Threat Intelligence and Security Incidents
One-third of organisations are hit by ransomware attacks every week
More than 40% of IT professionals surveyed by Menlo Security said they worry that ransomware will exceed their knowledge and skills.
Ransomware has become more prevalent and complex, which poses a huge challenge to organizations. A report released Wednesday by security vendor Menlo Security reveals the obstacles organizations face as they strive to protect themselves against the latest wave of ransomware attacks.
How often do IT leaders experience ransomware?
Among respondents to the report, one-third said their organizations are hit by ransomware attacks at least weekly, with 9% reporting more than one attack per day. Over the past 18 months, more than half (53%) of organizations have been victims of successful ransomware attacks.
The top three entry points where ransomware gained a foothold in reported attacks were email (54%), desktop browsers (49%), and mobile devices (39%). Other entry points for ransomware attacks include social media, USB devices, physical security breaches, and social engineering. However, 17% of respondents who reported attacks within the past 18 months could not determine how attackers breached their organization.
The Biggest Ransomware Challenges Facing IT Professionals
When asked about the biggest challenges to protecting their companies from ransomware, 35% of respondents cited evolving threats, while 34% pointed to remote workers. About 43% of respondents said they believe employees are the weakest link in their cybersecurity chain. With the rise of remote and hybrid work, security professionals now face the challenge of incorporating unmanaged devices into their security strategies.
About 41% of respondents said they worry that a ransomware attack will exceed their own knowledge and skills, while 39% worry that a ransomware attack will exceed their organization's security capabilities.
Security teams rely on a variety of tools and techniques to try to combat ransomware attacks and other threats.
Ransomware Attack Response
How do IT decision makers respond to ransomware attacks? Nearly half (45%) said they implement data backup and recovery plans, 39% attempt to determine the impact and damage of the attack, 37% isolate all affected endpoints, 37% notify employees, and 33% notify affected customers. About 29% said they would contact the CEO or board and wait for a response, while 10% said they did not know what to do as a first step.
To pay or not to pay the ransom is always a critical issue in an attack. About 65% of respondents said they would pay the ransom, 31% said their insurance company should pay, and 18% said the government should pay. More than a quarter (27%) said they would never pay a ransom. Of all the professionals surveyed, one-third said they would worry about paying a ransom and not being able to get their data back.
An increasing number of companies are turning to cyber insurance to help cover the financial costs of ransomware attacks or other breaches. Among respondents, 76% said they have cyber insurance, 17% did not know if they had it, and 7% said they did not. But insurance payouts are not necessarily enough to cover all losses. Respondents said they believe the average cost of a ransomware attack is about $326,000. Insurance payouts averaged $556,000. However, according to data from Sophos, the average cost of recovering from an attack in 2021 was $1.4 million.
To better protect your organization from ransomware attacks, Mark Guntrip, Senior Director of Cybersecurity Strategy at Menlo Security, offers some advice.
"The best time and place to prevent a ransomware attack is before the initial intrusion occurs," Guntrip said. "If the threat can be prevented at this point, it means the rest of the attack kill chain never happens. Companies can ensure that attackers are not on their network and that they don't suffer from additional reinfection. This is a shift from the detection and remediation mindset popular today (EDR, MDR, XDR, etc.) to a mindset of true prevention rather than rapid detection."
SecOps Validation recommends that enterprises proactively prevent ransomware attack incidents by validating the effectiveness of their defense systems before an intrusion occurs. The SecOps Security Metric Validation Platform helps enterprises accurately assess their defense capabilities with visual and quantitative data results by simulating real cyber attack techniques. In response to ransomware, SecOps Validation has also launched a ransomware defense assessment service to help you perform a technical assessment of your ransomware defense capabilities. As shown in the figure below, our assessment service covers all attack phases of the entire ransomware attack kill chain, identifying risks for enterprises at each attack phase.
Ultimately, our assessment report provides recommendations for resolving or mitigating each risk.
| Reference Source:
