Ransomware: why you should not pay the ransom (and what to do instead)
11 May 2021
Climate change in cybersecurity
Getting ahead of the ever-changing global conditions
At Orange Cyberdefense, we believe that the threat landscape in any region or industry emerges through the relationship between three primary systems – structural forces, inflationary forces and the evolution of technology. When these massive forces, that shape the threat landscape shift, then the impact can be enormous.
During the first half of 2020 such a systemic shift occurred with the advent of a global crisis, initiating the rapid adoption of new digital practices for work and commerce. As a result of this unprecedented event, a process of business transformation, that would normally have taken years, was started and completed in a matter of weeks.
Climate & weather analogy
The ‘systemic’ factors that need to be considered, are deeply woven into the fabric or societies and economies and therefore far beyond the means of a single corporation to counter directly. Think of it in terms of ‘weather’ and ‘climate’. You can counter the effects of the weather by staying indoors, dressing warmly or carrying an umbrella, but you can’t counter climate change and global warming in the same way.
Climate change is a systemic issue, born out of a multitude of poor decisions, wrong turns and compromises that we have collectively made over decades. Consequently, the impacts of climate change can only be countered by collectively addressing the systemic forces that create them. We can’t address climate change by carrying an umbrella and similarly we can’t truly address threats in cyberspace by countering its systems. We need to collectively work to understand the systemic factors that create these threats and then seek to address them at their core. The simple place to start, is to think about these problems from a *collective* perspective. As long as we persist in thinking about how individual organisations counter the cyber-threats to themselves in isolation, we will never be able to address risks that are truly systemic in origin.
The same is true in cybersecurity, where the threats and vulnerabilities we deal with on a daily basis really have their origin in large scale systemic and structural forces that exists far beyond our reach.
We need to start by appreciating that the emergent cyber-threat landscape is the function of system forces, and seek to understand those forces and their impact, rather than only focus on the symptoms we see. For example, the growing scourge of ransomware, (which we can easily predict is set to persist and escalate), is not an issue of advancement in malware or the failure of anti-virus. Indeed, it’s not an issue of technology at all. Ransomware is the consequence of a set of systemic factors that collude to create an inevitable and intractable problem. The business prerogatives of the cyber-crime ecosystem, the fundamental seller-buyer dynamic that is created when data is stolen, the enabling effect of cryptocurrencies and the failure of regulation in that ecosystem, causing the compounding effect of insurance companies who enable the payment of ransoms, to save costs. Until these system factors are understood we will not understand the nature of ransomware. And until then we won’t be able to address its symptoms.
The primary systemic components which give shape to new threats
New threats emerge through the relationship between three primary systemic components – structural forces, inflationary factors and the evolution of technology.
Structural forces include the systemic forces that create the enablers and constraints that shape the threat and our ability to respond. These factors are woven into our contexts and environments and have a fundamental impact on the shape the threat takes and our ability to respond to that threat. Influencing the landscape is the most far-reaching and effective way of addressing threats and should always be strongly considered whenever cybersecurity strategies are being discussed.
Once the shape of the threat landscape is initially defined by these structural forces, the challenges we face are exacerbated in one way or another by equally powerful and even less controllable inflationary factors. We can picture these inflationary factors as having the effect of blowing air into a balloon. If the shape and initial size of the threat is the balloon – created by the structural forces we described – then the inflationary factors inject more air into those balloons, vexing our efforts to deflate them or even inflating them further, leaving us with more and more intractable problems to deal with. Whilst we can observe these forces and even attempt to predict them, we have no real way of controlling them. Our only choice here is to observe them and orient our own strategies accordingly.
It stands to reason that the evolution of technology, along with the new business models and process it enables, would have a meaningful effect on the threat landscape. Indeed, both the attacker and the defender are impacted by even the smallest changes to the systems and tools both sides use. Given the reality outlined above, we avoid focusing on the impact of specific technologies, but rather seek to identify consistent principles that describe how technology evolution affects the state of the threat. From a cyber-defense point of view, however, technology is something we can exert control over. We can choose not to adopt a new technology, and when/how we deploy others to address emergent security threats. We can effectively reduce the size of our attack surface by limiting the technologies we deploy and reduce risk by finding and mitigating vulnerabilities. Since these efforts are completely under our control, it makes perfect sense for us to use recognized best practices to do so.
In short, we start to get ahead of new and ‘left-field’ threats in the same way that we start to get head of the weather- by understanding the climate globally and appreciating how climate creates the weather, and how our collective behaviours contribute to shaping the climate.
World 2020: Virtual event
On November 24th 2020 we hosted our first global, virtual flagship event. A half-day streamlined program dedicated to our customers, cybersecurity experts and end-users across the globe. An opportunity to deep-dive on the threat, tech & innovation and geopolitical trends that are shaping the current cybersecurity landscape and how they are affecting board’s decisions, through an interactive session with preeminent members of the group.
No one today is immune from a cyber-attack. Our ability to operate, work and recover from an attack determines our level of resilience. We share the lessons we have learned from this climate change and our viewpoint on the key issues we collectively need to prioritise to build a safer digital society.
The topics covered include:
- An overview of the business, IT and the cybersecurity global landscape as of 2020 – What have we learned from this climate change and what do we need to focus on next?
- Insights into how our customers and the industry in general responded to the new threats and vulnerabilities, and how effective those responses were
- The security ‘debt’ that businesses have had to accumulate in order to respond rapidly to the crisis, and what we have to do to pay off that debt now that we’re living in a ‘new climate’
- The lessons we can learn in cybersecurity from the impact the 2020 crisis has had on the world, and the successes and failures of the health community’s response to the pandemic
- CISO priorities on demand: Addressing the top critical challenges to better plan the weather forecast
You find the on-demand webinar here!
More Articles