Why Are Businesses Still Falling Victim To Ransomware?

A recent survey determined that 80 per cent of organisations were victims of ransomware attacks in 2021, and more than 60 per cent of the businesses paid the ransom. As these figures have become all too common, it is important to look at why businesses still find themselves at risk of ransomware attacks.

Industry expert and ex-FBI cyber crime Supervisory Special Agent Jason Manar, now Chief Information Security Officer at Kaseya, addresses the following questions: 

Despite the vast amount of data security information available, why do businesses continue to find themselves vulnerable to ransomware attacks?:      

Attackers prey on employees, as well as those that have access to the company’s systems using social engineering and phishing techniques. Additionally, many bad actors combine these tactics by using social media platforms to obtain additional information about their victims. To combat ransomware attacks, businesses need to provide ongoing end users with security training to ensure they don’t become the company’s weakest link. In addition to the human factor, organisations should have security tools in place that baseline the network and limit administrative access, even at the local level. It’s also critical to stay on top of patching. 

What can companies do to improve their security systems and proactively combat ransomware?   

Proactive measures companies can take include instituting educational programmes, implementing a regular patching policy, limiting administrative accounts, provisioning administrative users, and auditing administrative accounts. It’s equally important to have appropriate security tools in place, and to avoid running on legacy or unsupported systems. Additionally, organisations should run regular security and pen tests, and enact a strong password security policy which enables multi-factor authentication (MFA) and ensures lengthy, complete passwords. In addition, companies need to keep browsers up-to-date to prevent adversaries from installing keyloggers. Offline backups should also be standard practice with a system in place to determine how often these are done. 
 
Paying ransom goes beyond the money, it’s also about business suspension and reputational damage if the attack becomes public knowledge. How do you educate organisations about the risks?

Unfortunately, there are too many worst-case scenarios where companies have lost everything, and they then go out of business. I can share examples that have not been publicised of people repeatedly saying, “we’re going to get to it,” and then put off implementing ransomware preventative measures, which inevitably leads to having to deal with the dire consequences of the attack. Developing and implementing robust security policies and guidelines is fairly simple, as well as cost effective. By taking these actions, companies can mitigate risk in the event they are intruded upon.
 
What advice would you give to a CFO?

Any C-Suite member should have security top-of-mind and understand that the lack of security in an organisation is one of the most existential threats that an institution faces that could potentially lead to immediate dissolution of the company. 

The CFO should meet regularly with the company’s CISO or security leader to understand the top threats and vulnerabilities facing the organisation, and jointly make decisions about security funding that are aligned with the highest risks and impact. 

What advice would you give to a CIO?

The one-piece of advice would be to overcommunicate and collaborate with the CISO. The primary responsibility of the CIO is to ensure the functionality and continuity of IT operations. Equally important to the CIO’s primary duties are to ensure they keep a security-first mindset. This is important as it may seem easier for the IT team to institute policies, which lean more to convenience vs. security.  

What advice would you give to a CEO? 

“Where you lead, they will follow,” meaning every security policy that is in place for employees are also there for the CEO, and everything starts from the top down. People are going to scrutinise every action, or lack thereof, that the CEO makes regarding their own personal security practices. If a CEO doesn’t participate, typically there won’t be a security-first culture within that organisation. As CEO, you need to show employees that you take cybersecurity seriously. This means doing the cybersecurity training like everyone else and engaging with both the security team and employees, so they see you are engaged. It’s important to set an example so that employees see that meeting the requirements and standards set forth by the company are a top priority.

Unfortunately, the rewards for cybercriminals have become greater than the risks. To this end, they are continually developing new and innovative ways to leverage inherent network infrastructure weaknesses.

To lessen the impact of ransomware attacks and subsequent payments, organisations must remain vigilant and take proactive measures such as securing the network and prioritising cybersecurity training for all employees. 

Jason Manar is Chief Information Security Officer at Kaseya.

You Might Also Read:

Building a Threat-Ready Ransomware Response Plan: