One way the corporation can be impacted negatively by attackers is by encrypting data hosted on the corporation’s systems and withholding access to the decryption key unless a ransom is being payed. Encryption can be achieved with the Data Encryption card (T1486).
Any compromised asset with the Data Encryption card should be replaced with this Encrypted Asset card.
The ransom is to be determined by the attacker, although the defender may want to negotiate the price. If a backup server is present, the corporation may opt for removing the server from stage and recover the data back.
The name of the card
|
Encrypted Business Asset |
|---|---|
|
The card type
|
Business Asset card type |
|
Whether this card was meant to be played as part of another card
|
|
|
Whether this card must be trashed after being player or not
|
Play once |
|
Whether a certain requirement must be met before this card can be played
|
|
|
The ATT&CK tactic this card belongs to
|
|
|
The ATT&CK technique this card belongs to
|
|
|
Amount of bitcoins the player needs to pay in order to play this card
|
|
|
The amount of bitcoins the player needs to play to retreat this card
|
|
|
Cards that will counter this card
|
|
|
How rare this card is
|
High |