Ransomware continues to be a major issue across the globe, with 54% of organizations surveyed hit in the last year and a further 31% expecting to be victims of an attack in the future.
That’s according to the Sophos State of Endpoint Security Today survey, which shows the extent to which businesses are at risk of repeated ransomware attacks and are vulnerable to exploits. The survey polled more than 2,700 IT decision makers from midsized businesses in 10 countries worldwide, including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India and South Africa.
On average, respondents impacted by ransomware were struck twice—which is not an inexpensive state of affairs. According to the report, the median total cost of a ransomware attack was $133,000. This extends beyond any ransom demanded and includes downtime, manpower, device cost, network cost and lost opportunities. A few (5%) of those surveyed reported $1.3 million to $6.6 million as total cost.
“Ransomware is not a lightning strike – it can happen again and again to the same organization. We’re aware of cybercriminals unleashing four different ransomware families in half-hour increments to ensure at least one evades security and completes the attack,” said Dan Schiappa, senior vice president and general manager of products at Sophos. “If IT managers are unable to thoroughly clean ransomware and other threats from their systems after attacks, they could be vulnerable to reinfection. No one can afford to be complacent. Cybercriminals are deploying multiple attack methods to succeed, whether using a mix of ransomware in a single campaign, taking advantage of a remote access opportunity, infecting a server or disabling security software.”
This relentless attack methodology combined with the growth in ransomware-as-a-service, the anticipation of more complex threats and the resurgence of worms like WannaCry and NotPetya puts businesses in serious need of a security makeover, according to Sophos.
“Organizations of all sizes are starting 2018 with inadequate protection against ransomware, despite last year’s international headlines,” said Schiappa. “Given the ingenuity, frequency, and financial impact of attacks, all businesses should re-evaluate their security to include predictive security technology that has the capabilities needed to combat ransomware and other costly cyber-threats.”
The report also uncovered that IT professionals also need to be aware of how exploits are used to gain access to a company’s system for data breaches, distributed-denial-of-service attacks and crypto-mining. The survey revealed considerable misunderstanding around technologies to stop exploits, with 69% unable to correctly identify the definition of anti-exploit software. With this confusion, it’s not surprising that 54% do not have anti-exploit technology in place at all. This also suggests that a significant proportion of organizations have a misplaced belief that they are protected from this common attack technique yet are actually at significant risk.
“The lack of awareness and lack of protection against exploits is alarming. We’ve seen a resurgence in cybercriminals looking for vulnerabilities to actively use in countless attack campaigns,” said Schiappa. “Five or six years ago we saw one per year, and last year as many as five new Office exploits have been used for cybercriminal activity, according to SophosLabs. When cybercriminals are deliberately seeking out both known and zero-day vulnerabilities and an organization has a deficit in defenses, it adds up to a bad security situation.”