Whether to pay off an online extortionist is one of the most divisive issues for security experts It is the most divisive question you can ask security experts: Should paying off a protection fee ever be included in your portfolio of potential responses to extortionists. Even those experts who thought paying should be an option didn’t like to admit it. Others said it’s asking to be extorted again. The worst possible response is to pay when you have no control over the situation. In that caseand experts have watched this happenthe extortionists simply take the money and keep attacking you.“It irritates the hell out of me that I would have to think about paying, and it makes my skin crawl, but I would say you’d have to have that option in your back pocket,” says Ira Winkler, president of Internet Security Advisors Group. “If you’re unprepared and they’re ready to inflict a significant amount of damage, you have to consider it.”“Paying off is buying time; that’s it,” says Bob Weaver, former Department of Homeland Security deputy director and now part of consultancy Stroz Friedberg. “You’d better reconcile with the business that you’re shaking hands with the devil. You’d better bring in law enforcement. Better yet, have a preexisting relationship. Because all paying will do is maybe reduce the risk for a while. It does nothing to get rid of the risk.” -S.B. Related content news analysis Companies are already feeling the pressure from upcoming US SEC cyber rules New Securities and Exchange Commission cyber incident reporting rules don't kick in until December, but experts say they highlight the need for greater collaboration between CISOs and the C-suite By Cynthia Brumfield Sep 28, 2023 6 mins Regulation Data Breach Financial Services Industry news UK data regulator warns that data breaches put abuse victims’ lives at risk The UK Information Commissioner’s Office has reprimanded seven organizations in the past 14 months for data breaches affecting victims of domestic abuse. By Michael Hill Sep 28, 2023 3 mins Electronic Health Records Data Breach Government news EchoMark releases watermarking solution to secure private communications, detect insider threats Enterprise-grade software embeds AI-driven, forensic watermarking in emails and documents to pinpoint potential insider risks By Michael Hill Sep 28, 2023 4 mins Communications Security Threat and Vulnerability Management Security Software news SpecterOps to use in-house approximation to test for global attack variations The new offering uses atomic tests and in-house approximation in purple team assessment to test all known techniques of an attack. By Shweta Sharma Sep 28, 2023 3 mins Penetration Testing Network Security Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe