On June 2, 2021, President Biden issued a memorandum providing "recommended best practices" for protecting against ransomware. The memorandum urged corporate executives and business leaders to:
These are practical, high-level tips, and leave many questions for companies to answer in examining their cybersecurity posture. How broadly should encryption be used? How much logging should be done? How often should backup data be synched, backups tested, and incident response plans rehearsed? How often should third-party tests be done, and how extensive should they be? How segmented must networks be? The answers require the same risk-based approach already in use by most top companies.
But the president's June 2 memorandum is noteworthy for at least two reasons beyond the substantive advice. First, the memorandum's direct appeal to the private sector illustrates not only the importance of addressing ransomware but also the hands-on approach this administration intends to take with cybersecurity matters. With high-profile ransomware attacks recently grabbing headlines across the nation, cybersecurity generally - and ransomware in particular - has become an issue of general concern for the American public. This memorandum only underscores that point.
Second, regulators and litigants may point to the memorandum to argue that it sets forth a standard of care that organizations must adhere to when it comes to cybersecurity. The efficacy of that argument will depend on any given matter and its unique facts, but given the increasing frequency of government investigations and/or litigation in the wake of a cyberattack, organizations should consider the possibility that an adversary will scrutinize their security posture relative to this memorandum.
So what should organizations do to guard against cyberattacks generally and ransomware in particular? In light of the White House's memorandum, it is especially worthwhile to: