According to the Justice Department, ransomware attacks are now elevated to the same priority level of terrorism. Dealing with cybersecurity right now is as important to the US government as dealing with global terrorism after 9/11. So what gives?
JBS, a Brazil-based company responsible for 1/5 of the United States’ cattle supply, was hit by an enormous ransomware attack, threatening to “significantly” raise the wholesale price of beef during our period of highest consumption (think of all the summer barbecues!) All US operations were brought to a halt. This is the second time this year that a major industry was attacked in this fashion.
What’s Changed?
Ransomware groups and individuals have been attacking people, businesses, even cities for a while – but now we’re seeing them target whole industries. Back when it was small attacks on individuals, they would demand small fines in the hundreds of dollars to unlock the encrypted files.
In 2017, we saw a group emerge who claimed to have hacked the NSA. They released an attack called WannaCry that hit 200,000 computers across 150 countries, including entire businesses, hospitals, etc. And then it got worse. Russia picked it up and targeted Ukraine. They hit every major government agency, the rail system, ATMs, post offices. They targeted any business that had any operation in Ukraine, including some American companies like FedEx, Merck, and Cadbury Egg.
American Companies are Vulnerable
The attack resulted in approximately $10 billion in damages and the longer-lasting legacy was that the attack opened up eyes (for better or worse) to how vulnerable American businesses were to ransomware.
What about American businesses in particular makes them vulnerable? One expert proposed that it started in Silicon Valley with Zuckerburg’s famous motto: “move fast and break things.” The idea that it was more important to get things DONE than to get them done securely. Build now, secure later. Our entire tech structure is built on buggy software.
The cost of these bugs can be enormous. Colonial Pipeline paid over $4 million to the hackers, and JBS ended up paying $11 million. The City of Baltimore was attacked in 2019. The ransom demanded $75,000 and the city refused to pay. They opted to rebuild everything instead – which ended up costing around $18 million.
How to Stay Protected from Ransomware
From the government’s perspective, the solution needs to be top-down. Our leadership needs to acknowledge the risks, work with our allies to determine an appropriate cohesive response to ransomware attacks around the world. One proposal is even to make paying ransoms illegal.
But for us? For the little guys, the vulnerable companies? We need to take steps to protect ourselves. The first is a robust set of backups. And the other is what is commonly called simply “good cyber-hygiene.” Cybersecurity is only as good as the weakest link, and employees are typically the weakest link. Be sure that they are staying diligent in protecting their passwords and enable multi-factor authentication whenever possible.
We will have a series of webinars concerning cybersecurity and ensuring your company is prepared for an attack in the coming months. Be sure to stay subscribed to our blog to be notified when those dates are chosen. And as always, contact us about getting on the Crestwood Cloud!
