Holding data to ransom

June 2017

Michael Rohrs, Senior Consultant

In this article, which was published in the Q2 issue of Continuity magazine, the membership publication of the Business Continuity Institute, Michael Rohrs discusses the key factors that influence the severity of a cyber extortion incident. In the wake of the WannaCry ransomware attack in May, it is vital for all organisations to have a well structured and properly resourced plan for an effective technical incident response.

Read the full article

Key takeaways:

  • Capability plus intent: One of the first essential questions to answer when you are alerted to a cyber extortion incident is, “Is the attacker capable of what they claim?”
  • Crisis management: Regardless of the facts of an incident, perception can be reality during a crisis. Sometimes how you manage the other aspects of the incident – business continuity, internal communications, legal obligation, customer management and media interaction to name but a few – matters more than your technical response.
  • Cost versus benefit: Being extorted can be emotional, particularly if you’ve been targeted more than once. But not all extortion attempts have the same level of severity or implications.
  • Preparing for the expected: Extortion is a well-established and evolving technique and is now a common occurrence across sectors around the world. It will likely continue to happen as long as it works. The best way to secure your enterprise and reduce your risk is to prepare the entire business ahead of time.

See Also

  • Kidnapping risk along the Belt and Road Initiative

    The Belt and Road Initiative (BRI) is an unprecedented opportunity to develop regional economic integration and maritime connectivity, but also presents a risk of kidnap-for-ransom.

  • Automotive Expert Brief: September 2017 - UK and Brexit

    In the months following the UK’s vote to leave the EU, the government gave assurances to Nissan that Brexit would not adversely affect its UK operations. However, nearly a year later, the automotive companies are becoming increasingly frustrated that those assurances have not translated into concrete agreements between the UK and the EU.