ACCORDING to Cybersecurity Ventures, ransomware will cost its victims around $265 billion by 2031. In the first half of 2023, Check Point Research’s 2023 Mid-Year Report found that 48 ransomware groups reported breaching and publicly extorting more than 2,200 victims around the world. 45 percent of the attacks were against US-based organizations — far and away more than any other country.
According to Verizon’s 2023 DBIR report, 24 percent of all breaches involved ransomware. And these ransomware attacks are disproportionately focusing on manufacturing, retail and software services. It’s interesting to note that while government, health care and education are the most attacked industries — they are not the main focus for ransomware.
What is ransomware?
Ransomware is a malware designed to deny an organization access to files or data on their computer. Cybercriminals encrypt the data and demand a ransom payment for the decryption key, hoping the victim would pay to regain access. In double-extortion ransomware attacks, if the ransom isn’t paid, the bad actors would sell the stolen data or publish it in public forums.
Increasingly, cybercriminals are resorting to triple extortion where they blackmail individual employees or victims into paying for their data. A recent example is from a plastic surgery clinic in which the clinic refused to pay the ransom, so the hackers contacted patients and threatened to release their health records if they didn’t pay up. At least 70 patients had their health data and photographs published, and one patient is now suing the clinic.
Six practical tips
In order to prevent ransomware attacks, organizations need to exercise good security hygiene across on-premise, cloud and hybrid networks, all the way up to the board level. There are several actions that leaders could take to minimize exposure to and the potential impacts of an attack.
Robust data backup. The goal of ransomware is to force the victim to pay a ransom in order to regain access to their encrypted data. However, this is only effective if the target actually loses access to their data. A robust, secure data backup solution is an effective way to mitigate the impact of a ransomware attack.
Cyber awareness training. Phishing emails are one of the most popular ways to spread ransomware. By tricking a user into clicking on a link or opening a malicious attachment, cybercriminals gain access to the employee’s computer and begin the process of installing and executing the ransomware on it. Frequent cybersecurity awareness training is crucial to protecting the organization against ransomware, leveraging their own staff as the first line of defense in ensuring a protected environment. This training should instruct employees on the classic signs and language that are used in phishing emails.
Up-to-date patches. Keeping computers up-to-date and applying security patches, especially those labeled as critical, could help to limit an organization’s vulnerability to ransomware attacks, as such patches are usually overlooked or delayed too long to offer the required protection.
Strengthening user authentication. Enforcing a strong password policy, requiring the use of multi-factor authentication, and educating employees about phishing attacks designed to steal login credentials are all critical components of an organization’s cybersecurity strategy.
Anti-ransomware solutions. Anti-ransomware solutions monitor programs running on a computer for suspicious behaviors commonly exhibited by ransomware, and if these behaviors are detected, the program could take action to stop encryption before further damage could be done.
Utilize AI-powered threat prevention. Most ransomware attacks could be detected and resolved before it is too late. Automated threat detection and prevention could maximize your chances of protection, including scanning and monitoring of emails, and scanning and monitoring file activity for suspicious files. AI has become an indispensable ally in the fight against cyberthreats. By augmenting human expertise and strengthening defense measures, AI-driven cybersecurity solutions provide a robust shield against a vast array of attacks. As cybercriminals continually refine their tactics, the symbiotic relationship between AI and cybersecurity would undoubtedly be crucial in safeguarding our digital future.
While ransomware attacks could indeed be scary, it is possible to prevent or at least lessen their impact by utilizing the six steps above. And before you pay a ransom, remember that there is no guarantee that you would get your data back or that the hacker would not release it publicly. In fact, by paying a ransom, you are funding the hackers’ efforts and letting other criminal efforts know that you are willing to pay. So focus on preventing the breaches in the first place.