Ransomware Attack: What if this were your Billion $ mistake?

No one has ever heard of your company. Let’s call it, COMPANY X. And you like it that way. In 57 years, you’ve never once shut down your mission-critical operations that fuel the US economy. YOU are an honest, satisfied employee of Company X, and although your security team hounded you with preachy posters in every ELEVATOR to never use the same password twice (because passwords are like dirty underwear), you still did. You used the same totally UNGUESSABLE 10-character password for your work login and hotel loyalty program. Which got breached. You changed the stolen password on the hotel website, but forgot about your work login. And your company doesn’t require two-step logins, even though they bought the technology after a dashing keynote speaker SCARED the crap out of them.

In mid-February, you receive a promotion, and with it, a new login to the system. In spite of a $200 million per year IT budget, your company never decommissions your old login credentials, leaving access as wide open as the BACK DOOR into a college-town liquor store.

On April 27, DARKSIDE, (yes, even hackers have a sense of humor) a ransomware attack ring protected by EMPEROR PUTIN, buys your stolen loyalty credentials for approximately five cents and uses artificial intelligence to insert them on every login page on the Company X website, which they know you work at from your snappy LinkedIn profile. While outdated on the hotel site, your username and password still work for your vacated role at Company X.

By April 29, DarkSide has loaded ransomware onto your computer, which happens to be in the master control room of Company X. Company policy states that any sign of ransomware triggers an automatic shutdown of all operations, which suggests that Company X isn’t clear on how closely their business I.T. systems are tied to their operational or O.T. systems. PARTY FOUL.

And that’s how Colonial Pipeline, supplier of 45% of the East Coast’s fuel supply, shut down all operations for 6 days. 2.5 million barrels of fuel per day, stuck in Texas because of your single password that opened the company to ransomware attack. Ok, I realize this isn’t really your fault, but what if it was? What if you were the one who caused FLORIDIANS to queue at gasless gas stations as if KRISPY KREME and In & Out Burger had just merged?

Colonial chooses to defy the FBI DIRECTIVE to never pay a ransom (research says that doing so just invites the cybercriminals to come back for seconds) and pays DarkSide $4.4M dollars in untraceable bitcoin to get their pipes back in the game. Well, not totally untraceable, as the FBI HELPS Colonial retrieve half of its bitcoin. But don’t expect them to come to your rescue, as you probably don’t supply the East Coast with half of its carbon emissions. Even after the blackmail is complete, fuel doesn’t flow for 6 more days. Which causes Billions in damage to the US economy and Millions in reputational damage to Colonial. Because of a password. From one person.

Here’s what this ransomware attack means for you:

• Every employee matters: One weak password can bring an organization to its knees
• Don’t let your company get cocky, because it CAN happen to you.
• The ransomware get-out-of-jail price tag is now often in the tens of millions.
• Security is an obsessive, continuous pursuit, so make a long-term game plan.
• Never forget to deactivate old user accounts.
• Require two-step logins to minimize the impact of poor passwords.
• Have a foolproof, off-site, offline backup of your data.
• None of this works without a healthy underlying culture of security.

If you’re confused about how to prepare for a ransomware attack, consider a leadership crash course in cybersecurity. Because one small cyber mistake, and everyone will know your company.

_____________________________

John Sileo hosts cybersecurity crash courses that target the human element of cybersecurity. His clients include Amazon, the Pentagon and Charles Schwab, but his most fulfilling engagements are for smaller organizations and associations that can affect immediate change. 303.777.3221