The Ransomware Attack That Exposed Shadow IT
A mid-sized UK law firm suffered a ransomware attack that encrypted client files and demanded a £500k ransom. The firm's IT team discovered that the attack originated from a marketing employee's personal Dropbox account, which she used to share large files because the firm's email limit was 10MB. The firm had no visibility of this shadow IT usage. The firm's backup strategy was to copy files to an external hard drive every Friday, which was also encrypted by the ransomware because it was connected to the network. The firm has cyber insurance covering £1m, but the insurer requires evidence of 'reasonable security controls'. The firm's partners are debating whether to pay the ransom (which is not illegal in the UK but may breach sanctions if the attackers are state-sponsored) or to restore from backups. The IT manager wants to implement a new data loss prevention (DLP) system and block all personal cloud services. The managing partner is concerned about the cost and the impact on lawyer productivity, as lawyers often use personal devices.
1. Assess the security failures that led to the ransomware attack and evaluate the proposed DLP and blocking approach. Recommend a more balanced set of controls, considering the firm's business needs.
Read the worked answer
Security failures: (1) Lack of visibility and control over shadow IT – employees used personal cloud services because corporate tools were inadequate (10MB email limit). (2) Inadequate backup strategy – offline backups were connected to the network, so they were encrypted; backups should be immutable and offline. (3) Lack of employee awareness – the employee did not follow policy (if one existed) or there was no policy. (4) Possibly weak access controls and patching. The proposed DLP and blocking all personal cloud services is a blunt instrument that may drive shadow IT further underground and harm productivity. A balanced approach: (a) Provide a corporate file-sharing solution with adequate capacity and security (e.g., enterprise-grade cloud storage) to meet business needs; (b) Implement DLP with a focus on sensitive data, but allow personal cloud for non-sensitive data with monitoring; (c) Educate employees on risks and acceptable use; (d) Implement a 3-2-1 backup strategy with at least one immutable offline copy; (e) Segment networks and apply least privilege; (f) Consider endpoint detection and response. Regarding ransom: do not pay, as it encourages crime and may breach sanctions; restore from backups if possible. The firm should also review its cyber insurance requirements and document controls. The managing partner should be advised that productivity concerns can be addressed by providing better tools, not by blocking.
2. Discuss the ethical and legal considerations of paying the ransom, and how the firm should decide.
Read the worked answer
Paying the ransom is not illegal under UK law per se, but it may breach sanctions if the attackers are affiliated with a sanctioned entity (e.g., OFSI rules). The firm must screen the attacker against sanctions lists. Ethically, paying ransom funds criminal activity and may encourage further attacks. The firm should consider its fiduciary duty to clients to protect their data, but also its reputation. The decision should be made by the partners, with legal advice, and documented. The firm should notify the ICO if personal data was breached (likely, given client files). The NCSC advises against paying. The firm should first attempt restoration from backups, and if not possible, consider paying only as a last resort, with law enforcement involvement. The decision should be based on a risk assessment: likelihood of data recovery, potential sanctions breach, and reputational impact. The firm should also inform its cyber insurer.