Former Chief Executive of NCSC @ciaranmartin says in The Times it’s time to figure out how to make a ransomware payments ban work.
For the record, 100% this. A lot of the arguments against this fall apart with any basic level of scrutiny and are largely being made by people and orgs who directly or indirectly benefit from the status quo.
Nothing should be off the table, and it may well help manage ransomware group’s targets if this option was very much on the table, in fact.
One of the defining things I’ve seen at every org I’ve talked to about ransomware preparedness is they’ve spent more time deciding if and how they would pay a ransom - who gets the call, the CEO, the board etc - than actually preparing cyber resilience.
Orgs are discussing the wrong thing first because it’s seen as completely normal to pay. That’s all our fault.
@GossiTheDog Counterpoint: it's their fault, because they view every problem as a certain quantification of money to be gained or lost. And the big power game is who has the power to spend company's money. So they will focus on the expense, and the person in charge to approve it.