This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
Impacts vary but, in many cases, ransomware disrupts businesses for significant periods—or even forces them to suspend operations or close. A growing population of highly capable cyber extortionists is developing new means to counter defenses and to increase the level of disruption they can inflict, constantly. Threats are widespread, they extend across industry and the public/private sector and they affect large and small businesses alike.
Security leaders must understand and counter new ransomware challenges, strengthen defenses across people, processes and technology and demonstrate why security is critical to the business strategy.
year-on-year increase in ransomware events in 2020—with little sign of any slow-down in early 2021 Source: CIFR intrusion data
US$34M
ransom demanded from one of the world’s largest manufacturers—encrypted 1,200 servers, theft of 100GB of data, deleted 20 to 30TB back-ups. Source: Bleeping Computer
US$50M
The Accenture Cyber Investigations, Forensics & Response (CIFR) team observed ransom demands ranging from US$100,000 to US$50M in 2020. Source: CIFR intrusion data
Today’s top three ransomware defense challenges
Successful ransomware extortionists are ramping up attacks
Established ransomware operators are upping their game as they continue to focus on new monetization opportunities and see no limits to the potential profits.
Ransomware operators are constantly improving their ability to disrupt
Cyber extortionists are incentivized to develop ever-more disruptive ways of working. The more disruption they can inflict, the larger the ransom they can demand.
Business growth and service strategies lack resilience
Downtime from ransomware can affect tens of millions of people. The theft and publication of data gives attackers new extortion opportunities—such as the risk of regulatory sanctions if protected information is made available online.
Ransom demands are growing and becoming more customized—with threat actors assessing who is more likely to pay. If ransoms are paid, it can open the door to further criminality. Some ransomware operators have been sanctioned, potentially placing a ransom-paying victim in further legal jeopardy.
Focus on the basics
Keep security hygiene up to standard.
Prevent and protect
Continuously validate and test your defenses.
Know your operations
Model the threat against your operations and end-to-end value chain.
Make it personal
Collaborate and prepare so everyone knows how to work together during an event.
Prepare, prepare and prepare again
Constantly measure and improve resilience or adjust your course.
Assume that you are already breached—and focus on resilience across the end-to-end value chain.
Ransomware solutions if you’ve been hit
What can you do next, now that you’ve been hit?
Trace the attack
Build a comprehensive understanding of the intrusion and impact.
Collaborate and report
Ensure statutory obligations are fulfilled and collaborate with others.
Learn from the experience
Identify metrics and resources to meet the C-suite's expectations for cyber resilience.
Update risk mitigation plans
Evaluate current and residual risk and apply a risk mitigation strategy.
Strengthen defense posture
Get tactical; drive behavioral changes to strengthen cybersecurity defenses.
Is your ransomware defense strategy ready?
Being resilient means robust processes, training and coordination across the business. Here are some questions you can ask yourself to find the best way forward to mitigate ransomware risk:
What
What are the most critical systems and data in your operations?
What plans do you have in place (eg, business continuity, disaster recovery)?
What is your media strategy in the event of a crisis?
How
How often do you pressure-test and exercise your plans?
How quickly could you respond to and recover from a ransomware threat?
How would you handle a full domain compromise?
Who
Who are your decision-makers during a crisis?
Who is responsible for negotiating or reviewing your extortion policy?
