Winning the Ransomware Lottery

Ransomware is a growing threat to individuals and enterprises alike, constituting major factor in cyber insurance the security planning of every organization. Although game theoretic lens often frames as competition between equals -- profit maximizing attacker loss minimizing defender reality many situations that ransomware organizations are not playing non-cooperative game, they lottery. The wanton behavior attackers creates situation where victims hit more than once by operators, sometimes even same group. If defenders wish combat malware, must then seek remove incentives it. In this work, we construct an expected value model based on data from actual attacks identify three variables: payments, cost attack, probability payment. Using model, consider potential manipulate these variables reduce motive associated with attack. Based present mitigations encourage environment hostile operators. particular, find off-site backups government for their adoption most fruitful avenue combating ransomware.