Four Steps to Prevent Anarchyware

Background: Just a few months ago, in an office far from the U.S. mainland, a contractor clicked open a seemingly innocuous email and it began.

Senior management at a well-known company awoke to their worst nightmare: systems all over their network infrastructure were locked up while employees and customers alike were already screaming for a solution to an, as yet, unknown cause. Is this a new story? Unfortunately, not. Read on though, there’s more to this than first met your eyes.

The Bad Guys

Ransomware – your money for your data; by now, we are all too familiar with this form of malware and the damage it inflicts. At first, it seemed to be the culprit but the accompanying message only asked for a very small of money. Attempts to pay the ransom did not work because the payment link was broken and, as it turned out, this was never about the money.

Meanwhile, the malware had raced across international boundaries turning servers, desktops and laptops, thousands of them, into useless bricks. Experts were scratching their heads wondering “what’s the point of this” if there’s no monetary payoff for the bad guys? The old adage of “cui bono?” didn’t apply this time.

Anarchyware:

When you remove a profit motive from ransomware and its intent is purely destructive it becomes “anarchyware.” ArsTechnica’s article is but one of many to describe what happened this time – this was a destructive “wiper” designed to wreak havoc and it did so without mercy. The end result for this company was weeks of downtime for thousands of employees contractors and customers, damage to their reputation, tens of millions of dollars spent to “recover”, delayed or lost sales and a huge blow to morale.

Where is all this going? Well, sadly, this did not have to happen. Indeed, you cannot always prevent an employee from opening a malware-laden email but you can put up roadblocks to neutralize, or substantially mitigate, the intended damage. The parallels to actual ransomware should be instructive to every CEO, CTO, CIO and CFO, no matter the size of your company.

The Conversation:

(The following is an amalgam of conversations heard over decades in the IT security world, updated for today’s problem sets. Some of you might recognize it from your own budget discussion experiences.)

CEO to CIO/CTO: “Your proposed budget number for IT security infrastructure isn’t going to happen. We cannot spend that kind of money.”

CIO/CTO: “While I understand your thinking, let me explain mine. We are no longer just dealing with ransomware but anarchyware. It used to be that we had the option to pay a ransom for our data, ugly as that concept is, but now we have malware designed to wipe out our systems with no monetary motive. Preventing that kind of disaster is expensive but remediating one is even more so.”

CEO: “What about our disaster recovery plans and backups?”

CIO/CTO: Remember last year’s budget request for more grid infrastructure and the cloud implementations that were denied? You said to make do with a token budget increase. Those requests were just to help bring us to a minimal level of compliance with our DR plans.”

CEO: “So, what are you telling me? That you can’t keep us secure without this big increase? How will it look when we spend this money and nothing happens?”

CIO/CTO: The whole point is to look just as we do today, a company fulfilling its mission without severe/permanent data losses and work stoppages. Look at our friends at “XYZ Corporation” down the road who just spent five times what I am requesting to remediate a malware attack and still aren’t up and running as they were before.”

CEO: Ok, time for a Board-level discussion. To be continued……”

The Parallels:

The message from the top IT folks was simple: “You can pay now or pay later – and paying later is exponentially more expensive.” With anarchyware, the paradigm has irrevocably changed and companies must realize that it is no longer about an exchange of bitcoins for data; your entire business is now at risk as destructive malware variants continue to proliferate on the Dark Web.

In this particular story, a fairly small investment would have prevented this anarchyware from doing its damage. The unseemly parallel is that making the necessary investments to secure your company from harm is like paying a ransom but will be smaller dollars than the true costs of remediation. And that’s only when you get a choice; anarchyware pays (no pun intended) no mind to your bank account – it is chaos for the sake of chaos.