Why Are Businesses Still Falling Victim To Ransomware?

A recent survey determined that 80 per cent of organisations were victims of ransomware attacks in 2021, and more than 60 per cent of the businesses paid the ransomAs these figures have become all too common, it is important to look at why businesses still find themselves at risk of ransomware attacks.

Industry expert and ex-FBI cyber crime Supervisory Special Agent Jason Manar, now Chief Information Security Officer at Kaseya, addresses the following questions

Despite the vast amount of data security information available, why do businesses continue to find themselves vulnerable to ransomware attacks?:      

Attackers prey on employees, as well as those that have access to the company’s systems using social engineering and phishing techniques. Additionally, many bad actors combine these tactics by using social media platforms to obtain additional information about their victims. To combat ransomware attacks, businesses need to provide ongoing end users with security training to ensure they don’t become the company’s weakest link. In addition to the human factor, organisations should have security tools in place that baseline the network and limit administrative access, even at the local level. It’s also critical to stay on top of patching. 

What can companies do to improve their security systems and proactively combat ransomware?   

Proactive measures companies can take include instituting educational programmes, implementing a regular patching policy, limiting administrative accounts, provisioning administrative users, and auditing administrative accounts. It’s equally important to have appropriate security tools in place, and to avoid running on legacy or unsupported systems. Additionally, organisations should run regular security and pen tests, and enact a strong password security policy which enables multi-factor authentication (MFA) and ensures lengthy, complete passwords. In addition, companies need to keep browsers up-to-date to prevent adversaries from installing keyloggers. Offline backups should also be standard practice with a system in place to determine how often these are done. 
 
Paying ransom goes beyond the money, it’s also about business suspension and reputational damage if the attack becomes public knowledge. How do you educate organisations about the risks?

Unfortunately, there are too many worst-case scenarios where companies have lost everything, and they then go out of business. I can share examples that have not been publicised of people repeatedly saying, “we’re going to get to it,” and then put off implementing ransomware preventative measures, which inevitably leads to having to deal with the dire consequences of the attack. Developing and implementing robust security policies and guidelines is fairly simple, as well as cost effective. By taking these actions, companies can mitigate risk in the event they are intruded upon.
 
What advice would you give to a CFO?

Any C-Suite member should have security top-of-mind and understand that the lack of security in an organisation is one of the most existential threats that an institution faces that could potentially lead to immediate dissolution of the company. 

The CFO should meet regularly with the company’s CISO or security leader to understand the top threats and vulnerabilities facing the organisation, and jointly make decisions about security funding that are aligned with the highest risks and impact. 

What advice would you give to a CIO?

The one-piece of advice would be to overcommunicate and collaborate with the CISO. The primary responsibility of the CIO is to ensure the functionality and continuity of IT operations. Equally important to the CIO’s primary duties are to ensure they keep a security-first mindset. This is important as it may seem easier for the IT team to institute policies, which lean more to convenience vs. security.  

What advice would you give to a CEO? 

“Where you lead, they will follow,” meaning every security policy that is in place for employees are also there for the CEO, and everything starts from the top down. People are going to scrutinise every action, or lack thereof, that the CEO makes regarding their own personal security practices. If a CEO doesn’t participate, typically there won’t be a security-first culture within that organisation. As CEO, you need to show employees that you take cybersecurity seriously. This means doing the cybersecurity training like everyone else and engaging with both the security team and employees, so they see you are engaged. It’s important to set an example so that employees see that meeting the requirements and standards set forth by the company are a top priority.

Unfortunately, the rewards for cybercriminals have become greater than the risks. To this end, they are continually developing new and innovative ways to leverage inherent network infrastructure weaknesses.

To lessen the impact of ransomware attacks and subsequent payments, organisations must remain vigilant and take proactive measures such as securing the network and prioritising cybersecurity training for all employees. 

Jason Manar is Chief Information Security Officer at Kaseya.

You Might Also Read:

Building a Threat-Ready Ransomware Response Plan:

 

« CISA Reports No Significant Attacks On US Elections
International Fraud Awareness Week: Every Individual Has A Part to Play »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Venafi

Venafi

Venafi is a world-class cyber-security company dedicated to protecting machine identities for our hyper-connected digital economy.

CyberDef

CyberDef

CyberDef is a consulting company specialising in cyber defence services for small and medium enterprises.

MailXaminer

MailXaminer

MailXaminer is an advance and powerful email investigation platform that scans digital data, performs analysis, reports on findings and preserves them in a court validated format.

Corvid

Corvid

Corvid is an experienced team of cyber security experts who are passionate about delivering innovative, robust and extensive defence systems to help protect businesses against cyber threats.

Uleska

Uleska

Uleska is a scalable platform that provides automated and continuous software security testing whilst translating cyber risk.

bluedog Security Monitoring

bluedog Security Monitoring

Sentinel from bluedog provides powerful and affordable internal network monitoring.

SWAT Systems

SWAT Systems

SWAT Systems is an IT support and cyber security managed service provider.

Eaton

Eaton

Eaton provides comprehensive cybersecurity services for operational technology (OT) to help keep your operations and personnel safe.

RocketCyber

RocketCyber

RocketCyber is a Managed SOC platform empowering Managed Service Providers (MSPs) to deliver security services to small and medium businesses.

Perygee

Perygee

Perygee is a fully integrated platform for operational security. Companies depend on Perygee to identify and streamline the most important security practices for their operations.

vCISO Services

vCISO Services

vCISO Services is a small, specialized, veteran-owned firm focused on the needs of SMBs only.

CyberUSA

CyberUSA

CyberUSA is a collaboration of leaders and states focused on a common mission purpose of enabling innovation, education, workforce development, enhanced cyber readiness and resilience.

WPScan

WPScan

With WPScan, you'll be the first to know about vulnerabilities affecting your WordPress installation, plugins, and themes.

Astute Technology Management

Astute Technology Management

Astute Technology Management helps businesses take control of their technology and work with greater confidence.

DV Cyber Security

DV Cyber Security

DV Cyber (formerly A76) is an innovative cyber security company vertically focused on Threat Intelligence and Cyber Security Research.

Lasso Security

Lasso Security

Lasso Security is a pioneer cybersecurity company ensuring comprehensive protection for businesses leveraging generative AI and other large language model technologies.