Ransomware: To Pay or Not to Pay? The results of what IT professionals recommend

Abstract

The number of ransomware attacks has been on the rise. Ransomware is a malware attack in which the cybercriminal encrypts a file or a device and then demands a payment from the victim. There are many different variants of ransomware, and they continue to evolve. The number of IoT devices has been increasing over the years. IoT devices also face a considerable challenge from ransomware. In this study, a survey was administered to 27 Information Technology (IT) professionals. They were asked if they would recommend an organization attacked by ransomware to pay the ransom. The data collected from the professionals was analyzed, and the results indicated that only 4% would pay. Furthermore, the number of those who would not pay or were not sure was evenly divided at 48%. Moreover, the results indicate that the decision to pay or not to pay is difficult even for IT professionals with many years of experience in the field. The literature review revealed that the decision whether to pay or not to pay is a business decision. Some factors to consider when choosing to pay or not pay were presented. The use of cybersecurity insurance with ransomware coverage is recommended. Practices that can prevent ransomware attacks were covered and they include educating users, backups, and multi-layer security.