Technology personal details , ransomware actors can monetise a victim ’ s IP on the Dark Web or hand it over to a state-sponsored threat actor to be leveraged for an economic advantage .
RANSOMOPS IMPACT TO THE BUSINESS Taken together , these tactics have escalated the costs to targeted organisations from ransomware attacks . The Cost of a Data Breach Study 2021 estimated the average ransomware attack cost victim organisations USD4.62-million to recover from , a figure that doesn ’ t even include the costs associated with paying the ransom demand and other fallout from an attack .
So , what does the cost of a ransomware attack include ? A Cybereason study from 2021 , titled Ransomware : Attacks and the True Cost to Business provides some indication . Consider the following statistics :
• Loss of business revenue : Two-thirds of organisations said that they suffered significant revenue loss following a ransomware attack .
• Damage to brand and reputation : More than half of organisations said that they suffered damage to their brand and reputation after an attack .
• Loss of C-level talent : Approximately one third of respondents said that they lost C-level talent after suffering a ransomware attack .
• Employee layoffs : About thirty percent indicated that they were forced to lay off employees due to the financial pressures caused by a ransomware attack .
• Business interruption : A quarter of organisations temporarily ceased business operations after experiencing a ransomware attack .
Another attacker strategy worth noting is the tendency for attackers to hit organisations on weekends and holidays when they are typically running skeleton crews . Notable weekend / holiday ransomware attacks in 2021 included the DarkSide attack on Colonial Pipeline that occurred over Mother ’ s Day weekend , the REvil attack against JBS Meat Packing over Memorial Day weekend and the attack on Kaseya during the Fourth of July weekend .
A follow-up report from Cybereason , titled Organisations at Risk : Ransomware Attackers Don ’ t Take Holidays , revealed that 60 % of organisations said a weekend or holiday ransomware attack resulted in longer periods to assess the scope of an attack . As a result , 50 % said they required more time to mount an effective response , and 33 % said they required a longer period to fully recover from the attack .
DEFENDING AGAINST RANSOMOPS The utility of data backups has changed given the increasing prominence of double extortion , where backups might allow a victim to recover their encrypted information , but it won ’ t prevent an attacker from leaking their stolen data online . This tactic thus helps to put additional pressure on victims to pay up .
Zero trust is an inherently complicated goal for infosec teams , as sending and receiving data in only prescribed circumstances is unrealistic in the average enterprise that is more distributed than ever before . Interfacing through the internet means that we do normal business over the same channels that attackers operate on , which is like sending a commercial ship through known pirate routes .
More information can be found by downloading the white paper : Inside Complex Ransomware Operations and The Ransomware Economy .
" Criminal activity is motivated by financial gain "
In addition – and through no fault of their own due to human bandwidth issues and resource constraints , the average security team doesn ’ t have full visibility of their ecosystems , can ’ t patch vulnerable systems in short order , and have not fully implemented security basics across their environment . This gives sophisticated attackers many options to gain access to the IT infrastructure of a targeted organisation , and opponents will use every tool at their disposal to gain access .
Many organisations that have prepared for a ransomware attack have resorted to cyber insurance as a failsafe against financial losses . Due to its prevalence , cyber insurance payouts are in a sense funneling money to adversaries and directly helping to prop up the industry . The insurance itself is often insufficient , with many loopholes for coverage and red tape that tips the scales in the advantage of the insurers .
Just as venture capital is a conduit for infusing monies into the legitimate software market , cyber insurance is becoming a conduit for infusing monies into the illegitimate software market of ransomware . “ Criminal activity is motivated by financial gain , so paying a ransom may embolden adversaries to target additional organisations ( or re-target the same organisation ) or encourage cyber criminals to engage in the distribution of ransomware ,” the joint report published by CISA advised . “ Paying the ransom also does not guarantee that a victim ’ s files will be recovered . Additionally , reducing the financial gain of ransomware threat actors will help disrupt the ransomware criminal business model .” RACA
www . refrigerationandaircon . co . za RACA Journal I November 2022 45