Catherine Lotrionte's guest appearances

Catherine Lotrionte

The Cyberlaw Podcast

ITSPmagazine

Alan Cohn

Chris Krebs

Scott Charney

Zulfikar Ramzan

Mikko Hypponen

Michael Daniel

Andrew Smith

Matthew Green

Shane Harris

Robin Smith

Kathleen Smith

Omar Khawaja

Adam Levin

Jeff Bezos

David Cross

OwlTail

Adam Hickey

Stewart Baker

What do we think about this cybersecurity strategy? We wait for an attack to happen, then we respond to the threat by paying a criminal organization to get out of the trouble. Does it seem like a good one? Probably not, especially when it is illegal to do so. Let's discuss. Ransomware is a digital attack against an individual or organization that holds data and/or systems hostage until a payment is received. Like many other forms of cybercriminal activity, this is on the rise, affecting our society at large. If and when this happens, the options in front of the victim are generally:- Restore the system/data from a known good backup - Pay the ransom and go back to normal — (hopefully, assume the criminal honors the “agreement”)- Don't pay and experience the consequencesThe FBI discourages organizations from paying ransomware, and now the Department of Treasury has declared that paying ransoms is illegal and violates OFAC regulations. Seemingly this puts boards—and the conversation in and around evaluating risk—in a very precarious situation. The consideration around this and the balance of fiduciary responsibility depends on the organization: a manufacturing company vs. a hospital, for example, and what data is being held. However, it still squarely could disrupt the natural flow of risk considerations for Boards.How about cyber insurance? Can we just skip prevention because there is a cure? Probably not.Beyond the illegality of the payment, there's also the idea that the funds paid don't just land in the pocket of an individual criminal actor looking to buy a new sports car. It most probably supports international crime and nation-state activities such as funding human trafficking or nuclear weapon research and development.Also, why is this still a problem in 2021? Why can’t we win here?Listen in to this group of experts as we try to figure that out. Maybe we solved the problem. Maybe not. Guest(s)Dr. Catherine Lotrionte, CSIS Technology Policy ProgramAdam Hickey, US Department of JusticeStewart Baker, Steptoe &amp; Johnson LLPResourcesRSAC 365 Session: Understanding Response Risk Relative to Ransomware and DoT GuidelinesDept. Of Treasury Ransomware Advisory: https://home.treasury.gov/news/press-releases/sm1142FBI Position on Ransomware: https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/ransomwareRSAC 365 Virtual Summit: https://itspm.ag/virtual-summit-d0974This Episode’s Sponsors:BlackCloak: https://itspm.ag/itspbcwebTo see and hear more The Cyber Society content on ITSPmagazine, visit:https://www.itspmagazine.com/the-cyber-societyAre you interested in sponsoring an ITSPmagazine Channel?https://www.itspmagazine.com/podcast-series-sponsorships

What do we think about this cybersecurity strategy? We wait for an attack to happen, then we respond to the threat by paying a criminal organization to get out of the trouble. Does it seem like a good one? Probably not, especially when it is illegal to do so. Let's discuss. Ransomware is a digital attack against an individual or organization that holds data and/or systems hostage until a payment is received. Like many other forms of cybercriminal activity, this is on the rise, affecting our society at large. If and when this happens, the options in front of the victim are generally: - Restore the system/data from a known good backup  - Pay the ransom and go back to normal — (hopefully, assume the criminal honors the “agreement”) - Don't pay and experience the consequencesThe FBI discourages organizations from paying ransomware, and now the Department of Treasury has declared that paying ransoms is illegal and violates OFAC regulations. Seemingly this puts boards—and the conversation in and around evaluating risk—in a very precarious situation. The consideration around this and the balance of fiduciary responsibility depends on the organization: a manufacturing company vs. a hospital, for example, and what data is being held. However, it still squarely could disrupt the natural flow of risk considerations for Boards.How about cyber insurance? Can we just skip prevention because there is a cure? Probably not.Beyond the illegality of the payment, there's also the idea that the funds paid don't just land in the pocket of an individual criminal actor looking to buy a new sports car. It most probably supports international crime and nation-state activities such as funding human trafficking or nuclear weapon research and development.Also, why is this still a problem in 2021? Why can’t we win here?Listen in to this group of experts as we try to figure that out. Maybe we solved the problem. Maybe not. Guest(s) <a href="http://www.rsaconference.com/experts/catherine-lotrionte" rel="nofollow" target="_blank">Dr. Catherine Lotrionte</a>, CSIS Technology Policy Program<a href="http://www.rsaconference.com/experts/adam-hickey" rel="nofollow" target="_blank">Adam Hickey</a>, US Department of Justice<a href="http://www.rsaconference.com/experts/stewart-baker" rel="nofollow" target="_blank">Stewart Baker</a>, Steptoe &amp; Johnson LLPResources RSAC 365 Session: <a href="http://www.rsaconference.com/virtual-series/fds1-summit/agenda/understanding-response-risk-relative-to-ransomware-and-dot-guidelines" rel="nofollow" target="_blank">Understanding Response Risk Relative to Ransomware and DoT Guidelines</a>Dept. Of Treasury Ransomware Advisory: <a href="https://home.treasury.gov/news/press-releases/sm1142" rel="nofollow" target="_blank">https://home.treasury.gov/news/press-releases/sm1142</a>FBI Position on Ransomware: <a href="https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/ransomware" rel="nofollow" target="_blank">https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/ransomware</a>RSAC 365 Virtual Summit: <a href="https://itspm.ag/virtual-summit-d0974" rel="nofollow" target="_blank">https://itspm.ag/virtual-summit-d0974</a>This Episode’s Sponsors:BlackCloak: <a href="https://itspm.ag/itspbcweb" rel="nofollow" target="_blank">https://itspm.ag/itspbcweb</a>To see and hear more The Cyber Society content on ITSPmagazine, visit: <a href="https://www.itspmagazine.com/the-cyber-society" rel="nofollow" target="_blank">https://www.itspmagazine.com/the-cyber-society</a>Are you interested in sponsoring an ITSPmagazine Channel? <a href="https://www.itspmagazine.com/podcast-series-sponsorships" rel="nofollow" target="_blank">https://www.itspmagazine.com/podcast-series-sponsorships</a>

Understanding Response Risk Relative to Ransomware and DoT Guidelines | Don’t Pay, Can’t Pay, What Next | A Conversation With Dr. Catherine Lotrionte, Adam Hickey, And Stewart Baker

In our seventy-fourth episode of the Steptoe Cyberlaw Podcast, Stewart Baker, Jason Weinstein, and Michael Vatis discuss: China’s new security law; FTC settles with a virtual currency mining app makers; This Week in Hacks: FBI report ties Anthem and OPM hack; Anthem class action filed; OPM class action; FTC releases new security guidance; Foreign Intelligence Surveillance Court reauthorizes metadata program; WikiLeaks rolls out more alleged NSA docs; Russia modifies its right to be forgotten bill. In our second half we have an interview with Catherine Lotrionte, Associate Director of the Institute for Law, Science and Global Security at Georgetown University. The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Interview with Catherine Lotrionte