{"id":20047,"date":"2021-11-19T20:10:24","date_gmt":"2021-11-19T20:10:24","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=20047"},"modified":"2021-11-19T20:10:24","modified_gmt":"2021-11-19T20:10:24","slug":"companies-get-better-at-fighting-ransomware","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/threats\/companies-get-better-at-fighting-ransomware\/","title":{"rendered":"Companies Get Better at Fighting Ransomware Despite Escalating Threats"},"content":{"rendered":"

In a year in which ransomware<\/a> attacks seem to get worse by the day, companies have made surprising progress defending themselves against attacks.<\/p>\n

But the attention paid to the malware<\/a> by journalists, cybersecurity vendors and increasingly, government agencies<\/a>, has pushed companies to improve their preparedness to defend themselves against ransomware gangs, according to a report this week by security solutions vendor Cymulate.<\/p>\n

That preparedness has led to a reduction in the damage done by some of these attacks and in the amount of downtime they cause, giving organizations some hope at a time when they feel vulnerable and under assault, Cymulate officials said.<\/p>\n

\u201cThe survey data indicates that, while everyone may be a target, most of those who are hit are doing an excellent job defending themselves and recovering gracefully,\u201d the authors of the report, Ransomware Study: Unexpected Reasons for Optimism<\/a>, wrote. \u201cWhen taking a closer look at the damages incurred by the respondent victims of an attack, overall, they suffered limited damage both in severity and duration, with over half the respondents proactive enough to stop the attack before it could cause any damage, and the vast majority of those even before it could cause any downtime.\u201d<\/p>\n

Companies Invest More in Security<\/h2>\n

For the report, Cymulate queried 900 IT professionals worldwide and found that 28 percent of companies had been the victim of a ransomware attack over the last few years and in 70 percent there had been an increased awareness among top executives and business managers of the threats that ransomware pose<\/a>. Overall, more than half of all companies are investing more in security budgets and headcount and almost half are creating new or modified incident response<\/a> plans.<\/p>\n

In addition, 82 percent said they are adopting offensive cybersecurity solutions.<\/p>\n

\"ransomware
Ransomware protection spending (source: Cymulate)<\/figcaption><\/figure>\n

Where the greatest optimism comes in is in what tends to happen when a company is hit with ransomware, according to the report. Among the respondents, 55 percent said they suffered no damage after experiencing a ransomware attack, and another 26 percent said they only lost a few systems. Only 19 percent said their business went down or that they sustained considerable damage.<\/p>\n

About 68 percent of respondents said their business didn\u2019t go down or did for a few hours. Others said their businesses were down for a few days (19 percent), a week (8 percent) or longer than a week (6 percent).<\/p>\n

\"Ransomware
Ransomware damages (source: Cymulate)<\/figcaption><\/figure>\n

Overall, organizations are spending more on budget and staff, upgrading incident response planning, spending more on security products and procedures and are being more aggressive in their protections, from penetration testing<\/a>, breach and attack simulations<\/a> and attack surface management, according to the report.<\/p>\n

\u201cParadoxically, ransomware\u2019s ill-gotten fame might be pushing the development of security measures covering other potential dangers,\u201d the authors wrote. \u201cConcern about ransomware is felt by all, and the result of fear is increased budget and resources that are invested in improving security posture management. Though ransomware is at the source of these security posture improvements, the end-result is a better defense against all types of attacks.\u201d<\/p>\n

Also read: Best Backup Solutions for Ransomware Protection<\/a><\/p>\n

Threats Evolve Too<\/h2>\n

The results reflect what some others in the cybersecurity industry are seeing, although most agree that any optimism needs to be tempered by the realization that ransomware isn\u2019t going anywhere and that just as vendors and enterprises are getting better at defending against it, bad actors also are evolving.<\/p>\n

\u201cAs organizations move forward on their journey towards cloud transformation, there\u2019s a lot of resilience that comes along for the ride,\u201d Tim Wade, technical director for the CTO team at Vectra, told eSecurity Planet<\/em>. \u201cThe farther along we get in this journey, the more I would expect to find pockets for encouragement with respect to organizational resilience.<\/p>\n

“The challenge [is] that adversaries haven\u2019t fully adopted their tactics to exploit the speed and the scale that the cloud offers their own disruptive operations,” Wade said.\u00a0“For organizations that still haven\u2019t shaken off the \u2018set and forget\u2019 mindset of legacy IT, they\u2019ll get bitten again. But for organizations that have internalized the need for their core security strategy to emphasize visibility, detection and response, I expect this positive trend is the down payment on a more resilient future.\u201d<\/p>\n

Chris Morgan, senior cyber threat intelligence analyst at DigitalShadows, said he agrees that awareness of the threat posed by ransomware is starting to pay off for larger and well-resourced companies, but that bad actors also will target smaller organizations that may not have the same resources and people.<\/p>\n

Also read: Best Ransomware Removal and Recovery Services<\/a><\/p>\n

Damage and Downtime<\/h2>\n

Morgan also told eSecurity Planet<\/em> that it\u2019s difficult to comment on damages and downtime.<\/p>\n

\u201cMost companies impacted by a ransomware attack will likely aim to provide only the minimal amount of information surrounding an attack to reduce the reputational and regulatory impact that might follow,\u201d he said. \u201cTransparency following such incidents is rare, but refreshing given that added context and insights can greatly assist incident responders and security researchers.\u201d<\/p>\n

He also pointed to a report last month from ThycoticCentrify<\/a> that found as many as 83 percent of victims of ransomware attacks have paid the ransom, adding that \u201cgiven that such a high percentage reportedly concede to attackers’ demands, it’s likely that the damages and downtimes have not become any less impactful.\u201d<\/p>\n

Threats Continue to Accumulate<\/h2>\n

Cymulate\u2019s report noted that the U.S. Treasury Financial Crimes Enforcement Network said that in the first half of the year, more than $590 million in ransoms were paid, more than the $416 million paid during all of 2020. With that type of money being paid, ransomware is too lucrative for cybercriminals to move away from.<\/p>\n

Just this week, cybersecurity firm Sophos detailed a new Python ransomware called Momento<\/a>, which locks files in a password-protected archive if the ransomware itself can\u2019t encrypt the targeted data.<\/p>\n

In addition, Russian ransomware gangs reportedly may be looking to collaborate with Chinese hackers<\/a>, according to a report from cybersecurity vendor Flashpoint.<\/p>\n

It\u2019s a continuing cycle of cybersecurity professionals and cybercriminals acting and reacting to what the other side is doing, according to OJ Ngo, co-founder and CTO of network security firm DH2i.<\/p>\n

\u201cRansomware attacks are an important bullet point for many modern corporations,\u201d Ngo told eSecurity Planet<\/em>. \u201cFortunately, companies are getting better at mitigating ransomware attacks by strengthening their HA\/DR [high availability\/disaster recovery] plans.\u201d<\/p>\n

With such hardware and software solutions in place, as seen in the Cymulate report, downtime and damages are being reduced, he said.<\/p>\n

\u201cIt\u2019s a never-ending cat-and-mouse chase,\u201d Ngo said. \u201cBut organizations are getting better and better at establishing and following security best practices, such as offering internal risk education and mitigation courses to employees and doing regular security audits [and] drills. As long as we continue to take these attacks [and] issues seriously, we all can move forward.\u201d<\/p>\n

Further reading: Cybersecurity Mesh, Decentralized Identity Lead Emerging Security Technology: Gartner<\/a><\/p>\n\n\n

\n \n\n \n\n
\n \n <\/path>\n <\/svg>\n <\/div>\n \n
\n
\n

\n Get the Free Cybersecurity Newsletter <\/h3>\n \n \n

\n Strengthen your organization's IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday <\/p>\n <\/div>\n\n

\n
\n \n Email Address\n <\/label>\n \n <\/div>\n\n
\n
\n \n \n By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time. <\/label>\n <\/div>\n <\/div>\n \n