A new report from the Ransomware Task Force — what we once called blue-ribbon panel of cybersecurity experts and non-profit organizations — was released last week. It has a long list of recommended actions to try to reduce this scourge. And while it is great that the tech industry has made the effort, it is largely misplaced.

The co-chairs of the various committees say right up front that tackling this problem won’t be easy, there aren’t any silver bullets to fix it, and no single entity has the needed resources to make much of an impact. Many of the recommendations concern actions by the federal government to try to stop it, I think public/private partnerships are going to see more success here.

Here are a few of their suggestions that captured my attention.

Action #2.1.2 recommends that cryptocurrency exchanges and other operators to follow the same “know your customer” and anti-money laundering rules as regular financial institutions, and aggressively targeting those exchanges that do not. This would restrict criminals from cashing out their ransom payouts. I think this is a worthwhile goal, but not sure how it could be enforced or even identified. There is always some semi-shady operator that will skirt the rules. Still, perhaps some crypto blogger or analyst could offer a summary of those operators that make more effort and those that just pay lip service to these very basic rules.

Action #2.3.1: Increased government sharing of ransomware intelligence with the private sector.

Action #4.2.2: Create a standard format for ransomware incident reporting.

These are both good suggestions. There are already common threat reporting formats, such as STIX and Taxii, that are used to share threat intelligence that are machine-readable and easily fit into automation solutions. But there are two issues: First, will victims be required to report incidents? Many times we only hear about attacks months or years later and many never come forward at all. Or victims post some rather gauzy information-free notices. The second issue is who will act as the central repository of this information. That brings up the following:

Action #4.2.1: Establish a Ransomware Incident Response Network.

This is another good idea. The only issue is who is going to be in charge. Part of the problem in infosec is that we have far too many organizations that overlap or operate at cross-purposes. MITRE would probably be my first choice: it is the keeper of other cybersec threat data.

Action #4.1.2 Create a federal cyber response and recovery fund to help state and local governments or critical infrastructure companies respond to ransomware attacks. This approach would be similar to the Terrorism Risk Insurance Program, which was enacted after 9/11 and has been used, albeit, infrequently, since then. It provides for a shared public and private compensation for certain insured losses resulting from a certified act of terrorism that is split 90/10 between the federal government and insurers. It could be tricky to implement, because having a definition of a ransomware attack might prove to be even more difficult than having a definite terrorist incident.

One part of the report that I found helpful and instructive was an appendix that describes the cyber insurance market, including a summary of common policy components and why you might need them. There are a series of suggestions to help improve insurance underwriting standards too, I would urge anyone who is reviewing their own corporate cyber policies to take a closer look at this portion of the report.

The report concludes with these dire words: “Ransomware actors will only become more malicious, and worsening attacks will inevitably impact critical infrastructure. Future attacks could easily combine techniques in ways that cause the infections to spread beyond their intended targets, potentially leading to far-reaching consequences, including loss of life.”