There may be no honor among thieves. And for those who deign to make it a career occupation, so to speak, changing the “rules” of the game is vital in order to remain two steps ahead of the white hat crowd hot on their trail.
Certainly, netting big fish raises the visibility and the ‘net cred of hackers, as evidenced by this summer’s coordinated social engineering attack, a Twitter bitcoin scam that hacked the accounts of no less than Barack Obama and Elon Musk, among others. The ability to infiltrate such a high-end platform indicates that no system is 100% safe.
We’ll stray a bit into the new month with some final thoughts as to the X-factors that could bear watching in the future. Our State of the Industry report may end here, but for providers of security solutions, the story will be continued.
Extortion Game
Mike Burgard, CISO for St. Cloud, Minnesota-based Marco, notes that 2020 saw the evolution of another older attack vector. Ransomware is evolving to the point where it doesn’t matter if an organization has an effective backup and restoration technology in place. The extortion then becomes revealing to clients, partners and other interested parties that a company’s system has been infiltrated and compromised.
“It really forces you to pay the ransom,” Burgard said. “If you don’t pay, the hackers will take the data and it will be known that you had a breach. Or they’ll take your financial statements as part of it, and they’ll know if you can afford to pay the ransom. They’ll see the bank statement and adjust the ransom accordingly. Nobody wants to be in that spot.”
From an MSP standpoint, the ongoing evolution translates into continued opportunities as threats become more sophisticated. Patrick Layton, vice president of managed IT for Impact Networking of Lake Forest, Illinois, believes solving the root cause is impossible when the machinations of the process to recover from an attack are geared toward restoration at any cost.
“When the ransomware can attack a network, the insurance company’s first thought is to get the employees up and running as fast as possible,” Layton notes. “That’s the fastest way to pay the least amount of money as an insurance claim, so their first impulse is to pay the ransom. That fuels the criminals to create stronger, more ridiculous tools, and they know that they’re going to get paid.”
Without solving that root problem, Layton adds, the “cat and mouse game” continues without an end in sight. When a slot machine continues to pay, the gamer won’t be leaving anytime soon.
“Crime pays, unfortunately,” he said. “The good guys, like the white hat hackers we employ, if they didn’t have morals and didn’t want to work for a living, they could probably make a lot more money being a criminal. To me, that’s the root of the problem.”
Evolved Hackers
The hacker world is certainly emboldened and is more sophisticated and organized, contrary to the popular image of hoodie-wearing social outcasts operating within the dark confines of their parents’ basements. The scourge has reached such proportions that governments are making efforts to help private organizations boost their security defenses, according to Jeff Leder, director of managed IT security services for Impact.
“It seems like a never-ending and uphill battle, to the point that cybercriminals—these ransomware groups out there—they have HR departments and helpdesks,” he said.
