CS Jan-Feb 2024

ansomware
Raja Patel - Sophos: cybersecurity
defences need to be dynamic and
foresightful.
Ilia Kolochenko, ImmuniWeb: the risk of
getting caught - despite several prominent
operations by law enforcement agencies in
2023 - are still infinitesimal.
enjoy the fruits of their crimes. In 2024, we
will likely see even more victims of ransomware
that is gradually dethroning other - less
profitable and more risky - types of cyberattacks."
INVERTING THE PRINCIPLE
In a bizarre twist to the principle of behaving
with all due probity in this murky world, it has
recently emerged that the ALPHV/BlackCat
ransomware operation (widely accredited as
being the first ransomware group to create
a public data leaks website on the open
internet) has filed a US Securities and
Exchange Commission complaint against one
of its alleged victims for not complying with
the four-day rule to disclose a cyber-attack.
Kolochenko, also adjunct professor of Cybersecurity
& Cyber Law at Capitol Technology
University, comments: "Misuse of the new SEC
rules to make additional pressure on publicly
traded companies was foreseeable. Moreover,
ransomware actors will likely start filing
complaints with other US and EU regulatory
agencies when the victims fail to disclose a
breach within the timeframe provided by law."
Having said that, not all security incidents are
data breaches and not all data breaches are
reportable data breaches, he points out.
"Therefore, regulatory agencies and
authorities should carefully scrutinise such
reports and probably even establish a new
rule to ignore reports uncorroborated with
trustworthy evidence, otherwise, exaggerated
or even completely false complaints will flood
their systems with noise and paralyse their
work."
REVISION TIME
Kolochenko also suggests that victims of data
breaches should urgently consider revising
their digital forensics and incident response
(DFIR) strategies by inviting corporate jurists
and external law firms specialised in cybersecurity
to participate in the creation, testing,
management and continuous improvement
of their DFIR plan. "Many large organisations
still have only technical people managing the
entire process, eventually triggering such
undesirable events as criminal prosecution of
CISOs and a broad spectrum of legal
ramifications for the entire organisation.
Transparent, well-thought-out and timely
response to a data breach can save millions."
ENHANCED EXTORTION
Thomas Barton, who is senior IR analyst at
Integrity360, addresses the very same issue:
"This shows that ransomware operations are
beginning to reach a maturity level where the
responsible threat actors are fully aware of
regulations affecting their target sector and
are able to use regulatory bodies to enhance
the threat of extortion. This highlights the
importance of engaging experienced legal
and cybersecurity profess-ionals before,
during and after an incident who can assist in
navigating the complex challenges that such
an attack can present."
Finally, and according to a new report by
MIT professor Stuart Madnick, there were
more ransomware attacks reported during
the first nine months of 2023 than in the
whole of 2022. It points to a stark increase in
cyberattacks, impacting as many as 360
million people up to and including August.
One reason for the jump, according to
Madnick, is that ransomware groups are
becoming far more organised, operating
as gangs and targeting organisations with
critical user data, such as government and
healthcare facilities.
The other cause for the jump, he points out,
is that cybercriminals are increasingly using
secondary vendors to gain access to their main
targets. "In today's interconnected world,
virtually every organisation relies on a wide
range of vendors and software. As a result,
hackers only need to exploit vulnerabilities in
third-party software or a vendor's system to
gain access to the data stored by every
organisation that relies on that vendor."
26
computing security Jan/Feb 2024 @CSMagAndAwards www.computingsecurity.co.uk