What should the government be doing about cyberattacks on corporations?
A day after the worlds largest meatpacking company, JBS, confirmed that it paid the equivalent of $11 million in ransom to hackers who broke into its computer system, two federal officials spoke with WTOP about what companies, private people and the government can and should be doing to prevent and deal with the next attack. A day after the worlds largest meatpacking company, JBS, confirmed that it paid the equivalent of $11 million in ransom to hackers who broke into its computer system, two federal officials spoke with WTOP about what companies, private people and the government can and should be doing to prevent and deal with the next attack. Eric Goldstein, the executive assistant director for cybersecurity at the Department of Homeland Securitys Cybersecurity and Infrastructure Security Agency, told WTOP on Thursday: This is a national-level risk that can affect every organization in America, public or private, big and small across sectors.  He didnt directly answer a question about whether the government could require a minimum standard of cyberdefense, but said that his agencys website, cisa.gov, has resources that all companies can use to secure their own networks against these risks.  Even so, attacks will happen, and Goldstein said the key to surviving them was not just to harden systems against attacks, but to focus on the resilience of our critical functions  fuel, food, banking, telecommunications  the things that you and I rely on for our everyday lives.  All organizations, even as they invest in cybersecurity, should also look to make sure that the services they provide can be less dependent upon IP networks and systems, Goldstein said. So that if a cyber intrusion or a ransomware attack does occur, the services they provide will still be available to the American people and the businesss customers.  Three ways to fight back  Sen. Mark Warner, the chairman of the Senate Intelligence Committee, pointed out that the JBS payment comes on the heels of the Colonial Pipeline hack that put half the country into a gasoline panic, as well as attacks on a ferry system in New England and the whole Irish health care system about three weeks ago.  He laid out three ways the government can fight back. One, we need to have a mandatory reporting requirement. These companies dont even have to tell the government when they are attacked, so that we can actually bring law enforcement and our other tools to the table.  Second, we really do need to create some level of international standards. So that when we see these attacks come from criminal gangs, for example, out of Russia, if they are attacking critical infrastructure, whether its here or Europe or elsewhere, we can have a united world response.  And three, we really need to start a  debate about whether there should even be payments of ransomware.  Even if you pay, there should be more transparency in the payments.  Warner said there was broad bipartisan consensus on his committee for legislation mandating the reporting of these attacks. He encouraged President Joe Biden to put this on the table when he meets with President Vladimir Putin of Russia, where many of the biggest hackers are based. Both officials discouraged the practice of paying ransom. Our guidance is to strongly discourage the payment of ransom, Goldstein said. The more ransoms that get paid, the more attacks we will see. He added that theres no guarantee that paying ransom will actually get a companys data back. Warner acknowledged its not that simple: Of course, you start with the premise that, hey, folks shouldnt pay this ransom. But if its a hospital, and theres a chance that people may die if you dont do something in the short term, its not as easy a discussion as you initially think.  But even if you pay, he added, there ought to be transparency on the payments. And maybe that means we shouldnt be using crypto right now.