Ransomware crims hammering UK more than ever as British techies complain the board just doesn't get it

The UK government's latest annual data breach survey shows the number of ransomware attacks on the isles is on the increase – and many techies are forced to constantly informally request company directors for defense spending because there's no security people on the board. "[The board is] very involved, they don't give full …

[Doctor Syntax]

"We need to have a constant dialogue of this is what we're doing, this is why we're doing it,"

This is why paying a ransom should be illegal ad directors held responsible. The dialogue would be much easier if IT could answer "If it goes wrong you could end up in gaol."

[Anonymous Coward]

This is why paying a ransom should be illegal ad directors held responsible. The dialogue would be much easier if IT could answer "If it goes wrong you could end up in gaol.

Easier said than done.

[Phil O'Sophical]

Or make having a security policy and board-level expertise a requirement of their business liability insurance.

[NoneSuch]

Or force Board Members to pay any fines on top of the ransom. Not the company.

That'll motivate them.

[Like a badger]

If existing law were enforced, they already could be sent to clink:

S 45 of the Serious Crime Act 2015, Offence of participating in activities of organised crime group

(1)A person who participates in the criminal activities of an organised crime group commits an offence.

(2)For this purpose, a person participates in the criminal activities of an organised crime group if the person takes part in any activities that the person knows or reasonably suspects—

(a)are criminal activities of an organised crime group, or

(b)will help an organised crime group to carry on criminal activities.

It's pretty clear that by paying a ransom, that helps and organised crime group to carry on their activity. The problem here is the lack of skill and determination on the part of the authorities, and a willingness to see corporate entities as victims of crime, rather than participants in a system of crime which (in most cases) they could have avoided by appropriate action beforehand. I'm sure many will disagree with me painting ransom-paying corporates as participants in crime, so let me be clear I think (eg) fraud or ransomware attacks against individuals are a totally different matter.

[Excused Boots]

I’ve upvoted, because I agree, alas I can’t upvote you again for spelling gaol correctly!

[ecofeco]

FAFO

The lords of the manors are never going to learn.

History shows us that FAFO is always the end result. Usually shortly after telling us peons to eat, er.... cake.

[Excused Boots]

Re: FAFO

Indeed, ultimately all we can do is warn, do it in writing, (and email counts) and keep copies, offline.

Now this won’t help if the company goes ‘nipples north’ due to a cyber attack, but it may help if it is a limited loss but the bosses are looking for a scapegoat to pin the blame on.

[ecofeco]

Re: FAFO

Exactly. CYA has never been more important for us plebes.

[Kurgan]

Cyber war

This is a cyber war and it will only get worse, so better get good at it.

[ecofeco]

Re: Cyber war

It is indeed and has been for some time now. But until there are real consequences, i.e. total bankruptcies and jail times for failure of leadership, the western corporations will do nothing significant to protect themselves. Psychopaths are funny that way. It's not important until it impacts them or a good friend at the country club.

[amanfromMars 1]

Oh that disruption was all that was so worrying.

"Cyber attacks are disrupting our citizens, businesses and economy, and this year’s survey puts the risks we face into sharp focus. .... Cyber Security Minister Feryal Clark

Cyber attacks are revealing to citizens, businesses and economies the lies and deceit of leaderships as they strive to hide and deny the deep truth of their operations in favour of the fanciful catalogue of half-truths needed to conceal and reinforce their tenuous grasp on rapidly emerging realities all too easily able to render them pariah and in fear of their future existence.

And if richly earnt, who would deny that they be certainly deserving of all that awaits around every corner for them.

[sitta_europea]

From the report:

"Sole traders and public-sector organisations are outside the scope of the survey. In addition, businesses with no IT capacity or online presence were deemed ineligible. "

Hmmmm.