Ransomware: Businesses Are Well Equipped But Underprepared

In a landscape where cybersecurity attacks are now inevitable, being underprepared is a recipe for disaster. Yet, despite the media being filled with cautionary tales of persistent malicious actors and unsuitable cyber defences, organisations have proven themselves seriously underprepared when it comes to recovering from one of today’s most prolific attack types: ransomware.

In a recent study by IDC and Kyndryl, which surveyed businesses with over 500 employees from a variety of sectors, 69% of respondents had suffered at least one successful ransomware attack in the last 12 months, and nearly a third had paid $50,000 to $100,000 to regain access to their data.

Only 28.2% of this group said they were able to recover their encrypted data from backup using the tools they already had, therefore not having to pay the ransom. Even more worryingly, 8% said that they could not recover all their data, regardless of whether they paid the ransom or not.

So, despite high-profile attacks targeting every industry, why are businesses still leaving themselves vulnerable?

The Illusion Of Preparedness

There are two ways to look at why enterprises are underprepared for ransomware. The first is the decades-long trend of consolidating infrastructure to high data availability platforms, and the second is the existence of increasingly stringent Service Level Agreements (SLAs) intended to govern that infrastructure. 

The lean towards consolidation is a necessary one as it has enabled data to move more freely through organisations and their networks, and it has motivated increased investment in clustering and storage replication, which guarantees high available easy access to this information. Though these highly replicated environments have unfortunate consequence in that it can rapidly propagate ransomware attacks from logical data corruption events.

As the infrastructure sees newly encrypted data, which the attacker intends to hold to ransom, as something which needs to be preserved, it can result in the attack propagating rapidly and all servers becoming encrypted.

In addition, the use of SLAs as a sign of preparedness can make an organisation vulnerable - while a dashboard full of green lights showing successful backups and data consistency can seem like a positive sign, it’s only impactful for some forms of risk. Successful backups do not always equal successful recovery, so these SLA’s need to cover both backup and test recovery if they are to provide confidence to an organisation.

But the outlook isn’t all negative - given the well-publicised nature of ransomware as a cyber threat, rates of adoption for tools like malware scanners, cyber tolerant backup and recovery software, and zero trust methodologies have been encouraging.

Yet, knowledge gaps remain in how these technologies are configured and managed, meaning they often cannot deliver what these businesses want and need if an attack strikes. 

Ransomware Recovery, The Right Way

To create a system that’s built to handle modern ransomware attacks, businesses need a Cyber Tolerant Recovery Solution that meets a few key attributes. The first is introducing an air gap to act as a firebreak for the propagation of compromised data during an attack, ensuring that backup data is physically separated from production data. Then, these backups should be stored in an environment with immutability and retention lock, which stops data from being changed or expired by a cyberattack once committed to disk. 

Next, verification is vital before triggering a recovery process from backup data. Using an anomaly scanner can detect indicators of compromise to improve defence against them. Then finally, all data storage and protection efforts are useless unless they help the business get back on its feet faster, and with less financial damage, than by paying the ransom. Therefore, organisations must be able to manage mass recovery and the handling of traffic tens of times greater than normal backup workloads.

Many businesses are already prioritising security investments in response to the rise in ransomware, so focus should be on adding to and reconfiguring their security, rather than outright replacing it.

To expand and improve data recovery capabilities, a holistic approach should be taken. This means identifying critical server and data volumes and which systems they are stored in, and pinpointing the systems that need to be recovered first, according to their unique business tolerance timelines. The business’ tolerance for data loss must be considered, given its huge effect on the cost of implementing a data recovery solution.

Lastly, organisations cannot forget data in cloud and SaaS solutions, as they are equally as vulnerable. Only by truly understanding its capability to recover data in the event of a ransomware attack can businesses adopt a comprehensive approach, allowing them to protect and recover more data, faster.

Duncan Bradley is Director of Customer Engagement, UKI Cyber Resiliency Practice at Kyndryl 

Image: Shubham Dhage

You Might Also Read:

Reimagining Your Cyber Infrastructure:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Cyber Attack On Georgia's State Government
Elections 2024 - Fake News & Misinformation   »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Kent Interdisciplinary Research Centre in Cyber Security (KirCCS) - University of Kent

Kent Interdisciplinary Research Centre in Cyber Security (KirCCS) - University of Kent

KirCCS harnesses expertise across Kent University to address current and potential cyber security challenges.

GreyCastle Security

GreyCastle Security

GreyCastle Security is a leading cybersecurity services provider dedicated exclusively to cybersecurity and the practical management of cybersecurity risks.

PBOSecure

PBOSecure

PBOSecure is a dynamic and progressive IT consultancy company specializing in IT and Industrial Control System (ICS) security.

Kleiner Perkins

Kleiner Perkins

For five decades, Kleiner Perkins has made history by partnering with some of the most ingenious and forward-thinking founders in technology and life sciences.

Carve Systems

Carve Systems

Carve Systems was founded to bring enterprise level information security, training, and risk management services to organizations of any size and industry.

Secureframe

Secureframe

Companies from startups to enterprises use Secureframe to automate SOC 2 and ISO 27001 compliance, complete audits, and continuously monitor their security.

Mitiga

Mitiga

Mitiga uniquily combines the top cybersecurity minds in Incident Readiness and Response with a cloud-based platform for cloud and hybrid environments.

Otto

Otto

Stop Client-Side Attacks. Plug otto into your application security suite and protect your supply chain.

McAfee

McAfee

McAfee is a worldwide leader in online protection. We’re focused on protecting people, not devices. Our solutions adapt to our customers’ needs and empower them to confidently experience life online.

Mobilicom

Mobilicom

Mobilicom is an end-to-end provider of cybersecurity and smart solutions for drones, robotics & autonomous platforms.

Cygna Labs

Cygna Labs

Cygna Labs is a software developer and one of the top three global DDI (DNS, DHCP, and IP address management) vendors.

Helix Security Services

Helix Security Services

Helix Security provides IT & information security consultancy to government and businesses across New Zealand.

St Fox

St Fox

St. Fox is a leading consultancy helping enterprises secure their Cloud, Data, endpoints, and applications.

Red Alpha Cybersecurity

Red Alpha Cybersecurity

At Red Alpha, we specialize in recruiting and rigorously training individuals passionate about cybersecurity.

Inoxoft

Inoxoft

Inoxoft delivers IT security consulting, assessment, and protection services to help businesses secure their infrastructure, applications, and sensitive data.

Esentry

Esentry

Esentry systems is a managed security service provider with focus on continuous security monitoring, threat detection, threat analysis and cybersecurity compliance.