Data Science for Ransomware Defense and Negotiation

SANS Ransomware Summit 2023

Data Science for Ransomware Defense and Negotiation

Speaker: John Sturgis, Data Scientist, Cyentia Institute

In 2022, Cyentia published a two-volume series analyzing data behind nearly 1,300 ransomware incidents since 2019 in partnership with Arete Advisors—a global cyber risk management company specializing in ransomware negotiation. In volume 1 (Mitigating Ransomware’s Impact), we explored questions about typical ransom demands and payments, payment rates, percent demand paid, payment reasons, and more. We further analyzed potential influencing factors, such as the victim industry and the presence—or absence—of various defensive measures. Readers also benefit from firsthand accounts of investigators and negotiators in the trenches. Of particular interest to this crowd, volume 2 (Reining In Ransomware) investigated trends among prominent ransomware families, including their associated ATT&CK techniques, related mitigations, and how these may affect demand and payment amounts. I believe the audience would benefit from many of these data points, in essence by learning from others’ experiences. They can expect to be equipped with the data needed to effectively prioritize organizational protections, and—in the worst case—inform their own high-stakes negotiation strategies.