Why Are Businesses Still Falling Victim To Ransomware?

A recent survey determined that 80 per cent of organisations were victims of ransomware attacks in 2021, and more than 60 per cent of the businesses paid the ransomAs these figures have become all too common, it is important to look at why businesses still find themselves at risk of ransomware attacks.

Industry expert and ex-FBI cyber crime Supervisory Special Agent Jason Manar, now Chief Information Security Officer at Kaseya, addresses the following questions

Despite the vast amount of data security information available, why do businesses continue to find themselves vulnerable to ransomware attacks?:      

Attackers prey on employees, as well as those that have access to the company’s systems using social engineering and phishing techniques. Additionally, many bad actors combine these tactics by using social media platforms to obtain additional information about their victims. To combat ransomware attacks, businesses need to provide ongoing end users with security training to ensure they don’t become the company’s weakest link. In addition to the human factor, organisations should have security tools in place that baseline the network and limit administrative access, even at the local level. It’s also critical to stay on top of patching. 

What can companies do to improve their security systems and proactively combat ransomware?   

Proactive measures companies can take include instituting educational programmes, implementing a regular patching policy, limiting administrative accounts, provisioning administrative users, and auditing administrative accounts. It’s equally important to have appropriate security tools in place, and to avoid running on legacy or unsupported systems. Additionally, organisations should run regular security and pen tests, and enact a strong password security policy which enables multi-factor authentication (MFA) and ensures lengthy, complete passwords. In addition, companies need to keep browsers up-to-date to prevent adversaries from installing keyloggers. Offline backups should also be standard practice with a system in place to determine how often these are done. 
 
Paying ransom goes beyond the money, it’s also about business suspension and reputational damage if the attack becomes public knowledge. How do you educate organisations about the risks?

Unfortunately, there are too many worst-case scenarios where companies have lost everything, and they then go out of business. I can share examples that have not been publicised of people repeatedly saying, “we’re going to get to it,” and then put off implementing ransomware preventative measures, which inevitably leads to having to deal with the dire consequences of the attack. Developing and implementing robust security policies and guidelines is fairly simple, as well as cost effective. By taking these actions, companies can mitigate risk in the event they are intruded upon.
 
What advice would you give to a CFO?

Any C-Suite member should have security top-of-mind and understand that the lack of security in an organisation is one of the most existential threats that an institution faces that could potentially lead to immediate dissolution of the company. 

The CFO should meet regularly with the company’s CISO or security leader to understand the top threats and vulnerabilities facing the organisation, and jointly make decisions about security funding that are aligned with the highest risks and impact. 

What advice would you give to a CIO?

The one-piece of advice would be to overcommunicate and collaborate with the CISO. The primary responsibility of the CIO is to ensure the functionality and continuity of IT operations. Equally important to the CIO’s primary duties are to ensure they keep a security-first mindset. This is important as it may seem easier for the IT team to institute policies, which lean more to convenience vs. security.  

What advice would you give to a CEO? 

“Where you lead, they will follow,” meaning every security policy that is in place for employees are also there for the CEO, and everything starts from the top down. People are going to scrutinise every action, or lack thereof, that the CEO makes regarding their own personal security practices. If a CEO doesn’t participate, typically there won’t be a security-first culture within that organisation. As CEO, you need to show employees that you take cybersecurity seriously. This means doing the cybersecurity training like everyone else and engaging with both the security team and employees, so they see you are engaged. It’s important to set an example so that employees see that meeting the requirements and standards set forth by the company are a top priority.

Unfortunately, the rewards for cybercriminals have become greater than the risks. To this end, they are continually developing new and innovative ways to leverage inherent network infrastructure weaknesses.

To lessen the impact of ransomware attacks and subsequent payments, organisations must remain vigilant and take proactive measures such as securing the network and prioritising cybersecurity training for all employees. 

Jason Manar is Chief Information Security Officer at Kaseya.

You Might Also Read:

Building a Threat-Ready Ransomware Response Plan:

 

« CISA Reports No Significant Attacks On US Elections
International Fraud Awareness Week: Every Individual Has A Part to Play »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Digital Gurus Recruitment

Digital Gurus Recruitment

Digital Gurus provide specialist recruitment services in areas including IT and information security

Academic Centres of Excellence in Cyber Security Research

Academic Centres of Excellence in Cyber Security Research

The ACE-CSRs scheme is part of the UK Government’s National Cyber Security Strategy, working with academia and industry to make the UK more resilient to cyber attacks.

Claroty

Claroty

Claroty was conceived to secure and optimize OT networks that run the world’s most critical infrastructures.

Celestya

Celestya

Celestya is dedicated to providing the most advanced and cost effective systems for human behavior education on cybersecurity awareness training.

CyberSift

CyberSift

CyberSift is a cyber security provider. We develop threat detection software which needs no infrastructure changes as it integrates with almost any security tool.

DFLabs

DFLabs

DFlabs is a pioneer in Security Automation & Orchestration technology, leveraging your existing security products to dramatically reduce the response and remediation gap.

MedCrypt

MedCrypt

MedCrypt are a team of medical device experts focused on bringing modern cybersecurity features to the next generation of healthcare technology.

Bridewell

Bridewell

Bridewell provide cost effective Security & Risk Assurance Services across Information Security, Cyber Security, Technology Risk, Security Testing and Data Privacy.

HacWare

HacWare

HacWare is a data driven cybersecurity awareness product that leverages machine learning and behavior analytics help IT professionals combat phishing.

Protected Media

Protected Media

Protected Media’s advanced cybersecurity ad fraud solution guards you against current and emerging threats across Connected TV, Display and Video advertising.

ESC - Enterprise Security Center

ESC - Enterprise Security Center

ESC is a system house specializing exclusively in IT security - Security Implementation & Optimization, Operations, Managed Security Services.

Ankura Consulting Group

Ankura Consulting Group

Ankura is a global expert services and advisory firm that delivers services and end-to-end solutions in a wide range of areas including cybersecurity and digital transformation.

gener8tor

gener8tor

The gener8tor Cybersecurity Accelerator offers a cutting-edge program in San Antonio, home to the second-largest concentration of cybersecurity experts in the United States.

CSIOS Corp.

CSIOS Corp.

At CSIOS we help our customers achieve and sustain information and cyberspace superiority through a full range of defensive and offensive cyberspace operations and cybersecurity consulting services.

Marcum Technology

Marcum Technology

Marcum Technology consultants are focused on helping you reach your company’s full potential by exploring creative ways to integrate tomorrow’s technology into your business today.

National Cybersecurity Agency (ACN) - Italy

National Cybersecurity Agency (ACN) - Italy

The ACN is the National Authority for Cybersecurity in Italy. the Agency promotes public-private initiatives to strengthen the national cybersecurity and resilience posture.