Following the news that hackers have stolen apparent internal documents from a Californian investment bank and published them online, likely in an effort to extort money from the victim company. Javvad Malik, Security Advocate at AlienVault commented below.
Javvad Malik, Security Advocate at AlienVault:
“The challenge is that even if companies pay the ransom, there is no guarantee that the data won’t still be leaked publicly or traded privately. Once the genie is out of the bottle there is no going back. So I’d not recommend paying the ransom under these circumstances.
Companies need to know what data they have, valuing it, and applying the best controls to it. However, it’s not always as easy or straightforward to establish the value of items, and data in particular is particularly difficult to value. One of the main reasons is that the value is hardly ever static; rather it changes on an ongoing basis. Businesses must examine the value of their data, not just in that point in time, but across a timeline that takes into account various events that may occur.
Organizations need to be aware of what data is hazardous to them and under what circumstances. Where possible, this should be imparted into the risk appetite of the organization and described independently of the technology stack. If this can be done, companies will be closer to understanding the value of their data, protect the most vital aspects, and minimise the chances of being held to ransom.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.