Reference no: EM132634076

One of the most basic concepts in the field of Information Security is the CIA Triad or CIA Triangle. CIA stands for Confidentiality, Integrity, and Availability. Denial of Service (DoS) attacks challenge the "Availability" of a system or data. This could be temporary (e.g., a SYN Flood Attack that renders a web server unavailable during the attack) or permanent (e.g., the deletion or destruction of the data).

The latter of these has become increasingly common in the case of "ransomware" which is malware that encrypts all of the data on an infected system and the administrator is notified that if they don't pay a ransom by a certain date that the key to decrypt the data will be permanently deleted. While the temporary attacks may be less destructive, they are often done against systems that generate a lot of money (such as e-commerce websites) or at times when they are most needed (e.g. Black Friday). Often these attacks come from overseas and, for individual cases, there may be little the police can do.

While there are ways to mitigate the effects of such attacks such as firewalls and filters at the network edge or even in the service provider network, often the best way to address any attack on availability is through redundancy - i.e., alternate paths, backup systems, data backups. Unfortunately, many organizations realize this too late.

QUESTION: If a business received a ransom demand under the threat of a ransomware threat to destroy all of the data or a DDoS attack on a day where the servers were generating $1,000/minute in online sales, would you pay? What would go into your decision making process? What if you don't have a backup plan?