The Future Of Ransomware Is In The Cloud

The cyber security lanscape is evolving and many businesses don’t understand how to keep their defences  up-to-date. While major corporations can spend as much as $1 billion a year, many small companies may not have the budget to hire a cybersecurity vendor to help them keep up with all the technology available needed to deter hackers. The loss of just a few thousand dollars can be devastating and hackers don’t discriminate when casting a wide net. 
 
Hackers are mining for data, passwords and other bits of information that can open the door to a company’s assets. Email scams, password and login theft, malware and ransomware are a;; among the cybercriminals’ primary weapons. 
 
Cyber security threats have been contantly growing in 2019, according to a new report by Crypsis Group, an incident management and digital forensics company. The Crypsis 2020 Incident Response and Data Breach Report, which found that cyber criminals have “significantly escalated tactical approaches” and become more targeted in their actions. 
 
Ransomware attacks and business email compromise (BEC) were the two most impactful cyber threats in 2019 with ransomware demands up  200% last year, and BEC fraud losses averaged $264,000 per incident. 
 
Software as a Service (SaaS) is being increasingly used and is a method of software delivery and licensing in which software is accessed online via a subscription, rather than bought and installed on individual computers. The Covid virus pandemic has forced businesses to start working from home on a massive scale, and SaaS platforms now have switched from being a matter of choice to a necessity. While the long-term advantages of this global switch are yet to be discovered, SaaS security threats are already out there. One of the most threatening is ransomware 2.0.
 
It's a new generation of attacks, using sophisticated types of ransomware, that spreads to the cloud and encrypts SaaS data of cloud services.
 
The average ransom payment was $41,000 in 2019, although yber liability insurance firms say that the  the real cost of a ransomware attack for a company with 50 employees has reached $73,000. This cost includes: Ransom fees, Forensics, Legal Fees, Fines and Penalties and Data Recovery payments. 
 
Ransomware has become a multibillion-dollar industry for cyber criminals, who to maximise their profits, are expanding to new  potential markets with a particular focus on the fast growing Cloud coputing sector.
 
Ransomware Criminals Are Targeting The Cloud 
Cyber-criminal new market opportunities. Many offline businesses are closed due to COVID-19, which reduces new opportunities for cyber-criminals. Phishing attacks are up 667% since the pandemic began. Cyber-criminals seem to be looking for new ways to generate revenue. Cloud services have become mission-critical apps for successful businesses. The spread of coronavirus will push companies to speed up their cloud adoption. Many organisations already can't imagine their business without cloud services. It’s only a matter of time until ransomware starts targeting cloud data.
 
A  Scenario For A  Cloud Ransomware Attack:
 
  • A user gets an email that looks like it was sent from their cloud service provider. It requires the user to click a phishing link to update an app.
  • A user installs a malicious app or a Chrome extension that requests a scope of permissions to access G Suite or Office 365 SaaS data.
  • Once permissions are granted, the app starts encrypting data directly in the cloud.
Ransomware that targets the cloud is here. and we can expect that in  the next one to two years, this evolution will  accelerate, with the emergence of a whole new generation of  ransomware.
 
Back Up Your Data. Use an independent cloud-to-cloud backup provider to back up your sensitive SaaS data to secure cloud storage. AWS, GCP and Azure are the most secure and trusted cloud storage services. Daily backup is a very important part of this process.
 
Protect Yourself Against Phishing. Deploy an anti-phishing monitoring solution. The majority of phishing emails are designed to run ransomware attacks.
 
Monitor Third-Party Apps. Deploy monitoring and risk assessment of the third-party apps installed by your employees, such as marketplace apps, chrome extensions, add-ons, iOS apps, Android apps, non-marketplace apps and any other apps that have access to your SaaS data. Some of the apps can be time bombs and run ransomware attacks when you never expect it.
 
It Important to Train Your Employees to Watch for Cyber Threats. Educate your employees by implementing security awareness training on a quarterly basis. Continue doing all the necessary data security work: Manage files’ permissions and access.  Outline clear security policies, and educate your employees on cyber security matters through corporate training.
 
Crypsis:     Forbes:     SC Magazine:     Insurance Business:      Arkanasa Business: 
 
Business need cyber security training and we at Cyber Security Intelligence recommend GoCyber training for all employees and management please contact Cyber Security Intelligence for a free trial.
 
You Might Also Read: 
 
Cyber Crime Methods Are Evolving:
 
Managing Your Cyber Security, Detection & Response:
 
 
« Blame The Boss For Cyber Attacks
Inside The Deep & The Dark Web »

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Tenable Network Security

Tenable Network Security

Tenable Network Security - The Rise of the Business-Aligned Security Executive. Is your security operation aligned with the overarching goals of the business?

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Security Service Supplier Directory

Cyber Security Service Supplier Directory

Free Access: Cyber Security Service Supplier Directory listing 5,000+ specialist service providers.

Code Decode Labs

Code Decode Labs

Code Decode Labs provides consulting for IT Technology, Cyber Security, Advanced Defense & Policing Technologies, Intelligent Networks, and Information Security.

ComSec LLC

ComSec LLC

ComSec perform threat assessments to identify vulnerabilities and help protect businesses against corporate espionage via electronic eavesdropping.

Ambersail

Ambersail

Ambersail provide Penetration Testing and Cyber Security Compliance services.

Milton Security Group

Milton Security Group

Milton Security develops products to provide security, visibility and control over your network to keep it Operational and Secure.

Karlsruhe Institute of Technology (KIT)

Karlsruhe Institute of Technology (KIT)

KIT is a leading research and education institutions with strong capabilities in information systems and security.

Norwegian Center for Information Security (NorSIS)

Norwegian Center for Information Security (NorSIS)

NorSIS) is an independent organization that works to increase knowledge and understanding of information security for businesses and individuals.

Compass Security

Compass Security

Compass Security is a specialist IT Security consultancy firm based in Switzerland. Services include pentesting, security assessments, digital forensics and security training.

CyNation

CyNation

CyNation is an Integrated Risk Management company focused on managing the risks inherent in supply chains and third-party ecosystems.

SecureBrain

SecureBrain

SecureBrain software and services help protect against Japanese-specific cybercrime and global internet security threats such as online fraud, phishing, drive-by downloads and malware attacks.

SecureAppbox

SecureAppbox

SecureAppbox provide solutions that protects the communication of sensitive data as well as advice on data security and compliance with GDPR.

ThreadStone Cyber Security

ThreadStone Cyber Security

ThreadStone Cyber Security offer reliable, practical and affordable cyber security solutions for both large and smaller organizations that we develop and deliver ourselves from Europe.

Cybersecurity Professionals

Cybersecurity Professionals

Search vacancies from top cyber security jobs worldwide on CyberSecurity Professionals. View IT security jobs or upload your CV to be seen by recruiters from industry leading firms.

ArmorText

ArmorText

ArmorText offers a seamless channel for communication and collaboration for organizations concerned with keeping communication data private and secure.

Griffeshield

Griffeshield

Griffeshield is a company specialised in new information technologies used to protect Intellectual Property.