Perception vs reality: how to really prepare for ransomware

Check out all the Smart Security Summit on-demand sessions here.

It seems like most IT environments haven't made the connection between ransomware and the importance of a good protection system. This is easy to deduce by reading a recent IDC survey of over 500 CIOs from over 20 industries around the world.

The most striking stat from the IDC report is that 46% of respondents have been successfully attacked by ransomware in the past three years. This means that ransomware has overtaken natural disasters to become the number one reason to be good at performing large data restores. Many years ago, the main reason for these restores was hardware failure, as the failure of a disk system often meant a complete restore from scratch.

The advent of RAID and erasure coding changed all that, bringing natural disasters and terrorism to the forefront. However, the odds of a business falling victim to a natural disaster were actually quite low, unless you lived in certain disaster-prone areas, of course.

Lost money, lost data

That 46% basically means that your chances of being hit by ransomware are a coin flip. Worse still, 67% of respondents paid the ransom and 50% lost data. Some reviewers downplayed the 67%, suggesting these organizations may be responding to a ransomware tactic known as extortionware.

Event

On-Demand Smart Security Summit

Learn about the essential role of AI and ML in cybersecurity and industry-specific case studies. Watch the on-demand sessions today.

look here

In this scenario, a company will receive a request such as "Give us $10 million, or we'll release your organization's worst secrets." However, even if we put that stat aside, we still end up with the fact that half of the organizations affected by ransomware lost critical data. That's two coin tosses. It's not good, as they say.

Ready for an attack? Probably not

The story gets worse though. Surprisingly, the same organizations that were attacked and lost data seemed to place great importance on their ability to react to such events. First, 85% of respondents said they have a cyber recovery playbook for detecting, preventing, and responding to intrusions. Any organization is likely to answer "absolutely" if you ask them if they have a plan like this.

In fact, you might even ask what's going on with the 15% who don't seem to need it. They're like the fifth dentist in the old Dentyne ad that said, "Four out of five dentists surveyed recommended sugar-free gum to their gum-chewing patients." If your organization does not have a cyber recovery plan, the fact that so many businesses have been attacked should hopefully motivate your management to make this change.

An organization should be forgiven for being attacked by ransomware in the first place. Ransomware is, after all, an ever-evolving field where malefactors constantly change tactics to gain ground. What's hard to fathom is that 92% said their data resilience tools were "effective" or "very effective." It goes without saying that an effective tool should be able to recover data in such a way that you don't have to pay the ransom - and you certainly shouldn't lose any data.

Minimize attack damage

There are several key elements...