Ransomware fallout is devastating and could often be avoided, study finds
Ransomware victims face tightened budgets, lost productivity and other problems. In most cases, new post-attack security measures could have prevented the ransomware attack if implemented beforehand.
Image: Zephyr18, Getty Images/iStockphoto
A report on the fallout from ransomware attacks performed by Keeper Security finds that nearly all companies affected by ransomware noticed a business-wide ripple effect on budgets, productivity, reputation and security posture. To make matters worse, Keeper found that post-attack security implementations, if in place prior to the ransomware attack, could have prevented most attacks.
“The realities of being hit by a ransomware attack, especially for a smaller company, are much more terrifying than most people realize,” said Keeper Security CEO and co-founder, Darren Guccione. In its survey of more than 2,000 U.S. professionals, Keeper Security found that 93% of respondents noticed budgets tightening in non-security departments after a ransom payment, indicating that an entire organization shoulders the burden of a successful ransomware attack.
SEE: Security incident response policy (TechRepublic Premium)
As for paying ransoms, the percent actually doing so may be higher than previous estimates. Forty-nine percent of respondents said their company paid the ransom, and 22% decided not to disclose that information, meaning the percent of businesses paying ransoms, which many security experts advise never to do, could be significantly higher than previously thought.
Business leaders, Keeper Security noted, “feel an incredible pressure to prevent further malicious movement within their network as well as to placate customers. Cybercriminals know and depend on exploiting this frenzied state of mind” to convince companies to pay.
Being labeled a ransomware victim carries a serious stigma, Keeper Security said, leading 15% of organizations not to disclose an attack to partners and customers, and 26% not to disclose their victimhood to the public. Attackers count on this, Keeper said; like the panic state of realizing you’re a ransomware victim, the stigma gives attackers another piece of leverage to ensure a payment. It’s understandable that businesses feel this way: 64% said they think being a ransomware victim had a negative impact on their reputation.
For all the fear and paranoia ransomware attacks induce, shockingly few businesses are taking steps to prevent them, the report found. For starters, 29% of employees said they weren’t familiar with ransomware until their company became a victim, indicating that there’s a startling lack of education in place to teach employees to be aware of the risk and how to prevent it.
Half of ransomware attacks are triggered by a phishing email, which Keeper Security said “is a frightening indication of how lack of awareness remains an achilles heel for too many organizations.”
The aftermath of a ransomware attack is a common time to implement stricter security practices, which the report found 87% of organizations do as part of their recovery efforts. Ransomware attackers go after low-hanging fruit, Keeper said. Organizations not using multi-factor authentication are common victims, indicated by the fact that 62% implement the practices following a ransomware attack.
Unfortunately for businesses opting to implement software upgrades and new security features after a ransomeware attack, doing so has a negative impact on day-to-day business. Seventy-one percent of respondents said updates impacted their productivity or their ability to carry out routine tasks, and 64% said they lost login credentials or important documents as a result of updates. Of those numbers, Keeper Security said they “further prove that the best time to install significant security updates is before the necessity is demonstrated.”
SEE: How to manage passwords: Best practices and security tips (free PDF) (TechRepublic)
Ransomware isn’t going anywhere; if anything, attackers are becoming bolder and better at exploiting vulnerable companies. According to Keeper Security Chief Revenue Officer Mark Cravotta, many of those companies can take steps to protect themselves, yet choose not to.
“Given the overwhelming prevalence of these attacks, it’s shocking to see how many employees are left in the dark until it happens to them. Investing in cybersecurity measures like MFA, password management solutions and awareness training might seem like an unnecessary expenditure to companies with tighter budgets, but the costs pale in comparison to the ramifications of being the victim of a ransomware attack,” said Cravotta.
Cybersecurity Insider Newsletter
Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays