Ransomware: Businesses Are Well Equipped But Underprepared

In a landscape where cybersecurity attacks are now inevitable, being underprepared is a recipe for disaster. Yet, despite the media being filled with cautionary tales of persistent malicious actors and unsuitable cyber defences, organisations have proven themselves seriously underprepared when it comes to recovering from one of today’s most prolific attack types: ransomware.

In a recent study by IDC and Kyndryl, which surveyed businesses with over 500 employees from a variety of sectors, 69% of respondents had suffered at least one successful ransomware attack in the last 12 months, and nearly a third had paid $50,000 to $100,000 to regain access to their data.

Only 28.2% of this group said they were able to recover their encrypted data from backup using the tools they already had, therefore not having to pay the ransom. Even more worryingly, 8% said that they could not recover all their data, regardless of whether they paid the ransom or not.

So, despite high-profile attacks targeting every industry, why are businesses still leaving themselves vulnerable?

The Illusion Of Preparedness

There are two ways to look at why enterprises are underprepared for ransomware. The first is the decades-long trend of consolidating infrastructure to high data availability platforms, and the second is the existence of increasingly stringent Service Level Agreements (SLAs) intended to govern that infrastructure. 

The lean towards consolidation is a necessary one as it has enabled data to move more freely through organisations and their networks, and it has motivated increased investment in clustering and storage replication, which guarantees high available easy access to this information. Though these highly replicated environments have unfortunate consequence in that it can rapidly propagate ransomware attacks from logical data corruption events.

As the infrastructure sees newly encrypted data, which the attacker intends to hold to ransom, as something which needs to be preserved, it can result in the attack propagating rapidly and all servers becoming encrypted.

In addition, the use of SLAs as a sign of preparedness can make an organisation vulnerable - while a dashboard full of green lights showing successful backups and data consistency can seem like a positive sign, it’s only impactful for some forms of risk. Successful backups do not always equal successful recovery, so these SLA’s need to cover both backup and test recovery if they are to provide confidence to an organisation.

But the outlook isn’t all negative - given the well-publicised nature of ransomware as a cyber threat, rates of adoption for tools like malware scanners, cyber tolerant backup and recovery software, and zero trust methodologies have been encouraging.

Yet, knowledge gaps remain in how these technologies are configured and managed, meaning they often cannot deliver what these businesses want and need if an attack strikes. 

Ransomware Recovery, The Right Way

To create a system that’s built to handle modern ransomware attacks, businesses need a Cyber Tolerant Recovery Solution that meets a few key attributes. The first is introducing an air gap to act as a firebreak for the propagation of compromised data during an attack, ensuring that backup data is physically separated from production data. Then, these backups should be stored in an environment with immutability and retention lock, which stops data from being changed or expired by a cyberattack once committed to disk. 

Next, verification is vital before triggering a recovery process from backup data. Using an anomaly scanner can detect indicators of compromise to improve defence against them. Then finally, all data storage and protection efforts are useless unless they help the business get back on its feet faster, and with less financial damage, than by paying the ransom. Therefore, organisations must be able to manage mass recovery and the handling of traffic tens of times greater than normal backup workloads.

Many businesses are already prioritising security investments in response to the rise in ransomware, so focus should be on adding to and reconfiguring their security, rather than outright replacing it.

To expand and improve data recovery capabilities, a holistic approach should be taken. This means identifying critical server and data volumes and which systems they are stored in, and pinpointing the systems that need to be recovered first, according to their unique business tolerance timelines. The business’ tolerance for data loss must be considered, given its huge effect on the cost of implementing a data recovery solution.

Lastly, organisations cannot forget data in cloud and SaaS solutions, as they are equally as vulnerable. Only by truly understanding its capability to recover data in the event of a ransomware attack can businesses adopt a comprehensive approach, allowing them to protect and recover more data, faster.

Duncan Bradley is Director of Customer Engagement, UKI Cyber Resiliency Practice at Kyndryl 

Image: Shubham Dhage

You Might Also Read:

Reimagining Your Cyber Infrastructure:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Cyber Attack On Georgia's State Government
Elections 2024 - Fake News & Misinformation   »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

InformationWeek

InformationWeek

InformationWeek is the world's most trusted online community for business technology professionals like you.

AFCON Control & Automation

AFCON Control & Automation

AFCON is a leading global provider of software solutions and services for the smart management of Control & Automation systems in the age of Digital Transformation.

Assured Information Security (AIS)

Assured Information Security (AIS)

AIS is committed to providing our customers with critical information security products, services, and training. We support diverse needs throughout business and industry.

MAY Cyber Technology

MAY Cyber Technology

MAY Cyber Technology is a Security Management solutions provider located in Turkey & Germany.

Somansa

Somansa

Somansa is a global leader in Data Security and Compliance solutions designed to protect valuable company information from leakage and help meet regulatory compliance requirements.

Avira

Avira

Avira provide a portfolio of antivirus, security and performance applications for Windows, Android, Mac, and iOS.

Optimum Speciality Risks

Optimum Speciality Risks

Optimum Speciality Risks are an experienced team of cyber insurance experts, backed by Lloyds of London.

Business Resilience International Management (BRIM)

Business Resilience International Management (BRIM)

Business Resilience International Management (BRIM) is engaged by law enforcement in the UK and overseas to advise on establishing and developing Cyber Resilience Centres (CRCs) for business.

nsKnox

nsKnox

nsKnox is a fintech-security company, enabling corporations and banks to prevent fraud and ensure compliance in B2B Payments.

Cyberfort Group

Cyberfort Group

Cyberfort exists to provide our clients with the peace-of-mind about the security of their data and the compliance of their business.

SecurelyShare Software

SecurelyShare Software

SecurelyShare Software is a security software company, specializing in data security, data privacy and data governance.

Clarabot Nano

Clarabot Nano

Nano is the secure file sharing tool to improve content search, data access and collaboration between multiple parties.

TechMD

TechMD

TechMD (formerly ICS) is an award-winning IT solutions firm that specializes in cloud solutions, managed cybersecurity services, strategic IT consulting, and managed IT services.

Oak9

Oak9

Oak9's Security as Code platform dynamically secures Infrastructure as Code (IaC) and deployed cloud workloads, automatically.

M7 Services

M7 Services

M7 Services are a comprehensive Managed Services Provider (MSP) with a focus on delivering cutting-edge information technology solutions and unparalleled customer service.

Vantyr

Vantyr

Vantyr's core mission is to safeguard the business-led adoption of SaaS applications by automating the lifecycle management and security of non-human identities.