Step up your protection against the rise of ransomware

When it comes to your vul­ner­a­bil­i­ty to cyber attack, if your main source of com­fort is that at least the per­pe­tra­tors have to mar­shal an army of tal­ent­ed hack­ers cre­at­ing bespoke code to infil­trate your organ­i­sa­tion — you’d bet­ter think twice.

“You can pick ran­somware up off the shelf as a ser­vice, should you be so inclined. It’s rel­a­tive­ly quick and easy to get your hands on and to exe­cute, and once it gets in some­where, it’s very destruc­tive and dis­rup­tive,” warns Johan Drey­er, Mime­cast EMEA field chief tech­nol­o­gy offi­cer.

As a result, it’s clear­ly becom­ing the cybercriminal’s weapon of choice. Accord­ing to Mimecast’s State of Email Secu­ri­ty Report, 2021, 48% of UK busi­ness­es have been affect­ed by ran­somware, 33% of those affect­ed suf­fered between two and three days of down­time and 50% have paid the ran­som in the past year. Those that suf­fered an attack were down for an aver­age of six days and a third of those who paid the ran­som to release their data ulti­mate­ly didn’t get it back.

Before the pan­dem­ic struck, Cyber­se­cu­ri­ty Ven­tures not­ed that ran­somware was pre­dict­ed to cost busi­ness­es around $20bn by the end of 2021, 57 times the lev­el in 2015, with an attack every 11 sec­onds. In a work-from-home envi­ron­ment, busi­ness­es were more at risk than ever. There was a 60% increase in the use of com­pa­ny com­put­ers for per­son­al rea­sons, 34% of Brits and Ger­mans were found to be open­ing sus­pi­cious emails and there was a three-fold increase in unsafe clicks by employ­ees.

Why is ran­somware so destruc­tive? Aside from the ease with which bad actors can get hold of it and deploy it in a short time peri­od, it preys on com­pa­nies’ com­mon fail­ings when it comes to cyber pre­pared­ness. Cyber crim­i­nals rely on the fact that busi­ness­es have no way to access the data that has been locked up by the ran­somware, oth­er than to pay them to release it.

The rea­son crim­i­nals are hold­ing com­pa­nies to ran­som so suc­cess­ful­ly is because too many still don’t have a com­pre­hen­sive back­up reg­i­men. In the best-case sce­nario, a busi­ness sub­ject to a ran­somware attack would review how the bad actors were able to get in, resolve the weak­ness, restore from back­up and pro­ceed as nor­mal with min­i­mal impact.

How­ev­er, for most this is very much a case of shut­ting the sta­ble door after the horse has bolt­ed. In many cas­es, com­pa­nies have a per­fect storm of poor­ly updat­ed sys­tems, mean­ing patch­es designed to remove vul­ner­a­bil­i­ties have not been installed, back­ups are delayed or irreg­u­lar and the organ­i­sa­tion hasn’t got the resources or resilience to con­tin­ue with busi­ness as usu­al while they try to recov­er their data. The only solu­tion is to pay up and hope for the best.

“The unfor­tu­nate real­i­ty is that there may be no way to unlock what they’ve done. Many organ­i­sa­tions have paid ran­soms and not received their data. Even when they do, you are still fuelling a crim­i­nal econ­o­my. It all goes back to mak­ing sure your sys­tems are ade­quate­ly backed up with a sen­si­ble redun­dan­cy in place. We offer organ­i­sa­tions a copy of their email archive which main­tains their abil­i­ty to send and receive email after an attack,” Drey­er insists.

Becom­ing ran­somware-resilient starts at the very top. “It can be a cliché that the board is respon­si­ble but to a degree, it is. Tak­ing action is typ­i­cal­ly down to the chief infor­ma­tion offi­cer or the head of secu­ri­ty. To help them play their part, the board has to set out the strat­e­gy that the exec­u­tive can car­ry out, imple­ment­ing drills to pre­pare the busi­ness, mod­el best prac­tice based on past events and improve the organisation’s over­all cyber resilience skillset which ulti­mate­ly empow­ers secu­ri­ty as a cul­ture,” says Drey­er.

How the CIO’s role is per­ceived is crit­i­cal to build­ing a cyber­se­cure envi­ron­ment and it’s a role that has under­gone sig­nif­i­cant change. Before, it may have been seen as a pure­ly tech­ni­cal role, now the posi­tion is pop­u­lat­ed by peo­ple whose remit is busi­ness first and tech­nol­o­gy sec­ond.

Part of the shift is around under­stand­ing how tech­nol­o­gy and the CIO con­tributes to busi­ness val­ue. They are increas­ing­ly seen as part­ners in the cre­ation of busi­ness val­ue in the first instance, and there to pro­tect it in the sec­ond. Secu­ri­ty pro­fes­sion­als have to be able to tie the risks that they’re fac­ing more close­ly to busi­ness val­ue and busi­ness objec­tives. Why? Because ran­somware puts val­ue at risk as it can pre­vent busi­ness­es from serv­ing their cus­tomers and there­fore has a mate­r­i­al impact.

“It’s more about dri­ving busi­ness out­comes rather than pro­vid­ing tech­nol­o­gy for the sake of it. There’s a sense of account­abil­i­ty,” Drey­er says.

“Most organ­i­sa­tions have some pro­tec­tion in place,” Drey­er adds. “Mimecast’s strengths are in email secu­ri­ty, con­ti­nu­ity, and archive and our sys­tems are thwart­ing attacks day in, day out.” Mime­cast pro­tects against phish­ing and BEC (busi­ness email com­pro­mise) attacks designed to cap­ture cre­den­tials that can be used to deploy ran­somware. “We con­tin­ue to invest heav­i­ly in dig­i­tal asset mon­i­tor­ing and asset pro­tec­tion. Active mon­i­tor­ing is an essen­tial weapon in the fight against cyber­crime and one that is very much a col­lab­o­ra­tive effort.

“When it comes to pro­tect­ing your busi­ness there’s no mag­ic tool or sil­ver bul­let so Mimecast’s invest­ing in inte­grat­ing with oth­er secu­ri­ty ven­dors. We’re active­ly col­lect­ing intel­li­gence and shar­ing it with sys­tems such as end point detec­tion and response or SOAR (Secu­ri­ty Orches­tra­tion and Reme­di­a­tion) and that enrich­es their data set. Cus­tomers can also ingest intel­li­gence from oth­er sources into their Mime­cast Ser­vice to com­plete the cir­cle. We are very much advo­cates of a ‘bet­ter togeth­er’ strat­e­gy,” Drey­er reveals.

With many organ­i­sa­tions mak­ing the move to remote and, lat­ter­ly, hybrid work­ing, com­pa­nies need to be more vig­i­lant than ever that their cyber pro­to­cols are as robust as pos­si­ble. Ran­somware attacks are almost an inevitabil­i­ty in today’s world. Cyber hygiene is an essen­tial part of every organisation’s strat­e­gy. Actions like review­ing your patch regime, keep­ing sys­tems up-to-date and keep­ing an eye on back­ups are vital.

Final­ly, pre­ven­tion is always bet­ter than cure. Attacks are most like­ly when employ­ees sim­ply click on unse­cure emails or are brows­ing unau­tho­rised sites while on busi­ness net­works so edu­ca­tion is para­mount. Build­ing a cul­ture of secu­ri­ty aware­ness that applies to both employ­ees’ per­son­al and busi­ness envi­ron­ments.

“Even the most sophis­ti­cat­ed organ­i­sa­tions can and have been breached but, we are see­ing more open­ness and trans­paren­cy which gives every­one else the infor­ma­tion they need to bet­ter pro­tect them­selves. The more we can share intel­li­gence, the more we can uplift the com­mu­ni­ty. That’s why we open our sys­tems and plat­forms so our cus­tomers and part­ners can all ben­e­fit.”

Learn how to mit­i­gate the ran­somware risk with our free resources:
mimecast.com/timescio

Pro­mot­ed by Mime­cast