Ransomware Explained - Ending Ransomware

Ransomware is one of the most prevalent issues in cybersecurity, and it's growing. It puts every business, government agency, and citizen at risk of being impacted. We are seeing attacks that extort insane amounts of money from businesses, but the more impactful aspects of it are the critical organizations that are being targeted, which are reliant on digital capabilities to deliver their services. Attacks against healthcare, food processing, transportation hubs, electrical grids, water supplies, federal agencies, fuel distribution, education institutions, and even entire city governments are undermining the national and international critical infrastructure that every citizen relies upon. So how do we end ransomware? Ransomware has been around for decades and has endured, even prospered, in the face of the best cybersecurity advancements. Ransomware attackers have become very savvy and powerful by embracing innovative technology to maximize their reach and profit. So let's break down the problem and define what a desirable end state looks like. Now, one of my favorite quotes is by Robert Highline: "In the absence of clearly defined goals, we become strangely loyal to performing daily trivia until ultimately we become enslaved by it." Now we're faced with the same risks when it comes to ransomware. Too often we focus on the trivial aspects of a single attack and fail to see what must be accomplished to rid ourselves of this growing darkness. So let's carve away the fear, the immediate issues, the preconceived notions to look at the problem analytically and strategically, because it's really tough to achieve a goal if it's not well-defined. So what do we need to accomplish in order to end ransomware? Well, let's look at an overall call to action and then the desired success criteria for mitigating ransomware. Now, first, we have to accept that ransomware is a significant and important issue to address. The reality is, you know, it's worthy of our time to discuss and address. Second, ransomware attackers, they're intelligent adversaries who are highly motivated. They're creative. They will adapt. And they won't go quietly. They're not going to surrender. They are very good at adaptation, and they will— whatever we throw at them to protect our assets, to try and get rid of ransomware or undermine it, they will do their very best to keep the money flowing. Third, the scope of ransomware. It's a national and, well, really global issue. It's not just about one company or one attack. We have to look at it holistically because these types of attacks, they can and will eventually affect everyone. And the great example there is all the different critical infrastructures. As ransomware impacts them and brings them down, that affects every single one of us. And the last thing that we kind of need to understand as part of this call to action is we have to do something about it. It won't go away on its own. The status quo is simply not acceptable. The traditional responses in security over the decades haven't worked. A new action must be taken. Okay. So let's now talk about the success criteria, because if we are going to address this strategically, we have to have those goals. We have to know when we've succeeded and then target that. So let's go through these one at a time here. The first, and probably the most important, is whatever we come up with, it needs to be effective. We need to reduce ransomware by a huge factor. And I'm guessing it's right around 90, probably 95% or more across the nation and eventually across the globe. And that's a huge goal. That's not, you know, slow it down. And keep in mind, ransomware is doubling and tripling every year. So we have to completely reverse that trend and then take most of it out. So effectiveness is the number one goal. It's also the toughest. Second is timeliness. We can't wait around for decades. This is growing too fast. The impacts are becoming too grievous. We have to act fast. In, in the world of technology and industry, and, and that's probably in the 24 the 36-month range. That seems reasonable, and in reality, that's actually a really tough goal as well. But we wouldn't want to wait any longer for achieving that effectiveness. We want to get there, we want to get there relatively fast. The third aspect has to be affordable. We can't be spending fortunes on it. In fact, we need to have a return on investment within 3 to 5 years. And that— what that means is we need to be spending less on security than the losses that it mitigates, right? You never want to spend more on security than what you're protecting. So it's important to have that return on investment no later than 5 years out. That's also a challenge because cybersecurity can be really expensive. The next one, it's got to be usable, right? It can't impact us or businesses or anything else with tremendous overhead. Adding friction like that, people just won't use it, they won't follow it, the security will become less effective, there'll be a lag. It just begins to grind on people and businesses, and so they pull back from it, and that then affects the effectiveness. So We need to make sure whatever we're designing, whatever we're choosing to implement, it will not introduce too much friction. There'll always be a little bit, we know that, we're willing to accept that, but it needs to be small, targeting less than 5%, preferably less than 2 or 3% if possible, on average for everyone that it's benefiting. And lastly, it has to be sustainable. And this goes back to the adaptability of the attackers themselves. They will shift, they will adapt, they will change because they want the money to continue to come in. So whatever we do, it has to be sustainable over time. And that's really, really important. And it's really tough given the fact that we know the attackers are well-funded by now. They're really smart, intelligent. In fact, they may be more skilled than most of cybersecurity people. And they're highly motivated. They're not going to give up. This is a windfall of money. Some of these ransoms have been massive. Some of the big groups, uh, it's estimated they've taken in billions of dollars. And again, that's just going up every single year. Okay, now I'm going to end this video on, uh, one final note. I've done the analysis and believe there is a solution. A way we can maneuver tactically that achieves our strategic goals. Just like playing chess, we must see several moves ahead in order to defeat our ransomware opponents. The idea is simple, and it's to criminalize ransomware payments. And I know that sounds a little odd, but what it does is it actually sets in motion a series of cascading events which will undermine the core desire to conduct ransomware attacks. It will satisfy all the success criteria we've been talking about. And I've been chatting with and debating with many of my colleagues in cybersecurity, and so far This stratagem is superior to all other options that I've seen. So we're going to talk about this idea more in upcoming videos, so stay tuned. Click the subscribe button and the notification bells so you won't miss out on any of the upcoming topics. Thanks for watching.