Semperis Ransomware Risk Report Highlights Alarming Trends

Uploaded on 2024-07-31 in TECHNOLOGY--Hackers, NEWS-Cybersecurity News, FREE TO VIEW

A new report from Semperis, a leader in identity-driven cyber resilience, reveals a troubling escalation in ransomware attacks, with 78% of victim organisations paying ransoms and 74% suffering multiple strikes, often in rapid succession.

The 2024 Ransomware Risk Report study is based on a global survey of 900 IT and security professionals, underscores the persistent and evolving threat of ransomware, emphasising the need for robust identity system protection and a proactive "assume breach" mindset.

Released on July 30, 2024, the report provides critical insights for business, IT, and security leaders navigating this growing cyber menace.

The report highlights ransomware’s transformation from a sporadic threat to a relentless, orchestrated assault. Criminal groups exploit vulnerabilities, particularly in identity systems like Microsoft Active Directory (AD), to launch multiple attacks, sometimes simultaneously. A staggering 54% of organisations hit by multiple attacks experienced them on the same day, with most occurring within a week. Simon Hodgkinson, Semperis Strategic Advisor and former bp CISO, notes that these rapid, successive strikes exploit organisations’ weaknesses, leading to closures, lay-offs, revenue losses, and cancelled cyber insurance policies. The financial toll is immense, with collateral damage often exceeding ransom costs, including operational downtime, reputational harm, and, in some cases, risks to human health and safety.

One of the most concerning findings is the high rate of ransom payments, driven by pressures to restore operations quickly. However, paying ransoms offers no guarantee of recovery - 49% of organisations that paid failed to receive usable decryption keys or recover their assets.

Many respondents cited cyber insurance, especially in the IT/telecom sector, as a factor in their decision to pay, while others prioritised avoiding threats to customers, patients, or business reputation. Yet, as the report warns, ransom payments often fund further attacks, with malware embedded in ransomware reinfecting systems. This cycle of breaches underscores the futility of relying on payments as a solution.

Recovery times remain a significant challenge, with 49% of organisations needing one to seven days to restore minimal IT functionality and 12% requiring a week or more. Prolonged recovery increases the likelihood of paying ransoms, as businesses face mounting pressure to resume operations.

The report identifies inadequate identity system backup and recovery practices as a common point of failure.

While 70% of respondents reported having an identity recovery plan, only 27% had dedicated, AD-specific backup systems. Without malware-free backups and tested recovery plans, organisations face extended downtime, exacerbating financial and operational impacts. Chris Inglis, Semperis Strategic Advisor and former U.S. National Cyber Director, emphasises that cybersecurity is a business issue, requiring board-level accountability and a collective effort to build resilience.

The report also reveals strategic shifts in attacker behaviour, with 72% of ransomware attacks targeting weekends or holidays when staffing is reduced. Despite 96% of organisations maintaining 24/7 Security Operations Centres (SOCs), 85% scale back after-hours staffing by up to 50%, and nearly 5% leave SOCs unstaffed during these periods. Attackers exploit these gaps, striking when defences are weakest, such as during mergers, acquisitions, or lay-offs. Mickey Bresman, Semperis CEO, advocates for automated identity protection and recovery solutions to bolster resilience during vulnerable periods. Kemba Walden, former Acting U.S. National Cyber Director, adds that organisations must embed resilience into their networks to combat relentless ransomware threats.

A lack of board-level support emerges as a significant barrier to ransomware resilience, with most respondents citing insufficient executive backing as their biggest challenge.

Inglis stresses the need for a three-pronged approach - corporate doctrine, skill-building, and technology - starting with boards recognising cybersecurity’s business implications. Regulatory bodies, including the SEC, increasingly hold boards accountable, reinforcing that cybersecurity is not solely an IT concern. The report urges leaders to prioritise identity-first security, explaining its value in business terms to secure investment and support.

Semperis’ findings call for a paradigm shift toward proactive defence. The report advocates embracing an "assume breach" mindset, assuming a constant state of threat and preparing accordingly. This includes implementing robust AD security and recovery tools, conducting real-world recovery testing, and maintaining 24/7/365 SOC coverage with automated threat detection. Jeff Wichman, Semperis Director of Incident Response, emphasises that SOCs should operate at least 75% capacity during off-hours, supported by automation to counter calculated attacker tactics.

Semperis' report sends an alert to organisations everywhere, highlighting ransomware’s devastating impact and the urgent need for enhanced cyber resilience. By focusing on identity system protection, board-level engagement, and continuous vigilance, businesses can better defend against this unrelenting threat.

Semperis | Semperis

Image: Unsplash

You Might Also Read:

Why DevOps Security Must Be On Every Leader's Agenda:

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.