Should MSPs Pay Ransomware Demands?

When impacted by ransomware, prevention is the best course of action for the MSP. What I mean is, MSPs should be a position where they can defend against ransomware more easily and quickly than the rest of the business community. After all, MSPs are IT professionals and should be taking all the necessary and reasonable precautions to prevent a ransomware attack and infection. If infection occurs, the MSP should be capable of quickly restoring itself to operational status.

Saying that no MSP will ever be affected by ransomware (or other cyberattacks) is not realistic. However, recovering from such attacks should be part of every MSP's business continuity and disaster recovery planning.

Customer Response

Customers are more likely to find themselves victims of ransomware attacks. More importantly, these same customers are also less likely to be prepared for such a cyberattack and less capable of restoring to operational status quickly.

While we place a higher standard of care on MSPs, end-user organizations have a much more difficult path ahead. MSPs have always had to play "catch-up" with their customers when it comes to training and educating them on proper cyber hygiene. As more customers deal with the impact of cybercrime, the faster they should evolve when it comes to protecting themselves against cyber attacks. This cyberattack prevention necessarily includes allowing their MSPs to backup data, test data restoration regularly, and implement relevant cybersecurity policies and procedures.

Should You Pay Ransomware?

According to the Federal Bureau of Investigation, the answer is no. In a public service announcement issued in October of 2019:

"The FBI does not advocate paying a ransom, in part because it does not guarantee an organization will regain access to its data. In some cases, victims who paid a ransom were never provided with decryption keys. In addition, due to flaws in the encryption algorithms of certain malware variants, victims may not be able to recover some or all of their data even with a valid decryption key."

I tend to agree with this statement. Not paying is the best long term strategy against cybercriminals. First, it will permanently foreclose any option involving the "cooperation" of the cybercriminal. Involving the cybercriminals in assisting with data restoration is dubious, at best, according to the FBI.

Second, not paying ransomware will properly place the responsibility on the customers (and MSPs) to begin safeguarding networks and systems. Continuing to pay cybercriminals will encourage them to continue their attacks and will not correct the behavior of the customers to modify their behavior.

This is a long term strategy, and MSPs need to be involved with their customers in having these discussions. MSPs need to also safeguard themselves from the business impact of customers who do not take cybercrime seriously. We are all in this together.

These are my thoughts. I'd love to hear your thoughts.