Decisions faced by Leadership on an extortion or ransomware attack can be quite difficult; should they pay, not pay, or negotiate? the technical impact associated with either encrypted systems or stolen data is only one of many considerations; there is a much larger challenge related to assessment of risk, governance, and timing.
Understanding the Negotiation Landscape
Few hackers will demand payment without prior research. They will typically conduct reconnaissance on an organization to determine what factors will have the most influence in a negotiation.
The following are important elements which impact how hackers negotiate with their victims:
1. Perceived ability to pay
2. Estimate f downtime tolerance
3. Sensitivity of the data being stolen
4. Visibility of regulatory/public scrutiny
Negotiators do not improvise, they perform reconnaissance and then make informed decisions.
Common Measures Used By Attackers
Once information has been gained by an attacker, there are several tactics that can be used by an attacker based on the victim's response:
1. Escalation of urgency: Threatening further escalation if Victim does not respond to initial demands
2. Possession of partial data: Proving possession of sensitive data and having it available for release to a victim
3. Flexible payment schedules: Providing the victim with multiple options of paying, with discounts for paying sooner.
4. Psychological Pressure: Exploiting fears of reputational, operational, or regulatory harm that may arise if there is a failure to pay.
Real-world examples
Phased Ransom Requests
1. Initial Request for Ransom- $500,000
2. Demand Increased to $1,000,000 After Delayed Responses From Organization
3. Prior to Payment; Legal Counsel and Executive Team Reviewed Organization's Decision to Pay
Sensitive Data Rendered Ineffective
1. Some attackers released a small amount of sensitive data
2. Some members of leadership were made aware of the fact that there had been a breach of the sensitive data but did not have an accurate picture of how extensive the breach actually was
3. An intense amount of pressure was placed on negotiators to try to ensure that further disruption would not ensue.
Use of Middleman To Facilitate Response to Attack
1. Organization Utilized Legal Counsel and Cybersecurity Advisors for Help
2. Communication Between the Organization and the Attackers Was Done Through An Intermediary
3. Terms of Payment and Time Frame Were Negotiated to Minimize Operational Disruption.
Practical considerations for leadership
Negotiation is not a trade-off. Negotiation is a negotiation of risk and uncertainty:
1. understanding the operational impact and reputational effect of your actions
2. understanding what data will be your case in establishing your position before making an agreement
3. identifying a clear chain of authority before you take any action
4. Working closely with your company's legal, insurance and cyber security professionals
5. Documenting all communications related to negotiations
Proper preparation and process will alleviate stress and lead to better decisions.
Attackers will continue to monitor how an organization operates
Quick or unnecessary responses can lead to greater demands, threats or an escalation of attack methods.
Using a methodical and controlled approach when negotiating will result in much better negotiating results with very limited exposure.
Takeaways for executives
1. Cyber negotiation is as much about information and leverage as it is about payment
2. Understanding attacker methods, pressures, and expectations improves decision-making
3. Leadership should define roles, decision thresholds, and escalation processes before an incident occurs
Effective negotiation requires governance, insight, and discipline.
