More than half (53 percent) of 225 US organizations surveyed by Trend Micro were victims of a ransomware attack in the last year and 42 percent didn’t know how often they were attacked.
Yet three of five (59 percent) surveyed in the Ransomware Response Study believe their current ransomware defenses are “superior,” showing a disconnect between the perception of organizational security defenses and the number of effective ransomware attacks, says Trend Micro.
“This survey reinforces the need for security leaders to understand their company’s defenses, and make calculated improvements to prevent and detect ransomware attacks in 2017,” said Ed Cabrera, chief cybersecurity officer for Trend Micro.
“Security leaders often rely on backups and traditional defenses to protect against ransomware. Cybercriminals know this and understand that some regular security measures, like patching, vary greatly in frequency, and they will target these weaknesses quickly using exploit kits to deliver ransomware before a company can address the issue.”
Trend Micro has observed an average of 10 new ransomware families per month, and the survey confirmed this startling growth with nearly one in five (19 percent) organizations reporting they are each hit by ransomware more than 50 times per month. A majority of respondents (60 percent) pinpoint susceptibility of employees as the primary entry method allowing attacks to penetrate an organization, while 65 percent of ransomware stems from compromised websites, likely clicked on from an email by an unsuspecting employee.
High profile challenge
“Ransomware became one the highest profile challenges facing cybersecurity professionals in 2016,” said Tom Field, vice president of editorial at ISMG. “Based on our research, we feel that nothing indicates a slowing down of this problem, in fact, we may have only scratched the surface. With organizations reporting that their own employees are their greatest threat exposure, I expect a drastic increase in training, awareness and vigilance across all organizations in 2017.”
Business disruption was reported as the greatest consequence from ransomware attacks (59 percent), followed by reputational damage (28 percent). IT leaders have largely resisted ransomware schemes, with nearly eight out of 10 respondents (77 percent) acknowledging they have never paid ransom as a result of an attack, while only two percent report they had paid.
Companies are relying heavily on data backup and recovery plans (78 percent of respondents) as the primary defense against ransomware. However, a holistic defense strategy to detect and prevent ransomware attacks from infiltrating an organization has proven to be most successful.
A multi-layered approach to security, as recommended by Trend Micro, with protection at email and web gateways, endpoints, networks and servers, will better protect businesses and mitigate the risk of ransomware.
The survey was conducted in mid-2016 and received more than 225 responses from a variety of industries in the U.S., including government, healthcare and financial services.
