While a total ban on ransom payments to hackers remains “the ultimate goal” for cybersecurity experts, critical infrastructure organizations need stronger cybersecurity resilience before that happens, former acting National Cyber Director Kemba Walden told lawmakers on April 16.
During testimony before the House Financial Services Subcommittee on National Security, Illicit Finance, and International Financial Institutions, Walden – who is now president of the Paladin Global Institute — told lawmakers that imposing a complete ransom payment ban would not stop hackers, but it could hurt critical infrastructure operators, particularly those in the small and medium-sized business arenas.
“If we banned ransomware payments today, we could bankrupt the very small- and medium-sized businesses that the American economy relies upon. Think rural hospitals that serve four or five municipalities – those can go bankrupt,” Walden said.
Walden also offered that the current economic equation of ransomware attacks also argues against an immediate ban on ransom payments.
“The profits are still too high, and the costs are still too low,” said Walden. “So, we need to shift that balance, and there are a number of policy options that we can take in order to get to the point where profitability is no longer a motivator for ransomware actors.”
Walden and other witnesses at the hearing urged Congress to approve and increase cybersecurity funding for critical infrastructure entities, particularly small and mediums-sized businesses.
“What we need to do is prepare for the worst … prepare those organizations to be more resilient against ransomware attacks,” said Walden.
She also advised that the Federal government bolster intelligence sharing and analysis with big tech firms and blockchain forensics experts in a bid to combat foreign ransomware threats.
Testifying alongside Walden was Megan Stifel, chief strategy officer at the Institute for Security and Technology. She echoed Walden’s testimony and voiced her support for increased government cybersecurity funding for those entities.
“Unfortunately, often those who are cyber poor are targeted for these types of incidents which, oftentimes, can drive these organizations out of business,” Stifel said. “And with small businesses being the lifeblood of the American economy, they do need additional support.”
