It is hard to overstate the level of havoc generated on global enterprises by year-over-year increases in ransomware attacks. Verizon Data Breach Investigations Report provides one state-of-the-world snapshot noting that the 13% increase in reported ransomware instances last year was greater than those measured across the preceding 5 years combined. It’s not surprising that ransomware readiness has moved up the list of most CISOs crowded priority sheets. And it needs to.
The fallout of hit-and-miss IR planning for ransomware attacks
Having an up-to-date incident response plan is a good foundational step for enhancing your organizational readiness for cyber incidents. However, when it comes to ransomware, the standard 48-hours-or-less response window associated with many double extortion ransomware attacks can create a real-world cybersecurity crisis for even those organizations with well-established IR plans.
It’s important to note that not all IR planning is cerated equal. For example. organizational IR plans prepared by a third-party in order to demonstrate industry-standard compliance to auditors can largely be discounted here. Generally, these IR plans were not developed with the up-to-the-moment threat landscape in mind, nor are they purpose-built for the nuances of a ransomware attack.
Even with comprehensive incident response planning, lack of advanced readiness for a ransomware attack places in-house IR (incident response) teams and general-purpose IR vendors in a reactive, catch-up mode. All the while, the 48-hour clock rapidly ticks away.
Research conducted by Hitachi and Enterprise Strategy Group (source: "The Long Road Ahead to Ransomware Preparedness," March 2022) indicates that 79% of organizational respondents had been financially or operationally impacted by ransomware attacks in the last year. 56% of those hit by ransomware paid their ransom, just 1-in-7 reacquired their unencrypted data.
Rethinking your ransomware readiness approach
Beyond the recent rise of double extortion ransomware attack instances, an evolving triple extortion model involves adding greater scale for cybercriminals by also extending the threat to the end-customers of the targeted company. In response, industry discussion of a ransomware preparedness model has emerged. For modern enterprises, effective ransomware readiness planning must involve:
- Up-front, automated, rapid collection of cloud, SaaS, IaaS, and PaaS log data, stored for longer-period timeframes than those stored by the providers themselves.
- An investigation and crisis management platform that then enables cross-organizational executive and technical teams to continuously visualize their level of cyberattack preparedness – including ransomware. That same console should be equipped to analyze emerging threats, differentiate exposure levels based on analysis of the extended forensic data baseline, provide guidance on how best to quickly remediate and provide recommended-practices on organizational communications when a breach occurs – including internal business functions, impacted customers, business partners, and, as necessary, regulators.
- Ongoing organizational ransomware readiness activities, including executive-level drills and tabletop exercises that review organizational processes and procedures to identify gaps and dependencies in incident response planning.
Taking the next steps toward ransomware readiness
Minimizing future risks associated with ransomware requires a strategic and proactive approach and the development of new organizational skillsets and technology to support appropriate action. Only then can security teams reach the response velocity that ransomware response timelines require.
Learn how ransomware readiness can protect your enterprise against the most dangerous cyberthreats by downloading our eBook.
