Ransomware: Businesses Are Well Equipped But Underprepared

In a landscape where cybersecurity attacks are now inevitable, being underprepared is a recipe for disaster. Yet, despite the media being filled with cautionary tales of persistent malicious actors and unsuitable cyber defences, organisations have proven themselves seriously underprepared when it comes to recovering from one of today’s most prolific attack types: ransomware.

In a recent study by IDC and Kyndryl, which surveyed businesses with over 500 employees from a variety of sectors, 69% of respondents had suffered at least one successful ransomware attack in the last 12 months, and nearly a third had paid $50,000 to $100,000 to regain access to their data.

Only 28.2% of this group said they were able to recover their encrypted data from backup using the tools they already had, therefore not having to pay the ransom. Even more worryingly, 8% said that they could not recover all their data, regardless of whether they paid the ransom or not.

So, despite high-profile attacks targeting every industry, why are businesses still leaving themselves vulnerable?

The Illusion Of Preparedness

There are two ways to look at why enterprises are underprepared for ransomware. The first is the decades-long trend of consolidating infrastructure to high data availability platforms, and the second is the existence of increasingly stringent Service Level Agreements (SLAs) intended to govern that infrastructure. 

The lean towards consolidation is a necessary one as it has enabled data to move more freely through organisations and their networks, and it has motivated increased investment in clustering and storage replication, which guarantees high available easy access to this information. Though these highly replicated environments have unfortunate consequence in that it can rapidly propagate ransomware attacks from logical data corruption events.

As the infrastructure sees newly encrypted data, which the attacker intends to hold to ransom, as something which needs to be preserved, it can result in the attack propagating rapidly and all servers becoming encrypted.

In addition, the use of SLAs as a sign of preparedness can make an organisation vulnerable - while a dashboard full of green lights showing successful backups and data consistency can seem like a positive sign, it’s only impactful for some forms of risk. Successful backups do not always equal successful recovery, so these SLA’s need to cover both backup and test recovery if they are to provide confidence to an organisation.

But the outlook isn’t all negative - given the well-publicised nature of ransomware as a cyber threat, rates of adoption for tools like malware scanners, cyber tolerant backup and recovery software, and zero trust methodologies have been encouraging.

Yet, knowledge gaps remain in how these technologies are configured and managed, meaning they often cannot deliver what these businesses want and need if an attack strikes. 

Ransomware Recovery, The Right Way

To create a system that’s built to handle modern ransomware attacks, businesses need a Cyber Tolerant Recovery Solution that meets a few key attributes. The first is introducing an air gap to act as a firebreak for the propagation of compromised data during an attack, ensuring that backup data is physically separated from production data. Then, these backups should be stored in an environment with immutability and retention lock, which stops data from being changed or expired by a cyberattack once committed to disk. 

Next, verification is vital before triggering a recovery process from backup data. Using an anomaly scanner can detect indicators of compromise to improve defence against them. Then finally, all data storage and protection efforts are useless unless they help the business get back on its feet faster, and with less financial damage, than by paying the ransom. Therefore, organisations must be able to manage mass recovery and the handling of traffic tens of times greater than normal backup workloads.

Many businesses are already prioritising security investments in response to the rise in ransomware, so focus should be on adding to and reconfiguring their security, rather than outright replacing it.

To expand and improve data recovery capabilities, a holistic approach should be taken. This means identifying critical server and data volumes and which systems they are stored in, and pinpointing the systems that need to be recovered first, according to their unique business tolerance timelines. The business’ tolerance for data loss must be considered, given its huge effect on the cost of implementing a data recovery solution.

Lastly, organisations cannot forget data in cloud and SaaS solutions, as they are equally as vulnerable. Only by truly understanding its capability to recover data in the event of a ransomware attack can businesses adopt a comprehensive approach, allowing them to protect and recover more data, faster.

Duncan Bradley is Director of Customer Engagement, UKI Cyber Resiliency Practice at Kyndryl 

Image: Shubham Dhage

You Might Also Read:

Reimagining Your Cyber Infrastructure:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Cyber Attack On Georgia's State Government
Elections 2024 - Fake News & Misinformation   »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

NICE Systems

NICE Systems

NICE Systems provide software solutions to ensure compliance, fight financial crime, and safeguard people and assets.

AFCERT

AFCERT

AFCERT is the national Computer Emergency Response Team for Afghanistan.

Subex

Subex

Subex leverages its award-winning telecom analytics solutions in areas such as Revenue Assurance, Fraud Management, Asset Assurance and Partner Management, and IoT Security.

Seavus

Seavus

Seavus is a software development and consulting company with a proven track-record in providing successful enterprise-wide business solutions including Managed Security Services.

DigiSec360

DigiSec360

DigiSec360 is a technology firm focused on the human element of cybersecurity.

N8 Identity

N8 Identity

N8 Identity helps organizations realize the vision of Autonomous Identity Governance™ with AI-driven Identity solutions.

Across Verticals

Across Verticals

Across Verticals is a boutique cyber security consulting firm that specializes in holistic, deeply technical and end to end cyber security advisory services based on industry best practices.

FoxTech

FoxTech

FoxTech is an independent, friendly and deeply specialised cyber security company in the UK, with expertise spanning decades of Public Sector and Government services.

HolistiCyber

HolistiCyber

HolistiCyber provide state-of-the art consulting, services, and solutions to help proactively and holistically defend against a new era of constantly evolving cyber threats.

Cybertronium

Cybertronium

Cybertronium is a leader in managing cyber risk. We bring you the latest from the complex, ever-evolving online threat environment with the insights to inspire and the expertise to act.

TotalAV

TotalAV

TotalAV Antivirus is a free-to-use app packed with all the essential features to find and remove malware, keeping you safe.

Hexens

Hexens

Hexens introduces a whole new approach to cybersecurity solutions. Indisputable skills and a unique super-focused perspective on every single case are the values we create.

StrongBox IT

StrongBox IT

Strongbox IT provides solutions to secure web applications and infrastructure.

Foresiet

Foresiet

Foresiet is the first platform to cover all of your digital risks, allowing enterprise to focus on the core business.

Hive

Hive

Hive is a leading provider of cloud-based AI solutions to understand, search, and generate content, and is trusted by hundreds of the world's largest and most innovative organizations.

Prizsm Technologies

Prizsm Technologies

Prizsm is a computational storage capability that provides flexible, easy-to-use, resilient solutions for quantum-resistant, hyper-secure cloud storage and communications.