Rise in Ransomware Requires Strong Government Response, Executives Say
A rash of cybercrimes against companies and critical infrastructure requires a muscular response from the U.S. government, even as companies themselves must take steps to combat attacks, executives and cyber officials say.
Ransomware has become an intolerable situation in many nations, Kevin Mandia, chief executive of cybersecurity firm FireEye Inc., said during the WSJ Pro Cybersecurity Executive Forum on Wednesday.
“Pharmaceuticals, hospitals, healthcare, public companies, organizations that don’t have the talent and skills to defend themselves—they’re getting sucker punched,” Mr. Mandia said.
A ransomware attack on meat processor JBS SA is the latest incident showing how cyber hacks of major companies can ripple across the world. The meatpacker took a big chunk of U.S. beef-and-pork processing offline, sending buyers scrambling for alternatives and raising pressure on meat supplies.
The White House on Tuesday said the attack was part of a ransomware campaign by a criminal group that is likely based in Russia.
A May 7 ransomware attack on Colonial Pipeline Co. led to a six-day shutdown of the East Coast’s largest conduit for fuel, sparking scrutiny of pipeline security and pushing the Department of Homeland Security to prepare to issue first-of-their-kind cybersecurity regulations for the sector.
“It was a moment where I think a lot of America woke up to the reality that the cyber realm and the physical realm are becoming increasingly intertwined,” Rob Joyce, director of the National Security Agency’s cybersecurity directorate, said at the same conference.
Colonial paid a $4.4 million ransom to get code to unlock its data and systems, but the decryption tool wasn’t fully successful. The Federal Bureau of Investigation said that a criminal group known as DarkSide operating from Russia was responsible for the attack.
President Biden, in his June 16 summit with Russian President Vladimir Putin, must push for an agreement to rein in ransomware gangs, Mr. Mandia said.
To fight the cybercrime wave, the U.S. should pursue economic sanctions, technology protections and diplomacy, he said. “You gotta pull every lever on this one,” he said. “We have to impose repercussions and costs.”
White House deputy press secretary Karine Jean-Pierre said Tuesday that the Biden administration had launched a strategic review designed to combat ransomware, and that the White House has delivered the message that “responsible states do not harbor ransomware criminals.”
Part of the issue with the barrage of cybercrimes faced by public and private organizations isn’t just the immediate economic damage of a ransom, but the length of time it can take to recover from an attack, executives said.
The Scottish Environmental Protection Agency, for instance, still doesn’t have its systems fully operational more than five months after being attacked on Christmas Eve last year, CEO Terry A’Hearn said at the WSJ event. The agency, which didn’t pay the ransom, is completely rebuilding its systems, he said.
Likewise, the Colonial Pipeline shutdown resulted in fuel shortages across Southeastern states, and pushed gas prices to the highest point in six years.
Yet, ransomware is one aspect of what companies describe as a continuous assault of cyberattacks. Marene Allison, the chief information security officer at Johnson & Johnson, said at the WSJ event that the pharmaceutical giant experiences around 15.5 billion cybersecurity incidents a day. Not all are determined attacks, she said, but the volume is unrelenting.
“You will see attacks, whether it be through your email, through your systems, through your network, all day long. Twenty-four by seven from around the world,” she said.
International rules governing conduct among nations are outdated, Ms. Allison said, pointing to United Nations articles that specify ways a country can enforce its decisions or defend itself, short of armed military action. These include severing diplomatic ties or interrupting communications.
“Some of those were written when warships had to come to the U.S. and take a cannon and fire,” she said. “Today in cybersecurity, it’s much different.”
Officials say that countering cybercrime can’t just be left to the federal government, and that companies also have to take responsibility for their security.
“It isn’t always the extravagant attack that succeeds. It’s often very basic things where a door is left open that people exploit,” said Mr. Joyce of the NSA. His agency and others publish detailed information on attacks such as the breach of SolarWinds software because they hope the private sector will fix known weaknesses, he said.
Mr. Mandia of FireEye said that the volume of attacks arrayed against companies means future incidents are inevitable, despite best efforts to address cybersecurity weaknesses.
“Every slap shot is coming at us, and the puck is going to get through,” he said.
