Transcript
This transcript has been edited for clarity.
Mathew Schwartz: Hi. I’m Mathew Schwartz with Information Security Media Group. It is my pleasure to be sitting down again with Jen Ellis, the founder of NextJenSecurity. Jen, welcome.
Jen Ellis: Hey, Mathew, thank you for having me.
Mathew Schwartz: Really happy to have you. We’re in London.
Jen Ellis: Overlooking the river.
Mathew Schwartz: Overlooking the river. It’s a beautiful day. What could be better?
Jen Ellis: Right?
Mathew Schwartz: Except also talking about cybersecurity
Jen Ellis: Have we solved it? Is that why it’s such a beautiful day?
Mathew Schwartz: Exactly. Yes, we can all go home now. The future of CVE is well in hand. No more legislation is required, and there’s never been any trouble anymore with this thing called ransomware.
Jen Ellis: Right, no absolutely.
Mathew Schwartz: Speaking of we’re here in the U.K., and they’re grappling with ransomware. They’ve seen a couple of attacks over the last 5, 10, 12 months.
Jen Ellis: We’ve had an interesting few months.
Mathew Schwartz: Yeah, yeah. Anyone who you know isn’t a Jaguar Land Rover, it’s maybe been a little personal for them. And you know, when it starts to get personal, we start to see the government get pretty involved, personal on the economy front, I should say, for the government and for the rest of us. Then, well over a billion in fallout estimated from just that Jaguar Land Rover attack.
Jen Ellis: And a huge supply chain impact.
Mathew Schwartz: Exactly. So, very topical, very top of mind, especially for a lot of lawmakers. One of the responses, not just to that attack, because it was already in the wind, is what to do about ransomware. Yes, possibly, possibly, I emphasize, outline, the payment of ransoms, at least by things like hospitals or public bodies or maybe anybody.
Jen Ellis: Absolutely. So the consultation the U.K. Government put out actually gave options of who it would apply to, so it’s unclear yet which direction they’re going, because they haven’t come out with something to say publicly where they’re going. So it’s possible that it would just be an economy-wide ban. It’s possible that it would be companies above certain size, or that it would be specific sectors, as you said, you know, critical infrastructure and government, etc. I think it will be broader than that, is my guess. But it’s purely speculative. And you know, I think there is a debate here on how impactful a ban will be. I mean, for sure it will have impact. Whether it will stop attacks, I’m less convinced by. We will see.
Mathew Schwartz: Well, you often see lawmakers saying, this is a problem, we’ve passed a law – and there’s no magic wand they can wave.
Jen Ellis: There is not.
Mathew Schwartz: And the attackers, wherever they’re located, say, teenagers in London area, teenagers or older in Russia, they’re not necessarily going to go, oh, the U.K. is off, off our targeting list now.
Jen Ellis: Yes, I mean, also, it’s not really how the internet works, is it? I mean, you know, when we saw, for example, Maersk and Merck getting caught up in NotPetya. Not that NotPetya was a ransomware attack, before anyone writes in. But they weren’t really targeting those specific companies. And yes, they got hit because they did business in Ukraine, but nonetheless, it does show how these things spread, right?
So I’m not wildly convinced. I think the bottom line here is that U.K. companies will continue to be appealing targets, because we’re relatively wealthy nation. We have a high degree of reliance on digital infrastructure, and we have an adversarial relationship with a number of governments that provide safe harbors. And then on top of that, we also have homegrown attackers who have their own ax to grind or who want to make a name for themselves at home by targeting big brands here.
And so I think none of that goes away. I think all that happens is it becomes much harder for victims.
On the flip side, I think there is a view that some people have where they would like to be able to say, “We cannot pay because the government won’t let us,” right? It does enable them to say that not only to the attackers, but also to their shareholders, to their customers, right? Like it’s not our fault that we haven’t done this? Right?
Mathew Schwartz: “Our hands are tied.”
Jen Ellis: Yes, and I also think we have to there is a this is one of those situations where there is an ethical implication here of funding crime that you do have to take into consideration. So the fact that it won’t necessarily stop the crime isn’t necessarily reason not to have the ban, right? Like, there is still an element there. But then you also have to think about the fact that what you’re doing is mandating the behavior of victims, rather than mandating the behavior of the attackers. That’s not great.
Mathew Schwartz: No. I mean, you see in the States, for example, the FBI has been really good about getting agents on site for organizations that have gotten hit. And I’ve heard from ransomware incident responders that this has helped drive the thinking of the board or the CEO in a direction that isn’t just, “Let’s pay, just in case.” So that’s been really useful. I don’t know if there are analogs elsewhere. I mean, the FBI as an institution and entity is obviously very American. You know, you don’t hear about the NCA necessarily, deploying, always to victims, but you hear less about that. I think a lot of organizations say we are working with the NCSC.
Jen Ellis: I think it depends. One, I think that NCSC gets involved whenever it makes sense to. They can’t do everything, right? We are resource constrained, and by the way, the FBI do not get involved with everything, but they are also a much larger force, and they have more regional representation, right? There are field offices of the FBI across the U.S. I think NCA is a little bit more limited in what it’s able to do, but I think for sure, I mean, you know the fact that we have seen very quick arrests around TfL, around M&S and around JLR, is a sign that they are very engaged. They’re working hard on this. They’re working with regional police around the U.K. It’s not just NCA, and I think NCSC does get involved, but their remit is specifically to focus as much as they can on critical national infrastructure and government. So they’re not necessarily going to be involved with everything, but they also do get involved in the ones that have the greatest impact on economy.
So you can bet that they’ve been involved with the big ones we’ve seen in the U.K.. So I don’t think it’s a lack of getting involved. I will say I think a lot of the decision making over whether or not to pay is more readily influenced by both insurance companies, if you have cyber insurance, which you may not – you know market adoption in the U.K. is still relatively low, or your law firm, they will also be advising you on what you can and can’t do and what you should and shouldn’t do.
So I think companies in these situations will look to a lot of different sources to get advice. And I think ultimately they’ll also try and figure out, like, what is the most practical thing for their particular situation based on their customer climate, their shareholder climate, basically what the tolerance is for not paying, or what the tolerance is to pay. Because lots of people will have an ethical problem with it. But likewise, a lot of people want to see a business up in business up and running as possible.
Mathew Schwartz: I’ve also spoken to victims where the data that got exposed was especially sensitive. Yes, maybe it involved children. And they maybe don’t want to pay, but they did, because there were children involved, and it’s very hard to fault them for that.
Jen Ellis: Yeah, and we also see now a bit of a rise of a more litigious environment here. So we’ve seen class actions around Co-op and M&S. And I think this is one of those things where if people have suffered real, tangible harm, then absolutely they should have an opportunity for recourse, particularly to cover whatever expenses they themselves have incurred through no fault of their own.
However, I think we do need to think about what harm really looks like, and what we mean by that.
Simply having your PII exposed is not the same as experiencing harm, in my view. Now, if something happens because of that and you can prove that that relationship occurred, that’s a different thing. But I think we have to think about whether this rise of class action suits is likely to limit how much people want to then be upfront and transparent about what’s going on, which doesn’t you know, security by obscurity doesn’t really benefit anybody, let’s be honest, other than the attackers who love it.
Mathew Schwartz: Well, there’s still a real dearth of information about what happened, when it happened.
Jen Ellis: And that’s one of the other parts of the government proposal. So there are three elements to it. The first is a payments ban. The second is something that they call payments reductions. I can’t remember. Basically, it’s that if you get hit, even if you’re not in the category that has a ban, you have to go to the government and ask permission.
Mathew Schwartz: Like vetting, basically?
Jen Ellis: Yeah, it’s designed to basically figure out whether, like, if the people that you would be paying a sanction for that kind of thing. And then the third category is, as you were saying, it’s the incident reporting requirement. And I think the incident reporting requirement will be broad. Again, they’ve not confirmed and they gave options in the consultation, but I suspect it will be fairly broad. I think it will be for organizations of other certain sizes. I doubt it will be sector-specific, and that hopefully will start to up-level the amount of information and visibility we have into what’s really going on.
Mathew Schwartz: So some of that sounds like a slam dunk from a defensive standpoint about the information sharing. For example, yeah, do you think there is a chance the ban will or won’t happen, still? I mean, it seems pretty contentious.
Jen Ellis: I think it will happen. I think we will probably hear more about it in the early-ish part of this year. That feels like approximately the right timeframe from when they came out with their response to the consultation and said, “This is what we heard.” I think, really, the U.K. government, so there’s three major things, really, that they’re working on. I mean, there’s lots of things they’re working on, but for cyber there’s, there’s three. There’s the Cyber Security Resilience Bill, which has had its first reading in the House of Commons. There is the new National Cyber Security Action Plan. And then there’s this, and the timeline on CSRB and the action plan means that they’re sort of higher up in the they’re further along in the life cycle process. So I suspect what will happen is on the ransomware stuff, they will let those things clear through before they kind of come through with the ransomware thing. I think it’s just a bit of a cleaner message if they do it that way, rather than having everything come at once.
Mathew Schwartz: Well arguably better, I mean, ransomware, it has been evolving quite a bit lately. Yeah, we’ve seen a real change in focus. I mean, you and I were speaking before about how it was much more of a national security threat before, and there’s been a shift toward more data exfiltration, which changes the equation, perhaps slightly.
Jen Ellis: Yeah. I don’t know that it’s true everywhere. I think if you look at, for example, the rise of DragonForce, it’s demonstrably in the other direction, right? It’s still disruption-based attacks. I think it is true in certain places. So we see in the U.S., there’s been a real swing away from disruption-based attacks and towards data-exploitation-based attacks. And we did see that in the U.K. We saw that over the past couple of years, but then we’ve gone back to disruption-based attacks, and I think a part of that is the nature of who the attackers are and what their goal is. The thing that people need to remember is that Scattered Spider are anomalous. They are not the norm that we see. We’ve heard a lot about them, and therefore it’s easy to think that they’re the new normal, but they are still an anomaly, a very important anomaly that we should totally pay attention to. But they aren’t representative of the whole.
Mathew Schwartz: And if you’re trying to craft policy –
Jen Ellis: You have to look at all of it.
Mathew Schwartz: To tell signal versus noise?
Jen Ellis: Absolutely. And I think in reality, it’s actually quite hard to craft policy that would deal with a situation like Scattered Spider. I think actually the best thing you can do in that situation is exactly what they’re doing, which is make arrests quickly and move those arrests through the through the judiciary process, which they are doing. And we have to hope that that will do its job as a deterrent over time. So I think it remains to be seen whether the U.K.’s, I think they will move forward with their proposals. I’m less confident on what impact the proposals will have.
Mathew Schwartz: Well, it’ll be interesting to see them move their way through. It sounds like it’s going to be a fun 2026.
Jen Ellis: Oh, it’ll be an interesting one, for sure.
Mathew Schwartz: Well, Jen, always a pleasure to sit down with you.
Jen Ellis: Likewise.
Mathew Schwartz: Thank you for bringing me up to date on just a few of the things.
Jen Ellis: Yes, just a few things going on.
Mathew Schwartz: On the cybersecurity front. Look forward to catching up again soon.
Jen Ellis: Yeah, likewise. Thanks very much.
Mathew Schwartz: Thanks. I’ve been speaking with Jen Ellis, founder of NextJenSecurity. I’m Mathew Schwartz with ISMG. Thanks for joining us.