Dec 6, 2017, 7:03 PM ETPanel

Cybersecurity and the Ransomware Wave: How to Keep Europe Safe

Ransomware losses increased from approximately $325 million in 2015 to an estimated $5 billion in 2017, marking the sector as a highly profitable criminal enterprise.
The number of unique ransomware families grew by 752% in 2016, driven by the technology's ability to generate high returns with low barriers to entry.
Criminals now operate directly with victims to eliminate middlemen (money mules), maximizing profit margins compared to traditional fraud models.
The adoption of cryptocurrencies has created an ideal payment mechanism for ransomware, facilitating untraceable financial transactions.

AI and machine learning are being adopted by adversaries to automate the personalization of social engineering attacks, allowing them to gather intelligence and tailor lures at scale.
Future threats include autonomous cyber weaponry and bots capable of identifying vulnerabilities and deploying payloads with minimal human interaction.
Criminals are developing anti-machine learning evasion technologies to bypass defensive algorithms, creating a continuous "cat and mouse" dynamic.
"Pseudo-ransomware" is emerging as a diversionary tactic to distract IT departments while attackers execute data theft or financial fraud (e.g., the Bank of Taiwan attack).
The "Internet of Things" (IoT) and Industrial Control Systems (ICS) are already vulnerable; live demos have shown successful remote unlocking of doors, manipulation of security feeds, and sabotage of industrial robots.
Vulnerabilities in connected vehicles pose significant terrorist risks, with researchers demonstrating remote control capabilities on Jeep models and potential for large-scale coordination of autonomous fleets.

Organizational response to attacks often causes more harm than the initial breach due to failures in managing legal, regulatory, and reputational pressures.
Conflicting obligations, such as GDPR's 72-hour notification window versus insider trading disclosure requirements, create complex dilemmas for leadership during incidents.
Extortion tactics are evolving to leverage regulatory fines; attackers threaten data exposure to force victims to pay a ransom that is significantly lower than potential GDPR penalties (up to 4% of global turnover).
Security training must shift from prescriptive rules to fostering a "skeptical mindset," as humans are hardwired to trust and are susceptible to authority-based manipulation.
Implementing "human sandboxing" allows employees to experience the consequences of security failures in a controlled environment, helping to reduce the fear of reporting mistakes.
A culture of fear prevents employees from admitting errors; organizations must empower staff to say "no" to protocol breaches, even when pressured by senior leadership.
Credential sharing remains a critical vulnerability, illustrated by MPs sharing passwords and criminals exploiting compromised accounts to launch further attacks within trusted networks.

The "NoMoreRansom" initiative has expanded to 116 partners worldwide, currently offering decryption tools for 84 ransomware families and preventing approximately $10 million in losses.
Law enforcement actions have disrupted criminal infrastructure and extracted keys, yet prosecution rates remain low, leading criminals to perceive a "zero risk" of penalty.
The insurance industry currently lacks viable products for data confidentiality and integrity breaches due to the subjective nature of security controls and lack of standard metrics.
Cyber insurance is currently viewed as a "sham" for non-availability risks, as insurers struggle to audit complex, evolving digital environments.
The criminal market has matured into a "Cybercrime as a Service" economy, featuring niche markets for malware scanning, email blasting (30 million emails/month), and even customer support for ransomware buyers.
Profiles of adversaries are fluid; nation-state actors (e.g., Fancy Bear) now frequently utilize publicly known vulnerabilities rather than exclusive zero-days, often hiring freelance coders for specific campaigns.
Geographical trends persist: Brazil is a hub for banking malware, China for mobile malware, and Russia/Ukraine for organized online crime.

New technologies introduce their own vulnerabilities; security software operating with high privileges can become a target if compromised.
Autonomous weaponry and kill decision bots are technically feasible, prompting a UN petition signed by 119 scientists and academics calling for a ban.
Regulatory frameworks like GDPR are inadvertently creating new extortion vectors, with criminals leveraging the threat of mandatory disclosure to extract payments.
The UK government has banned the development of autonomous weaponry, but global enforcement remains ineffective without international consensus.
Encrypted email solutions (e.g., Hushmail, ProtonMail) face low adoption due to complexity and the preference for convenience over security, limiting their business utility.
Public sector initiatives, such as mandatory "cyber gyms" in some nations, have demonstrated success in reducing attack frequencies through increased awareness and traceability.