Ransomware: Businesses Are Well Equipped But Underprepared

In a landscape where cybersecurity attacks are now inevitable, being underprepared is a recipe for disaster. Yet, despite the media being filled with cautionary tales of persistent malicious actors and unsuitable cyber defences, organisations have proven themselves seriously underprepared when it comes to recovering from one of today’s most prolific attack types: ransomware.

In a recent study by IDC and Kyndryl, which surveyed businesses with over 500 employees from a variety of sectors, 69% of respondents had suffered at least one successful ransomware attack in the last 12 months, and nearly a third had paid $50,000 to $100,000 to regain access to their data.

Only 28.2% of this group said they were able to recover their encrypted data from backup using the tools they already had, therefore not having to pay the ransom. Even more worryingly, 8% said that they could not recover all their data, regardless of whether they paid the ransom or not.

So, despite high-profile attacks targeting every industry, why are businesses still leaving themselves vulnerable?

The Illusion Of Preparedness

There are two ways to look at why enterprises are underprepared for ransomware. The first is the decades-long trend of consolidating infrastructure to high data availability platforms, and the second is the existence of increasingly stringent Service Level Agreements (SLAs) intended to govern that infrastructure. 

The lean towards consolidation is a necessary one as it has enabled data to move more freely through organisations and their networks, and it has motivated increased investment in clustering and storage replication, which guarantees high available easy access to this information. Though these highly replicated environments have unfortunate consequence in that it can rapidly propagate ransomware attacks from logical data corruption events.

As the infrastructure sees newly encrypted data, which the attacker intends to hold to ransom, as something which needs to be preserved, it can result in the attack propagating rapidly and all servers becoming encrypted.

In addition, the use of SLAs as a sign of preparedness can make an organisation vulnerable - while a dashboard full of green lights showing successful backups and data consistency can seem like a positive sign, it’s only impactful for some forms of risk. Successful backups do not always equal successful recovery, so these SLA’s need to cover both backup and test recovery if they are to provide confidence to an organisation.

But the outlook isn’t all negative - given the well-publicised nature of ransomware as a cyber threat, rates of adoption for tools like malware scanners, cyber tolerant backup and recovery software, and zero trust methodologies have been encouraging.

Yet, knowledge gaps remain in how these technologies are configured and managed, meaning they often cannot deliver what these businesses want and need if an attack strikes. 

Ransomware Recovery, The Right Way

To create a system that’s built to handle modern ransomware attacks, businesses need a Cyber Tolerant Recovery Solution that meets a few key attributes. The first is introducing an air gap to act as a firebreak for the propagation of compromised data during an attack, ensuring that backup data is physically separated from production data. Then, these backups should be stored in an environment with immutability and retention lock, which stops data from being changed or expired by a cyberattack once committed to disk. 

Next, verification is vital before triggering a recovery process from backup data. Using an anomaly scanner can detect indicators of compromise to improve defence against them. Then finally, all data storage and protection efforts are useless unless they help the business get back on its feet faster, and with less financial damage, than by paying the ransom. Therefore, organisations must be able to manage mass recovery and the handling of traffic tens of times greater than normal backup workloads.

Many businesses are already prioritising security investments in response to the rise in ransomware, so focus should be on adding to and reconfiguring their security, rather than outright replacing it.

To expand and improve data recovery capabilities, a holistic approach should be taken. This means identifying critical server and data volumes and which systems they are stored in, and pinpointing the systems that need to be recovered first, according to their unique business tolerance timelines. The business’ tolerance for data loss must be considered, given its huge effect on the cost of implementing a data recovery solution.

Lastly, organisations cannot forget data in cloud and SaaS solutions, as they are equally as vulnerable. Only by truly understanding its capability to recover data in the event of a ransomware attack can businesses adopt a comprehensive approach, allowing them to protect and recover more data, faster.

Duncan Bradley is Director of Customer Engagement, UKI Cyber Resiliency Practice at Kyndryl 

Image: Shubham Dhage

You Might Also Read:

Reimagining Your Cyber Infrastructure:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Cyber Attack On Georgia's State Government
Elections 2024 - Fake News & Misinformation   »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

DataVantage

DataVantage

DataVantage data masking and data management software helps you prevent data breaches, pass compliance audits and meet regulatory requirements such as HIPAA and PCI DSS.

Detack

Detack

Detack is an independent supplier of IT security auditing and consulting services.

Cybint Solutions

Cybint Solutions

Cybint provides customized cyber education and training solutions for Higher Education, Companies and Government.

Lineal Services

Lineal Services

Lineal supports clients in meeting their digital forensics, cyber security and eDiscovery needs by providing bespoke solutions to complex problems.

Capy

Capy

Capy's SaaS-based security solutions will protect your website from bots, spam, humans and more.

Ashley Page

Ashley Page

Ashley Page offer a unique cyber insurance and risk management solution - Cyber+Insure.

OwnZap Infosec

OwnZap Infosec

OwnZap Infosec aims to digitally shield the cyberspace by offering services like Penetration Testing and Red Teaming, Infrastructure Security Testing, and Vulnerability Assessments.

SyferLock Technology Corp.

SyferLock Technology Corp.

SyferLock is an innovative provider of next-generation authentication and security solutions.

Althammer & Kill

Althammer & Kill

Althammer & Kill offers pragmatic solution concepts for data protection and digitization. We advise in the field of data protection, information security and compliance.

Protelion

Protelion

The Protelion Security Platform is uniquely architected to deliver security solutions that combine greater protection, flexibility, and performance.

People Driven Technology

People Driven Technology

People Driven Technology is a customer-obsessed organization. We leverage our decades of business, technology, and engineering experience to deliver outcomes for our clients.

AWARE7

AWARE7

IT security for human and machine. With the help of our products and services, we work with you to increase the IT security level of your organization.

Astute Technology Management

Astute Technology Management

Astute Technology Management helps businesses take control of their technology and work with greater confidence.

Catalyst Campus For Technology & Innovation

Catalyst Campus For Technology & Innovation

Catalyst Campus is a collaborative ecosystem to create community, spark innovation and stimulate business growth.

Orchestrate Technologies

Orchestrate Technologies

Orchestrate Technologies provides computer network and IT managed services for small and mid-market clients as well as small enterprise businesses.

Deepware

Deepware

Deepware is an emerging AI research company dedicated to exploring the potential of GenAI in both generation and detection.