Opening lines of communication with ransomware actors is crucial for achieving a favorable resolution during an incident that could significantly disrupt operations, according to Dan Saunders, Director of Incident Response EMEA at Kivu Consulting. He noted that only 30% of negotiations with threat actors in the past year resulted in financial settlements for victims.<\/p>\n
\u201cThere\u2019s a common misconception regarding engagement with threat actors,\u201d Saunders articulated. \u201cThe idea that engaging them guarantees a financial outcome is misleading.\u201d <\/p>\n
Engaging these malicious actors enables organizations to regain control of the situation, implement mitigation strategies, and prevent further escalation of the incident, which could include threats of physical harm, such as \u201cswatting.\u201d<\/p>\n
This proactive engagement allows organizations to gather actionable intelligence from the extortionists, helping them understand the root causes of the breach while buying time for forensic investigations and establishing a crisis communication team. “If our identity were to be disclosed, do we have an effective communication strategy to address the anticipated surge of inquiries?” Saunders questioned. He emphasized the likelihood of security researchers and journalists scrutinizing leak sites related to the incident.<\/p>\n
However, he cautioned that organizations must prioritize their operational security to mitigate risks, particularly if threat actors may already be operating within the network and monitoring responses. \u201cEstablishing out-of-band communication is vital to maintain control and prevent unintentionally revealing strategies to threat actors, as they prefer direct negotiations rather than third-party involvement,\u201d he advised.<\/p>\n
Better preparation for ransomware events is essential to minimize business impact, necessitating collaboration across the organization. \u201cWhile we have established playbooks for responding to ransomware attacks with our trusted service providers and IT teams, it is equally important to involve other stakeholders,\u201d Saunders stated. He urged organizations to consult incident response plans and conduct drills with leadership to simulate cyber extortion scenarios. <\/p>\n
Understanding the organizational assets, data storage protocols, and protection measures is fundamental for assessing risk exposure post-attack and identifying necessary parties for breach notifications. <\/p>\n
\u201cLegacy data often pose significant challenges; outdated systems and unnecessary data retention can exacerbate the situation,\u201d he concluded. <\/p>\n
This necessitates a comprehensive exploration of the organization\u2019s network architecture to identify critical assets, understand data classification, and evaluate the potential consequences of data exposure. <\/p>\n
The urgency of implementing best practices for incident response has escalated, especially in light of recent high-profile ransomware attacks affecting prominent retailers and brands.<\/p>\n","protected":false},"excerpt":{"rendered":"
Opening lines of communication with ransomware actors is crucial for achieving a favorable resolution during an incident that could significantly…<\/p>\n","protected":false},"author":1,"featured_media":1836,"comment_status":"open","ping_status":"closed","sticky":false,"template":"Default","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[28],"tags":[709,803,79],"class_list":["post-1835","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-communication","tag-negotiation","tag-security"],"acf":[],"yoast_head":"\n