0

Hypothetical scenario:

If a ransom-ware attack was to happen which threatened to make public "private client data" if you didn't pay up.

Assuming such a virus exists and you've already been infected, how do you protect your clients confidential data without paying?

As companies are now sidestepping ransom-ware attacks by simply using good backups to restore copies of files, I believe the next logical evolutionary step would be for ransom-ware attacks to threaten to reveal confidential client data, where backups will be useless as a defense.

Also, as far as I understand, no security measure if 100% perfect to attacks, and that you can only reduce your chances of being attacked in the first place. Therefore, in the inevitable scenario that you do get ransom-ware, how do yo protect client data confidentially?

  • 2
    2. and 3. are not information security questions (they're legal and business issues). 1. is easy to answer though - you've already failed at that if you got infected and the attackers have extracted data. – Matthew Dec 21 '16 at 15:39
  • Please remove points 2 and 3. They are off topic here. – Limit Dec 21 '16 at 15:47
2

If you are infected with a virus, then it's too late. Whatever the virus has access to is vulnerable at that point. This is true regardless if the virus happens to be ransomware or some other type of malware. The same thing is also true if a hacker (rather than a virus) gains access to your machine.

The best defense is to take measures to prevent the infection/hack in the first place.

Also, typical ransomware encrypts your hard drive which makes it inaccessible to you, so paying the ransom does not actually protect your data. All it does is allow you to access it again. The best defense against that type of ransomware is good backups. That way if you get hit you can just restore your machine. But you should realize that your data could still have been compromised.

Update: the type of attack you describe would probably not be called "ransomware", it more likely would be done by a live hacker who found some juicy data that they are now blackmailing you with.

  • No security measure is 100% perfect, it's inevitable that you will be infected eventually. If, sorry, WHEN that happens, how do you protect client data confidentiality. Based on your answer, it seems it's impossible to prevent the inevitable. – oshirowanen Dec 21 '16 at 16:30
  • @oshirowanen - If it's inevitable that a particular system will be infected, then it's inevitable that the "infector" will have access to anything that system can access. If you want to absolutely protect the data, then don't let that system access the data either...there really is no other way. – TTT Dec 21 '16 at 16:49
  • @oshirowanen no security measure is 100% perfect, but it is not inevitable a host will be infected... – Trotski94 Dec 21 '16 at 17:01
0

While it is true that it is generally impossible to be sure that it is impossible to be infected, that doesn't mean that any given system will be infected. After all, there are a lot of systems around, and only a limited (if high) number of attackers.

As a result, the general approach is to keep all systems up-to-date, minimising the chances of them being one of the unlucky ones. Implementing a strategy of defence in depth can help - ensuring that only data which needs to be available is kept on directly accessible devices, monitoring for unusual traffic (if someone is extracting data, it'll either take a while as they try to keep under the radar, or show up as unusual levels of outbound traffic), keeping systems patched and regularly audited for unusual software.

Once an attacker has managed to extract data, though, you can't do anything. It's already too late - they've got the data. Even if you pay them, you can't be sure that they delete their copy. You can't be sure that they've not made more copies. You can't be sure that they themselves haven't been attacked, with a third party taking another copy.

The only way to preserve confidentiality is to keep the data confidential - simple.

0

In the scenario you describe the attacker has compromised your data, stolen it and prevent you from accesing it. You can't do anything against that

The only thing you can do is prevent the attack and mitigate it with backups so you don't lose access to it. What the attacker does after that is not on your hands, your best chance is if you know the attacker and take legal actions against him

If this scenario is a real security risk for your business it should be contemplated in the mitigation plans in case of critical information leakage

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.