Ransomware Hit Nearly 50% Of Businesses In 2015: Study - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
IT Leadership // Security & Risk Strategy
News
8/3/2016
01:06 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ransomware Hit Nearly 50% Of Businesses In 2015: Study

Last year nearly half of businesses were attacked with ransomware, which caused 34% of enterprises to lose revenue and 20% to cease operations immediately.

9 Promising Cloud Security Startups To Watch
9 Promising Cloud Security Startups To Watch
(Click image for larger view and slideshow.)

Businesses are challenged to mitigate a growing danger from ransomware, which has become one of the world's biggest cyber-security threats.

This discovery comes from a new report called "State of Ransomware" (registration required) published by Malwarebytes. The anti-malware software vendor partnered with Osterman Research to learn more about the severity of the ransomware risk.

Their survey measured the frequency of cyber-security attacks, how attacks work within the enterprise, infiltration points, ransom cost, impact, and company preparedness, among other factors.

[Read: Companies lack the policies and knowledge for data theft prevention.]

Survey responses came from 540 CIOs, CISOs, and IT directors and managers knowledgeable about security. Participants represented companies with an average of 5,400 employees across the US, Canada, Germany, and the UK.

Results revealed nearly 80% of organizations surveyed have been the victim of a cyberattack, and 47% have been the target of a ransomware attack over the past 12 months. Of the enterprises targeted by ransomware, 34% lost revenue and 20% had to cease operations immediately.

"Over the last four years, ransomware has evolved into one of the biggest cyber security threats in the wild, with instances of ransomware in exploit kits increasing 259 percent in the last five months alone," wrote Nathan Scott, a ransomware expert and Malwarebytes' senior security researcher, in a statement.

It's a problem costing some businesses a lot of money. Nearly one-third of ransomware victims have received demands of $500 or less, an amount typically related to a spam-type of attack. Nearly 20% of victims have received demands exceeding $10,000, which is usually the sign of a more targeted attack.

However, not all businesses pay the ransom. On average, 37% of organizations surveyed said they pay the demanded ransom following an attack. Businesses in the US were far less likely to pay after being infected with ransomware, according to the report.

The most highly targeted companies of ransomware attacks are those in healthcare and financial services, which the report noted "comes as no surprise." Businesses in both industries heavily rely on access to business-critical information. As a result, they are top targets for cyber-criminals producing ransomware.

Businesses within the US have demonstrated commitment to addressing the ransomware threat. More than half consider investments in tech-based solutions and end-user ransomware education to be "high" or "very high" priority, according to survey respondents.

(Image: Mikkelwilliam/iStockphoto)

(Image: Mikkelwilliam/iStockphoto)

This is significant because the study found US businesses offer less ransomware-related training than businesses in other countries -- despite the fact that organizations in US experience higher levels of security-related attacks and "a significant level" of ransomware attacks.

The increased risk of ransomware arrives at a time when IT managers are struggling to hire employees with the right skills to defend corporate networks. A global lack of cyber-security talent is leaving businesses around the world vulnerable to attacks.

A report titled "Hacking the Skills Shortage," published by Intel Security, indicates the skill shortage is posing a danger to organizations. The majority of survey respondents (82%) report a lack of cyber-security skills, which has led to reputational damage and loss of proprietary data via cyberattack.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Author
8/22/2016 | 9:59:27 PM
Re: US cyber education
@vnewman2: Of course, regular people have known this for quite some time anyway.  Once staff starts considering the dictates of the IT department ridiculous and accordingly holds the IT department in low regard and disrespect, then no amount of policy can save you.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Author
8/22/2016 | 9:57:42 PM
Re: US cyber education
@tjgkg: I can certainly wait on biometrics.  I mean, don't get me wrong, multifactor is well and good.  But biometrics alone?  You only have ten fingers and ten toes -- compared to the number of possible passwords there are out there.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Author
8/22/2016 | 9:56:21 PM
Re: US cyber education
@tjgkg: Recent research has shown that mandating regular password changes actually decreases and lowers security -- particularly because people tend to pick similar passwords.  Consequently, if a password gets compromised, it may not be difficult to guess what the changed password is -- particularly if multiple samples are available/compromised.

Plus, anything that makes people hate the IT department is just going to wind up causing more harm than good as people find ways around the rules and protocols.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Author
8/4/2016 | 6:03:11 PM
Re: US cyber education
@vnewman: One InfoSec guy I interviewed earlier this year told me (and it wasn't the first time I'd heard this tip; I've used/advised it myself with consulting clients, but this was an especially notable guy, so it made me feel especially pleased and vindicated) that what he does at his company is have as part of the employment agreement, "You agree to not use any of your company passwords for anything else.  If you do, and we find out, you're fired."

He went on to note that no one has ever been fired for that policy and that, realistically, probably no one ever would and that the policy is almost completely unenforceable, but just having that language in there compels people to think about it more and have it top of mind -- so they don't engage in that behavior.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Author
8/4/2016 | 6:00:09 PM
Re: US cyber education
@Whoopty: I see it as a casualty of our sociocultural environment right now.

On the primary/secondary side, all the bickering is over testing, hard academics, arts, and especially Common Core.

Meanwhile, we are still (unfortunately) at a point where most people think that "the only way to get a good job" is to go (heavily in debt to go) to college -- and the most expensive one, at that.

Meanwhile, nobody's focusing on what the world needs, what society needs, what our country needs.

Oh, well.  That's none of my business.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Author
8/3/2016 | 5:28:01 PM
US cyber education
Exacerbating the issue is that the US, unlike other countries, places far too little (if any, ever) importance on cybereducation, coding, and cybersecurity.

Other nations teach cybersecurity at the secondary-education level -- which is precisely what we should do here.  Instead, we're lucky if a high school has a computer club for a few enthusiasts.

InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

News
Becoming a Self-Taught Cybersecurity Pro
Jessica Davis, Senior Editor, Enterprise Apps,  6/9/2021
News
Ancestry's DevOps Strategy to Control Its CI/CD Pipeline
Joao-Pierre S. Ruth, Senior Writer,  6/4/2021
Slideshows
IT Leadership: 10 Ways to Unleash Enterprise Innovation
Lisa Morgan, Freelance Writer,  6/8/2021
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Planning Your Digital Transformation Roadmap
Download this report to learn about the latest technologies and best practices or ensuring a successful transition from outdated business transformation tactics.
Slideshows
Flash Poll