Call us now:
Damned if you do damned if you don’t. One has to understand the dynamics of cybersecurity, banning ransomware payment is not an answer. Asking organizations not to pay ransoms in the hope that it will starve cyber criminals of their key funding source, at best has no teeth, unless it is regulated. At worst if enforced, it could see organizations fold. Will banning ransomware payments stop a script kiddy, nation state or cyber criminal from continuing? Cyber is more profitable than the drugs trade, have we not learnt anything about crime.
As the article points out, organizations that have implemented cybersecurity are far more likely to get themselves up and running, than those that do not, but there are no guarantees. Cybersecurity regulation changes the dynamic of cybersecurity in favor of cyber resilience, shifting cyber risk onto corporate financial statement, requiring organizations demonstrate amongst other things cyber resilience.
As an additional thought, the U.S Department of Treasury (DoT) has made clear that ransomware payments to individuals on an OFAC list is banned. For organizations that pay ransomware, maybe a starting point is for the DoT to demonstrate that it is providing oversight of its own advisory. Setting a precedence may focus organizations on cyber compliance?
Maybe following the Australian model, helping business comply to cybersecurity and improve maturity is the way to go?
Ted Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Bob Dix
#cybersecurity #cyberriskmanagement
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7132275965862240256