Exclusive: 'Bad guys aren't so bad' as cryptomining is a sign of conscience

Ransomware wreaked havoc on the world in 2016 and 2017, but recent studies show that it has been usurped as the cybercrime method of choice.

Cryptomining surged to popularity on the back of the meteoric rise of cryptocurrencies, with reports from Comodo and Sophos (among others) proving it has overtaken ransomware.

At the recent SolarWinds MSP Empower MSP event held in Amsterdam, I had the chance to sit down with SolarWinds MSP VP security architecture Tim Brown who spoke about the cybercrime landscape as a whole and what he thinks of cryptomining's ascent.

"Cryptomining as an exploit when compared to other available methods isn't so harmful. I think it's a sign that the bad guys aren't so bad and don't want to cause harm unless necessary. The problem is that those machines that have been hacked for cryptomining could have easily been infected with ransomware or financial trojans, among many others," says Brown.

"That machine is owned and therefore can take another role next time. Depending on what the miner did, the level on compromise on the device might be very benign and some of them are really good in only taking around 10 percent of your processor! They're designed not to disrupt, firstly to avoid detection but I believe also to cause less harm.

Brown believes that with the imminent GDPR just around the corner, we will see a lot more breaches publicised – not necessarily because cybercriminals are becoming more prominent, but simply because they will be obliged to.

"Already businesses are disclosing a lot more than what they used in the past, as we've seen the negative impact of not disclosing in cases like Equifax and Uber. The original mindset for many was 'what can we get away with', but now businesses are realising that if they hide details then it's going to get a lot worse," says Brown.

"Recently there have been some information disclosures where the system was just compromised, undoubtedly a result of the aggressive cryptomining that is going on. In the past the question that businesses would then ask was 'if our system gets exposed to one of those, do we really have a breach as no data was stolen?' This is why I see breach disclosures to increase.

I then asked Brown about how businesses can protect themselves against internal threats, as they can spend infinite amounts of money on cybersecurity against external threats, but often the biggest breaches come from the inside.

"What you do is put controls in place so that very few single people can do full amounts of harm to your business. For example, a business that needs to provide updates to millions of end points can only do so with the permission of a number of people, not a single person. This effectively means the key to the 'crown jewels' are guarded by a team," Brown says.

Brown also shared an interesting solution for the internal security conundrum that he is yet to implement with his team at SolarWinds MSP, but one that he would like to put in place in the near future.

"For people that have more access, you treat them specially. I'm a big fan of compensating and watching my 'crown' people more. I want to be able to take those people that need very high levels of access like my system admin and monitor their internal and external activities - and pay them 10 percent more for the hassle," says Brown.

"To ensure the safety of our business, you have to give up some of your privacy but in return I will pay you more. That's the world we now live in.