Ransomware attacks have become increasingly common in recent years. These malicious software programs encrypt files on a computer or network and demand payment in order to decrypt them. Recovering from a ransomware attack can be a major challenge for organizations and individuals. While paying the ransom may seem like the quickest way to get files back, there are risks involved and it doesn’t guarantee you will regain access. Understanding the options available and taking preventative measures are key to dealing with ransomware.
What exactly is ransomware?
Ransomware is a type of malicious software that encrypts files on a device or network, preventing the owner from being able to access them. Attackers then demand ransom payment in cryptocurrency, such as Bitcoin, in order to provide the decryption key. Some common examples of ransomware programs include CryptoLocker, WannaCry, and Ryuk.
Ransomware can target any kind of computer system, from individual devices to entire corporate networks. It is typically delivered through phishing emails containing malicious links or attachments. Once activated, it works quickly to encrypt files using complex algorithms. The ransom note provides payment instructions and threats for nonpayment. Ransom amounts can range from a few hundred to millions of dollars depending on the target.
For individuals, a ransomware infection often means losing access to personal files like documents and photos. For businesses, it can mean entire databases, servers, backups, and application software are suddenly inaccessible, making it impossible to continue operations.
Why is recovering from a ransomware attack so challenging?
Recovering files and systems after a ransomware attack is extremely difficult for several reasons:
- The encryption algorithms used by most ransomware programs are nearly impossible to break without the decryption key.
- Ransomware often targets backups and storage systems to prevent easy recovery.
- Removing the ransomware threat itself can be challenging if it is deeply embedded in networks.
- Paying the ransom does not guarantee files will be recovered – attackers sometimes delete files even after payment.
Additionally, ransomware attacks can have long-lasting impacts beyond just the encrypted files. Business operations may halt completely, leading to significant financial losses. Rebuilding systems and restoring data from backups can be extremely time consuming and costly. And paying ransoms funds criminal organizations and encourages further attacks.
Should you pay the ransom?
In most cases, security experts advise against paying the ransom. Paying not only funds and encourages cybercriminal operations, there is also no guarantee you will get your files back after payment. However, in certain extreme circumstances, for example if human lives are at risk, paying the ransom might be the most practical option.
If possible, victims should first exhaust all other recovery options before considering paying a ransom. Working with law enforcement and cybersecurity professionals can help determine if any alternatives are available. The decision ultimately depends on the specific circumstances of the attack.
Reasons not to pay the ransom
- No guarantee files will be recovered – attackers may just take the money
- Funds criminal organizations, encouraging further attacks
- May not get rid of malware infection itself
- Other recovery options may be possible
- Paying identifies you as someone willing to pay ransoms
Reasons you might pay the ransom
- Absolutely critical data has been encrypted
- Backups are inadequate or compromised
- Downtime costs are exceeding ransom amount
- Threat actors have leverage over you
- No other options have succeeded
How can you recover files without paying ransom?
While difficult, there are ways to regain access to systems and data without paying the ransom. The options largely depend on specific circumstances and preparation taken before an attack occurs. Some potential methods include:
Restore from clean backups
Ideally having regular, isolated backups that can fully restore systems and files is the best defense against ransomware. However, backups must be kept offline and regularly tested to ensure they work properly and are free of malware.
Reset systems to clean state
Wiping infected systems and resetting to factory or known good states may eliminate the ransomware infection. However, files restored afterwards will only be as recent as the last backup.
Attack the encryption
In rare cases, cybersecurity researchers have found weaknesses in ransomware variants’ encryption schemes, but typically this is extremely difficult.
Decryption tools
Occasionally decryption tools are developed and released either by researchers or law enforcement that can unlock files for certain strains of ransomware. But these are rare and not guaranteed.
Use ransomware decryptors
Some security companies have created decryption tools that can unlock files encrypted by common forms of ransomware. However, these don’t work on all strains.
| Decryptor Name | Compatible Ransomware Families |
| Emsisoft Decryptor | 136+ families covered |
| Avast Decryption Tools | 50+ variants covered |
| Kaspersky Ransomware Decryptor | 40+ families covered |
An ounce of prevention…
Of course, avoiding ransomware attacks in the first place remains the ideal scenario. There are a number of prevention best practices organizations should follow:
- Training employees to identify suspicious emails and links
- Keeping all software up-to-date with the latest security patches
- Using antivirus and anti-malware tools
- Regularly backing up critical files/systems offline
- Restricting access to sensitive systems and data
- Using virtual environments to limit impacts
- Disabling macros in documents from untrusted sources
Should ransomware payments be banned?
Some policymakers have proposed outright banning ransom payments or making them illegal. However, there are arguments for and against prohibiting payments:
Arguments for banning ransom payments
- Eliminates incentive and funding source for attackers
- Discourages future attacks by raising risks
- Removes question of whether to pay
- Forces focus on backup solutions
- Helps avoid financing criminal/terrorist groups
Arguments against banning payments
- In some cases, paying may be only way to recover
- Drives activity underground and reduces chance of catching attackers
- Businesses lose option to evaluate tradeoffs
- Doesn’t stop ransomware campaigns or remove infections
- Hard to enforce prohibition in practice
Overall, banning ransom payments has tradeoffs and may be challenging to implement in reality. A more holistic policy approach that focuses both on bolstering defenses and disrupting ransomware operators may be more effective.
Are cyber insurance policies helping or encouraging ransomware?
The increasing prevalence of cyber insurance has added another dimension to the ransomware debate. Cyber insurance can help organizations cover costs related to attacks and system recovery. However, some argue that policies with ransomware coverage may also be encouraging ransom payments. Essentially, if an insured entity knows their policy covers the ransom, they may be more inclined to pay. But others counter that insurance facilitates a more reasoned evaluation of tradeoffs.
How cyber policies may encourage ransom payments
- Insured entities don’t directly pay costs of ransom demands
- Insurance takes away some of the financial risk
- Policies may actually recommend or require paying ransoms
- Ransom coverage acts as a safety net if other recovery fails
How insurance facilitates informed decisions
- Insurers provide cybersecurity expertise to policyholders
- Insurance process adds structure and risk analysis
- Ransom evaluation looks at all costs, not just ransom amount
- Policies require following prevention best practices
- Payouts fund improvements to boost security
The interplay between cyber insurance and ransomware is complex, but insurers argue that policies promote cyber resilience overall. They help organizations manage risk, absorb costs of attacks, and strengthen defenses over the long term.
Should ransomware payments be tax deductible?
Recently, the issue of whether ransomware extortion payments should qualify as tax deductions has sparked debate. Currently, most ransom payments are deductible as losses according to IRS guidelines. But some tax and security experts argue changing this could help deter attacks.
Those in favor argue deductibility encourages ransom payments, thereby financing criminal activity. Eliminating deductions would raise the effective cost of ransoms for taxable entities. However, critics counter that disallowing deductions unfairly punishes victims and say preventing attacks should be the focus.
Reasons supporting deductible ransoms
- Victims should not face additional tax penalties
- Deductibility helps offset losses sustained
- Makes expenses predictable for budgeting purposes
- Keeps tax policy consistent with treatment of other crime losses
- Disallowing deductions doesn’t deter ransomware attacks
Reasons against deductible ransom payments
- Lowers real costs paid by victims
- Incentivizes giving into extortion demands
- Allows costs to be passed along to taxpayers
- Sends signal that payments are legitimate course of action
- Tax deductions effectively subsidize criminal organizations
In the end, disallowing tax deductions for ransoms may not significantly deter attacks, given the other business impacts and recovery costs associated with ransomware. A policy change could unfairly penalize victims unless coupled with more robust prevention mandates and cybercrime enforcement measures.
What lessons have been learned from major ransomware attacks?
Looking at how organizations have responded to large-scale ransomware events provides useful lessons for defense strategies. Here are some key takeaways:
Colonial Pipeline
- Even critical infrastructure remains vulnerable
- Operational technology (OT) and industrial control systems (ICS) are targets
- Crippling effects of ransomware go beyond just data loss
- Regular cybersecurity assessments of OT/ICS systems are essential
JBS Foods
- Third-party cyber risks must be managed
- Supply chain interruptions cause cascading effects
- Cybersecurity vendor partnerships provide resources
- Response plans should consider likelihood of payment
Ireland’s Health Services Executive
- Ransomware resilience requires defense-in-depth
- Isolated backups are critical for healthcare organizations
- Incident response plans should address patient safety risks
- Cyber insurance facilitates faster recovery
Each high-profile incident provides insights that organizations should incorporate into their overall cybersecurity strategy. Understanding ransomware’s business impacts far beyond just data loss is key to mitigating its risks.
Conclusion
Recovering from a ransomware attack can be extremely challenging due to the sophisticated encryption algorithms used. While paying the ransom is an option, it should be considered carefully and avoided if at all possible. Maintaining offline backups, deploying security tools, and restricting access help reduce the need to pay ransoms. For organizations, having a tested incident response plan is essential for navigating these situations. Staying vigilant, preparing for the worst, and investing in cyber resilience offer the best means of mitigating the existential threat from ransomware.
