work perfectly, but they've seen dramatically positive results in many of the areas that they've done this to. It really has undermined the abilities of attackers to achieve their objectives, and that has reduced the number of attacks and attempts. So let's apply this back to ransomware, right? Because it's important. This is why we're talking about this. And if the goals are for ransomware, right, we want to effectively knock down ransomware to a huge degree, right, say 90 or 95%. We want to do it in a timely manner, let's say within a couple of years, 2, 3 years. We want to do it at a low cost. In fact, we want to see a return on investment within a few years. We want to minimize any of the friction to users or companies. What else? We would want it to be sustainable, right? Anything that we do to solve ransomware, it's gotta be sustainable because we know the bad guys are going to adapt. So it has to be sustainably adaptable to remain effective and efficient over time. Okay, so what method do you think would be best to lead with? Removing the attackers, that's really difficult given the vast number of attackers, where they're at, how difficult it is to attribute something to them and then track them down, grab them, and prosecute them. It would be unlikely to find enough attackers really to be effective as a deterrent, and the rewards are still really good. So that's a pretty tough area to, to lead with. Now the second area is really the, the area that we've led with thus far. Far. It's the traditional cybersecurity practice. We're gonna buy solutions and tools, and we're gonna train people, and we're gonna do all these different things. And it has had a positive impact, but it has not stopped the growth, not anywhere near stopping the growth of ransomware. Right now, ransomware is growing 200 to 300% per year, every year. And the amount of impacts that it's having is getting greater and greater. Even if the attack number or the ransoms, the amount of ransoms were to stay the same, the targets that they're hitting, like critical infrastructure, don't just impact that company, it's all the customers of that company. We saw that with, you know, the fuel distribution company. It attacked them, but it impacted, you know, a huge chunk of the East Coast and their ability to buy fuel. So this, although combating their methods is important, it's been frustrating and it's fallen short. And my concern is right now the trend doesn't show that it would be effective to the level that we need. It would be too expensive to be sustainable. It would take a long time to try and get all those different technologies to actually work effectively. And it probably wouldn't be able to fight off the future maneuvers of what these ransomware attackers are doing. In the end, the ransomware attackers still have the advantage with this. Now, the third area, this is where it gets interesting. Can we undermine the objectives? And this may be the single greatest opportunity to undermine ransomware. If we can make it so the attackers believe that they simply won't get payments, their objectives are then out of reach, and that could stop the attacks at the source. Now, I have some videos on, uh, how to go about this, and I'm going to cover it more in later Ransomware Explained videos. So stay tuned for that. I'll be releasing some of those in the next few weeks. And that's really where I'm going to end this video. So be sure to check back and take a look at all the videos in this multi-part series on ransomware. The series is free on the Cybersecurity Insights YouTube channel. And please drop in your comments. Tell me what you think we should be leading with in the industry. Should it be trying to remove the attackers? Is should we stay the course and just try and continue to improve some of the, um, tools and processes, or should we go down the path of undermining their objectives? Thank you for watching. Be sure to subscribe, watch all those videos, uh, because ransomware is impacting all of us. We're seeing it in the news, and ultimately the more we share and collaborate about this topic the stronger we all become at protecting the world from ransomware.