Last week, the United States Conference of Mayors adopted a resolution against paying ransoms. What’s interesting about this is it’s creating what is essentially a vertical front of communities against ransomware. It may well disincentivize attackers from targeting US towns and cities. I’m hopeful and encouraged by this action, but I worry that this resolution is a dismissal of culpability and should have been about investing in cybersecurity before a ransomware outbreak, instead of advertising that we’d rather jump on a sword than pay a ransom.
I’ve been writing about the need for ransomware victims to prioritize their self-interest and consider paying ransom if they can establish that the actor will credibly provide decryption keys and that recovery would be discernably less costly in doing so. One of the common responses I’ve received in this regard is that I’m encouraging the creation of a ransomware market because the act of paying ransoms encourages more actors to get involved in this space — supply and demand.
…
https://go.forrester.com/blogs/the-rising-tide-of-ransomware-requires-a-commitment-best-practices/
