ILMA Compoundings December 2016 - 13

NOTES FROM AFPM

"I'll Take Ransomware
for $17,000"
Dan Strachan

O

n New Year's Day, some media groups will list the
terms and phrases that were popular during the
previous year. I would bet money that some of these
lists will include the term "ransomware."
Ransomware has been around for a while, but it made its public
debut this year at Hollywood Presbyterian Medical Center in
California. Malicious actors hacked into
the hospital's IT system and held it for
ransom. It was a de facto kidnapping
of the IT system. The hospital paid the
ransom of $17,000.
So, you ask yourself, how was an outside
entity able to "kidnap" an IT system?
Ransomware is a program that takes
control of a computer system by
encrypting all the information on it. It's
like someone changing all the locks in
your house and not giving you the new
keys until you hand over money. The
outside entity probably could hack into
the computer system through an open
port, a USB drive or a virus that was
downloaded.
Now, you might ask yourself, why this
particular hospital?
Answer: It was easy. This wasn't Mass
General or Johns Hopkins. This was
a small entity. I don't know anything
about Hollywood Presbyterian's IT
department, but I would bet money that
someone there thought they were too
small to be on any hacktivists' radar. They were wrong.
There are other examples of ransomware this year ranging
from fast food outlets to retail. An insurance industry report
finds that the ransoms sought from target companies remain
low, often in the region of $1,000. But these are not the only

costs incurred by companies that suffer attacks. Add to this
ransom payment the additional costs of system review and
mitigation (for a small company, this would mean hiring an
outside firm), downtime, supply-chain disruption and the
possible harm to the company's reputation with its customers
and suppliers, and the price tag is much higher than the
ransom.
I've said it in previous Compoundings
articles and will say it again: No
company is too small to be hacked into.
Companies must be on the defensive
and never rest on their laurels. Just
because you've never been hacked is no
guarantee that you will not be hacked
in the future. There are those out there
who see what happened at this hospital
and are thinking it is a great way to make
some money.
You should err on the side of caution
and assume hacktivists are looking at
your IT and maybe even your SCADA
systems. Ask yourself: Will they be able
to hack into your system? What would
happen if you couldn't access your IT
system because an outside entity has
encrypted it?
While the ransom seems very small, the
ramifications of this event need to be a
wakeup call. You are never too small to
be hacked.

Strachan is director, industrial relations and programs, for the
American Fuel & Petrochemical Manufacturers (AFPM). He may be
reached at 202-457-0480 or dstrachan@afpm.org.

Compoundings December 2016 * 13 * Vol. 66 No. 12
ILMA Compoundings December 2016

Table of Contents for the Digital Edition of ILMA Compoundings December 2016
