GSN Aug/Sept Digital Edition

Cybersecurity and ConvergenceComputer files held hostage by ransomwareare thwarting law enforcementBy Karen Ferrick-RomanAn upstate New York village of lessthan 8,000 people paid the equivalentof nearly $10 per capita last yearto hackers because its computerprograms were held for ransom.Ilion, N.Y., made payments of$300, then $500 to access its ownpayroll, accounting and financialfiles, reports the Associated Press.The AP also says that police in theChicago suburb of Midlothian paida $500 ransom in untraceable bitcoin.In Maine, the Lincoln Countysheriff ’s office paid a $300 ransomto regain access to its computers. Inthis case, the FBI helped to trace thepayment to a Swiss bank account—but could not identify the hackers.Ransomware—malwarethat can freezecomputers and/or stealtheir files—has grownmore prevalent in the lasttwo to three years, saysDr. Jibey Asthappan,assistant professor anddirector of the Universityof New Haven’s nationalsecurity program.While the amounts setDr. Jibey AsthappanUniversity of New Havenfor ransom may be small, the aggregateadds up to losses of billions.Thus far this year alone, Asthappanestimates, $2 billion has been spenton ransomware impacting municipalities,government agencies of alltypes and individuals.Using caution in opening suspiciousor unexpected emails is themost basic prevention. Regardlessof an agency’s size, Asthappan says,each individual employee mustknow the protocols for cybersecurityand must be trained to knowthat emails might have payload. Theauditors who uncovered the Ilionransomware issue cited irregularcomputer protocols: user accountsfor ex-employees that hadn’t beenclosed, generic accounts used bymore than one individualand lack of a recoveryplan for security incidentswith backup data.A few sloppy ransomwarehackers have beencaught, including somein Europe, Asthappansays. But most bad guysare outrunning law enforcement.“It’s not unheardof but we’re not34catching anywhere the amount ofattacks. About 600,000 computershave been held hostage in sixmonths, almost a million computersare held over the year.”Ransomware hackers are good atusing the banking system, Asthappansays. “We have yet to locate oneof these guys to find out what they’rereally making (in ransom), goingthrough Swiss bank accounts.”Asthappan offers ideas for avoidingransomware, starting with thehumans who can thwart firewallsand spam filters: watch where youclick. He also advises creating twosystems: one attached to the internetand one, storing more sensitivedata and backup material, that is notonline—“air gapped.” To go a stepfarther, use a different operatingsystem on the air-gapped system,including now easy-to-use and inexpensiveLinux.He advises: When youget that email, don’t routinely downloadthe attachment—and don’thave the computer automaticallydownload it. Remember that a USBdrive, which also has executable files