Nearly Two-Thirds of Ransomware Victims Paid Ransoms in 2021
Leading research and marketing firm CyberEdge Group, which serves companies in the cybersecurity industry, just published its ninth Cyberthreat Defense Report (CDR). This report acts as the standard for gauging organizations’ security postures, documenting the perceptions of information technology professionals and showing how industries plan to invest in their security infrastructures. The CDR’s findings underscore the increasing role that ransom attacks are playing in our current cybersecurity environment. According to the CDR, 71 percent of the organizations surveyed were the victims of successful ransomware attacks last year. This figure was up significantly from 55 percent in 2017. Almost two-thirds of the companies that experienced ransomware attacks paid the requested ransom, up from only 39 percent in 2017. The CDR hypothesizes that there are three reasons for this increase: The threat of public exposure of highly sensitive data. Lower cost. Companies believe that it will be less costly to pay the ransom than to experience lengthy downtimes, customer unhappiness, and potential lawsuits that could come to pass if they attempt to fight the criminals. Greater confidence that the ransomed data will be successfully recovered. All of these factors seem to have combined to make the instigators of ransomware attacks even more motivated to keep launching them. Even so, other internal reasons at play could explain the continued success that cyber attackers are enjoying. The CDR points to two additional elements, lack of skilled personnel and low-security awareness among employees. The report also indicates that a whopping 84 percent of organizations surveyed are amid a severe shortage of IT security personnel. There are also shortfalls when it comes to security administrators, analysts, and architects. Combine these lacks with insufficient ongoing training of employees that protects against email phishing and emphasizes the importance of strong passwords. The way is paved for digital criminals to insert themselves into digital systems. The report also detailed several other interesting findings: 83 percent of responding organizations have increased their security budgets, with the average being by 4.5 percent. The hottest security technology includes next-generation firewalls, deception technology to promote endpoint security, bot management, biometrics, and advanced security analytics. The most challenging items to keep secure include mobile devices, industrial control systems/supervisory control and data acquisition (ICS/SCADA)devices, and the internet of things (IoT). Nearly two-thirds of the responding organizations have put mechanisms in place designed to protect Application programming interfaces (APIs). When it comes to attacks on web and mobile applications, personally identifiable information (PII) is at most risk. Companies are also experiencing harvesting and account takeover (HATO) attacks that are of increasing concern. The most worrying hybrid security challenges include detecting unauthorized application usage and identifying and responding to cyber threats. Cloud and software security specialty certifications are in high demand by nearly all IT professionals surveyed. Combining app and data security into a unified platform is cited as leading to an improved cloud security posture and enhanced security incident investigations. Security teams are protecting remote workers with anti-virus and VPN products, SD-WAN, network access control (NAC), and mobile device management (MDM) solutions in response to the ongoing trend of working at home. The majority of respondents are embracing emerging security technologies, including SD-WAN, zero-trust network architectures, and security access service edge (SASE). The CDR respondents were made up of 1,200 IT security practitioners and decision-makers employed by a commercial or government entity with a minimum of 500 employees. Participants came from different geographic regions: North America, Europe, Asia Pacific, the Middle East, Latin America, and Africa. The data was compiled based on their answers to a 27-question online survey.
Mobile Threats Skyrocket
Although mobile devices are portable, powerful, and convenient, their use in employees’ jobs is coming at a price. The very features that make them compelling also render them especially vulnerable to hacking. Data shows that nearly one-third of zero-day attacks now focus on tablets and smartphones. In its most recent mobile threats annual report, Zimperium revealed some disturbing statistics. Nearly 25 percent of the mobile devices studied came in contact with malware during the past year. It happens when users click on a malicious link or open a malicious attachment, enabling hackers to access sensitive systems and data. Sixty-one percent of users experienced increased email phishing attacks, which are now more than ever being modified to target mobile devices. That is possible because the small screens on smartphones and tablets make seeing the complete website URL more difficult. It opens the door for users to misperceive what they see or make other types of mistakes. The survey also indicated that 13 percent had corrupted their data by a machine-in-the-middle attack, and 12 percent were directed to a malicious website. The upsurge in these incidents is due, at least in part, to the increase in mobile device exposures and vulnerabilities, which have risen to over 900, that affect Apple iOS or Android. An uptick exacerbates the situation in misconfigurations and risks from the third-party components developers use. As has been the case with virtually every aspect of our lives, the coronavirus pandemic is partly to blame for the rise in these mobile crimes. As more people began to do their work from home, their use of smartphones and tablets rose. In response to this trend, nearly two-thirds of the organizations surveyed now have enacted a bring-your-own-device (BYOD) policy, with a full 11 percent more planning to implement one shortly. Before the pandemic, only 40% of the surveyed companies had put these protocols in place. According to the Zimperium report, at least 75 percent of technology professionals use at least four applications on their mobile devices to do their regular work tasks. Even after the direct effects of the coronavirus have waned, it will have forever changed not only the work methods that people use but also the security landscape surrounding them.
Hacked US Companies to Face New Reporting Requirements
When cybercriminals target sensitive data or charge companies or agencies a ransom to retrieve their encrypted information, the consequences can be dire. In response, Congress has passed a bill that will require that entities who deal with critical US security-related information must now report when digital criminals victimize them. Should they fail to comply with any subpoena generated by this process, they will be referred to the Justice Department for Investigation. Thanks to this increased governmental oversight, federal officials will be able to have a complete picture of the ongoing effects of hacking on our nation’s well-being. The measure has been implemented in response to a surge in ransomware attacks and other digital crimes in the US and worldwide. In the past year alone, criminals targeted the largest US fuel pipeline and the world’s biggest meat-packing company, disrupting the economy and traumatizing affected citizens. Additionally, state terrorists continue to attack critical infrastructure. The most notable instance is the Russia-backed SolarWinds espionage campaign. Experts are concerned that the Russian war in Ukraine will open the door to an uptick in cyberattacks by state actors and their proxies, many of whom reside in Russia. “As our nation rightly supports Ukraine during Russia’s illegal, unjustifiable assault, I am concerned the threat of Russian cyber and ransomware attacks against US critical infrastructure will increase,” said Sen. Rob Portman, a Republican from Ohio. The solution is to be proactive. The reporting legislation, written by Michigan Sen. Gary Peters and approved by the House and Senate, is expected to be signed into law by President Joe Biden soon. The rule stipulates that any entity deemed part of the country’s critical infrastructure must report any “substantial cyber incident” to the government within three days. If a ransomware payment is made, officials must be notified within 24 hours. When hacking and ransomware incidents occur, reports should be sent to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. In an unusually public disagreement, the FBI expressed concerns and unsuccessfully pressed for tweaks to the bill. Specifically, the agency’s officials were concerned that the reporting methods to be instituted might be too complex, resulting in delays in accessing critical information. Furthermore, they worry that victims who report security incidents to the FBI may not enjoy the same liability protections as those through the Cybersecurity and Infrastructure Security Agency. The legislators who wrote the law assure critics that these concerns were addressed in the final draft of the legislation.
TSA Requires Rail and Airports to Strengthen Cybersecurity
Earlier this year, a ransomware attack on the Colonial pipeline severely interrupted the country’s fuel distribution system. In response, regulations were implemented in May that strengthened the cybersecurity infrastructure of the pipeline system. In light of this recent upsurge in data breaches and ransomware attacks that have victimized multinational corporations, institutions, and companies. The U.S. Transportation Security Administration (TSA) is now also protecting the nation’s passengers and the companies that convey them. The Biden administration recently issued a series of recommendations and directives designed to bolster the country’s digital underpinnings to protect it against attack. Most notably, the updated regulations hold passenger and freight operators accountable by requiring them to become intentional about their cybersecurity. To accomplish this, each major provider must now appoint a specific person or team to assess cybersecurity. Should an incident occur, it must be reported within 24 hours to the Cybersecurity and Infrastructure Security Agency. Additionally, all companies are expected to assess their digital assets, practices, and procedures to identify and address vulnerabilities. Finally, each must create and implement a plan that addresses how the organization will recover from the breach and alternative contingency strategies to minimize service interruptions. These rail carrier-related measures will take effect at the end of the year, with similar action plans soon required at large airports. The TSA still recommends making cybersecurity a priority for smaller rail and airport operators who do not fall under the mandates. Not all lawmakers in Washington are in favor of this TSA initiative. Some Republican officials are concerned that the regulations were pushed through without sufficient transparency and feedback from industry stakeholders. Concern was also centered on a fear that financial assets and attention would be focused more on regulatory compliance than on addressing the cyber threats directly. The TSA answered these criticisms by maintaining that the regulations were only enacted after extensive consultation with industry executives and other officials.
U.S. Gov Announces Support for ‘Paris Call’ Cybersecurity Effort
On November 10, 2021, U.S. Vice President Kamala Harris re-established the nation’s presence on the international stage by formally announcing the country’s support of the Paris Call for Trust and Security in Cyberspace. This initiative, first issued in 2018, is a collaborative effort to enhance cybersecurity around the globe that 79 nations have already endorsed. The Paris Call contains nine principles designed to enhance cybersecurity through multinational cooperation. These include the following: Protecting infrastructure and individuals Guarding against acts that jeopardize internet availability Safeguarding the electoral process Defending intellectual property Preventing the spread of malware and other criminal practices Overall enhancement of digital services, products, and processes Bolstering cyber hygiene Thwarting non-state actors’ attempts to hack Promoting international cyber norms and practices. Joining in with this collaborative effort sends a message to the world that the United States is committed to robust cybersecurity and safe internet for all citizens of the globe. To implement these tenets, Vice President Harris stated that the U.S. would work with governments, private companies, and civil society to promote cooperation, cyber hygiene, stability, and accountability. The United States’ decision to hoist the banner of the Paris Call comes at a crucial juncture. In an era when rogue terrorist groups and even state-sponsored bad actors are wreaking havoc on corporate, institutional, and small business systems in countries throughout the Americas, Europe, Asia, and Africa, stakeholders are choosing to band together in solidarity. By promoting a mutual commitment to stability that holds criminals responsible for their actions, the Paris initiative may prove to be the world’s first practical and unified cybersecurity plan.
House Passes Two Bills to Improve Small Business Cybersecurity
The U.S. Congress recently passed two bills aimed at bolstering data security measures for small businesses. These pieces of legislation would strengthen the Small Business Administration’s oversight, mitigate vulnerabilities and give entrepreneurs the tools to manage their network hygiene effectively. The first bill, the Small Business Administration (SBA) Act, was introduced by Representatives Yung Kim, a Republican from California, and Jason Crow, a Democrat from Colorado. It is designed to give the SBA more clout in addressing and documenting the increasing number of attacks on small business systems. To that end, the bill requires that the SBA expand its own IT operations, mandating documentation of its cybersecurity infrastructure, equipment and tools, improvement strategies, and reports of any security events in the agency. The second bill, the Small Business Development Center Cyber Training Act, was sponsored by New York Republican Andrew Garbarino with endorsement from Ohio Republican Steve Chabot and Pennsylvania Democrats Chrissy Houlahan and Dwight Evans. This bill would provide entrepreneurs with the support they need to take control of their cybersecurity. Furthermore, the legislation would give local Small Business Development Centers the financial resources necessary to provide cybersecurity certification training to owners and their employees. In an era when data breaches and ransomware attacks are devastating even the smallest companies, the U.S. House of Representatives is taking proactive steps on two levels. To exercise broader control, it works to support and enhance the capabilities of the SBA. At the same time, it’s more granular actions equip local business centers and the small companies they serve with the resources they need to take ownership of their digital security awareness and practices. With legislation furnishing the infrastructure and companies taking ownership of their daily cyber activities, there is sure to be a positive impact.
Basic Security Lapses Pave the Way for Ransomware Attacks in 2021
On the surface, ransomware attacks seem sophisticated and complex. Seemingly out of nowhere, criminals gain access to a company’s or institution’s data or systems, locking the rightful owners out unless and until they pay a hefty price. Due to their random and devastating nature, it is easy for security teams to adopt a fatalistic attitude about ransomware attacks, mistakenly believing that they can do little or nothing to avoid them. In its 2021 State of Ransomware Preparedness report, Axio revealed the fallacy of this line of thinking. As it turns out, many organizations have severe flaws in the underlying foundations of their security practices that make them more vulnerable to ransomware attacks. Specifically, there are seven key areas where organizations are falling short when it comes to security policies and practices: • Basic cybersecurity hygiene • Managing who has access to administrative privileges • Supply chain risk assessment • Security incident management • Network monitoring • Vulnerability management • Training and security awareness. The vast majority of the organizations surveyed are ill-prepared for a ransomware attack. For instance, the data indicates the following: • Almost 80 percent of them have either not implemented or only partially put in place a privileged access management strategy; • Only 36 percent of the surveyed organizations audit the use of service accounts • Only 26 percent deny the use of command-line scripting tools by default • Only 31 percent limit internet access to their Windows domain controller hosts • Only 29 percent conduct thorough evaluations of third-party vendors’ security postures before allowing them access to their data and systems • Only half of those surveyed conduct yearly training regarding email and web-based security threats. While ransomware and other cybercrimes seem to be a permanent fixture on the threat landscape, enacting preventive measures to bolster these cybersecurity foundations can minimize organizational risk.
Sun Tzu’s ‘The Art of War’ Applied to Cybersecurity
In roughly the 5th century BC, the Chinese strategist Sun Tzu wrote a treatise that has long been one of the most famous military classics in the entire world. Its themes have profoundly affected not only Asian warfare but also have expanded to influence legal strategies, business principles, and, most recently, even cybersecurity. Specifically, Sun Tzu had a lot to say about the most effective ways to prepare for conflict and address it when it happens. They cite the importance of utilizing mental weapons of strategy and forethought before ever resorting to the physical battle. There is no doubt that Sun Tzu’s ideas are highly relevant in the arena of digital security. Perhaps the most glaring and easily exploited weakness of an organization stems from its established policies and practices. Unless a business is just starting from the ground up, its chief information security officer will have inherited a long-standing set of cybersecurity systems and protocols. Making extensive changes would not only be expensive but would also force staff to move out of their comfort zones. The result tends to be systems built on unstable foundations that are not equipped to change and pivot with today’s rapidly evolving threat landscape and prevention, detection, and remediation technologies. How do Sun Tzu’s principles relate to effective cybersecurity? When followed to their logical conclusions with robust digital protection strategies, the following three tenets can be highly effective. “Know Thyself, know thy enemy.” In a nutshell, this refers to undergoing a comprehensive threat mapping and risk assessment process. Conducting a complete audit of all company functions enables the security team to identify critical data, reveal gaps and leaks in the digital infrastructure, and measure and prioritize risks. Only then can the team predict and categorize the adversaries that pose the most significant security threats. “Tactics without strategy is the noise before defeat.” This phrase refers to the strength of an organization’s incident response protocols, which should be determined long before a breach occurs. Superior strategies involve multi-prong approaches that combine technology with human expertise and strict adherence to monitoring and logging procedures. “Subdue the enemy without fighting.” Protecting critical assets is best accomplished by preventing attacks with robust security measures. It happens when the team thoroughly understands activity baselines to identify and act upon anomalies quickly. As Sun Tzu would no doubt agree, war is not a single incident – it is usually a series of battles that include setbacks, stalemates, and victories. When it comes to safeguarding digital assets, organizations will do well to keep this and Sun Tzu’s principles in mind as they construct and maintain solid digital security measures that readily evolve with changing technologies and threats.
Banking Industry Hijacked by Ransomware Attacks in 2021
The headlines continue to buzz with news about ransomware attacks launched against educational institutions, hospitals, corporations, and banks. A recent TrendMicro report confirms that these third-party malware attacks remain prevalent. They happen when cybercriminals block access to a company’s data or systems until the entity pays the price set by the criminals. Only then is the information unencrypted and restored to its rightful owner. Although many industries continue to suffer from ransomware attacks, the banking sector has felt the sting more than most. In the first half of 2021 alone, that sector experienced a 1318 percent year-on-year increase in ransomware attacks. That underscores the importance of maintaining a continuous focus on cutting-edge cybersecurity, including but not limited to promoting a culture of awareness among staff. Why are banks so vulnerable? The answer lies in financial institutions’ ready access to monetary resources. They cannot afford to have their processes and activities interrupted for any length of time, making them more amenable to speedy, discreet settlements. This does not, however, mean that banks have no recourse against ransomware incursions. Even though criminals are becoming increasingly sophisticated in their techniques, cybersecurity professionals are equally persistent and vigilant. To the extent that banks can maintain excellent cyber hygiene and avoid reinforcing bad behavior by paying the ransom requested, these forms of cybercrime may be limited. Augmenting individual best practices with a robust international commitment to threat reduction will also go a long way toward minimizing the impact of this highly distressing and financially arduous form of crime.
Gaming Industry Under Attack
In December of 2020, after much fanfare, the CD Project Group launched Cyberpunk 2077. However, contrary to the hype, the game was riddled with bugs and soon earned a cascade of blistering customer feedback. Two months later, hackers capitalized on the game’s bugs, stealing encrypted data and hijacking source code. As if that was not disturbing enough, criminals recently revealed that they have gained access to internal details about employees and customers and have disseminated it onto the internet. The Poland-based CD Project Group is combating this cyber attack by working closely with security experts and law enforcement officials both in-country and internationally. Furthermore, they are taking the following internal steps: Implementation of next-generation firewalls with state-of-the-art anti-malware protection Deployment of a new remote-access solution Limitation to the number of privileged accounts and access rights Updated mechanisms for protecting servers, endpoints, and networks Improvement of event-monitoring systems Expansion and cutting-edge training of internal security department Collaboration with gold-standard external information security and IT specialists Although the gaming industry has been particularly hard hit in the past few months, the techniques used by hackers to compromise their systems are also being weaponized to harm public and private companies of all kinds. With ransomware attacks such as this one on the rise throughout the digital sector, teams from all industries are learning to note the techniques the attackers use and the reactive and preemptive measures the affected companies enact. One commonality between gaming and other industries is their increased use of and reliance on mobile cloud-based technology. Hackers exploit these mobile applications while simultaneously taking advantage of customers’ ignorance about security practices and/or their lazy or careless attitudes when keeping the digital infrastructure safe. Security teams across all industries can learn the importance of vigilance and cutting-edge innovation from their gaming counterparts. More than anyone else, companies like the CD Project Group can be models of forward-thinking digital hygiene that can ultimately become the standard across the entire cyber landscape.
