Fraud Management & Cybercrime
,
Ransomware
CISOs at Organizations That Fell Victim Have a Different Story, 451 Research Finds
Overconfidence is the herald of a failed ransomware attack response, warn security experts armed with data showing how defenses often crumble against actual extortionist hackers.
See Also: How to Take the Complexity Out of Cybersecurity
A new study from 451 Research, a technology research group within S&P Global Market Intelligence, found high levels of assurance from survey participants that they could fend off ransomware. Of respondents who hadn’t been hit by ransomware, 34% said they expected their network security tools would intercept such an attack, while 25% expected their endpoint security tools to do the same.
Here’s the reality: “Among respondents who dealt with an actual attack, network security tools blocked 14% of the attacks and endpoint security was effective for 13% of respondents,” said report author Daniel Kennedy, principal research analyst for the Information Security channel at S&P Global Market Intelligence.
Kennedy regularly speaks with CISO end users as part of his ongoing “Voice of the Enterprise: Information Security” quantitative research into top pain points.
What happens when such tools fail to arrest an attack? Kennedy found that “reimaging machines and restoring from backup” was the most common strategy, practiced by 34% of organizations that fell victim to ransomware, “indicating the importance of a resilience-based strategy focusing on backup technologies such as immutable storage – an investment subsequently made by 38% of respondents who experienced ransomware events.”
Another safety net is cyber insurance, “a key strategy cited by 44% of respondents,” he said, with 78% of ransomware victims subsequently either extending an existing policy or else purchasing one for the first time.
As a result of a ransomware incident, surveyed organizations told 451 Research they made these specific investments:
- Security awareness education: 47%
- Network security: 45%
- Cyber insurance: 44%
- Endpoint security or protection platforms (EPP): 40%
- Immutable backup/storage: 38%
- Email security: 33%
- Endpoint detection and response: 31%
- Patch management: 29%
- Asset inventory: 29%
- Extended detection and response: 27%
Kennedy found only 4% of firms reported making no new follow-on investments after falling victim to a ransomware attack.
As many ransomware victims have learned the hard way, no single technology or practice is a panacea for blocking such attacks. In addition, one area of concern for security leaders remains having a patchwork of endpoint security solutions running across users’ systems, which they do not see as ideal.
In 2022, 2023 and again this year, 451 Research found that the mean number of endpoint security tools installed on endpoints is three, ranging from 2.66 on average for organizations with fewer than 250 employees, to 3.65 for organizations with more than 10,000 employees.
“The number of different tools, and agents, running on endpoints has long been a concern of security leaders as well as users due to performance issues, and 23% of respondents report that their organization is running more than five” such tools, 451 Research said.
Ransomware Groups Still Profiting
Even as organizations collectively work to improve their defenses, ransomware groups often respond by refining their strategies for hitting them with exfiltrating data, hitting them crypto-locking malware and attempting to make them pay.
In 2023, blockchain analytics firm Chainalysis said the illicit profits flowing to ransomware operations hit a record-breaking $1.1 billion. Estimates earlier this year suggest that 2024 could be just as lucrative for attackers.
Based on his ongoing discussions with CISOs, “the most concerning finding this year is that, while fewer respondents reported attacks, a significantly larger percentage of affected organizations paid the ransom,” Kennedy said in a post to social platform Mastodon. Specifically, he found that from 2023 to this year, the number of organizations that “experienced a ransomware attack” fell from 23% to 14%, while the percentage of victims that reported paying a ransom surged from 6% to 18%.
In other words, fewer victims overall – per 451 Research’s findings – doesn’t seem to be equaling less profit, at least for major cybercrime players. In particular, some groups – notably Black Basta – appear to have shifted to big-game hunting, meaning they often pursue very targeted attacks against large victims with deep ransom-paying pockets.
Not coincidentally, this year has featured a number of large organizations falling victim to ransomware, including the likes of UnitedHealth Group Change Healthcare, car dealership software provider CDK, Panasonic-owned logistics software maker Blue Yonder, and France’s second-largest telecommunications firm SFR.
Of those organizations, reportedly Change paid a $22 million ransom at least once to attackers, and CDK Global a $25 million ransom. Blue Yonder and SFR haven’t commented on whether or not they paid.