It is hard to overstate the level of havoc generated on global enterprises by year-over-year increases in ransomware attacks. Verizon Data Breach Investigations Report provides one state-of-the-world snapshot noting that the 13% increase in reported ransomware instances last year was greater than those measured across the preceding 5 years combined. It’s not surprising that ransomware readiness has moved up the list of most CISOs crowded priority sheets. And it needs to. 

The fallout of hit-and-miss IR planning for ransomware attacks

Having an up-to-date incident response plan is a good foundational step for enhancing your organizational readiness for cyber incidents. However, when it comes to ransomware, the standard 48-hours-or-less response window associated with many double extortion ransomware attacks can create a real-world cybersecurity crisis for even those organizations with well-established IR plans. 

It’s important to note that not all IR planning is cerated equal. For example. organizational IR plans prepared by a third-party in order to demonstrate industry-standard compliance to auditors can largely be discounted here. Generally, these IR plans were not developed with the up-to-the-moment threat landscape in mind, nor are they purpose-built for the nuances of a ransomware attack.

Even with comprehensive incident response planning, lack of advanced readiness for a ransomware attack places in-house IR (incident response) teams and general-purpose IR vendors in a reactive, catch-up mode. All the while, the 48-hour clock rapidly ticks away.

Research conducted by Hitachi and Enterprise Strategy Group (source: "The Long Road Ahead to Ransomware Preparedness," March 2022) indicates that 79% of organizational respondents had been financially or operationally impacted by ransomware attacks in the last year. 56% of those hit by ransomware paid their ransom, just 1-in-7 reacquired their unencrypted data. 

Rethinking your ransomware readiness approach

Beyond the recent rise of double extortion ransomware attack instances, an evolving triple extortion model involves adding greater scale for cybercriminals by also extending the threat to the end-customers of the targeted company. In response, industry discussion of a ransomware preparedness model has emerged. For modern enterprises, effective ransomware readiness planning must involve:  

  • Up-front, automated, rapid collection of cloud, SaaS, IaaS, and PaaS log data, stored for longer-period timeframes than those stored by the providers themselves.
  • An investigation and crisis management platform that then enables cross-organizational executive and technical teams to continuously visualize their level of cyberattack preparedness – including ransomware. That same console should be equipped to analyze emerging threats, differentiate exposure levels based on analysis of the extended forensic data baseline, provide guidance on how best to quickly remediate and provide recommended-practices on organizational communications when a breach occurs – including internal business functions, impacted customers, business partners, and, as necessary, regulators.
  • Ongoing organizational ransomware readiness activities, including executive-level drills and tabletop exercises that review organizational processes and procedures to identify gaps and dependencies in incident response planning.

Taking the next steps toward ransomware readiness

Minimizing future risks associated with ransomware requires a strategic and proactive approach and the development of new organizational skillsets and technology to support appropriate action. Only then can security teams reach the response velocity that ransomware response timelines require.  

Learn how ransomware readiness can protect your enterprise against the most dangerous cyberthreats by downloading our eBook. 

LAST UPDATED:

January 23, 2025

Don't miss these stories:

What CSPMs Can't Do for Your Cloud Security

In recent years, Cloud Security Posture Management (CSPM) tools have become increasingly popular, and with good reason. The posture management capabilities a CSPM provides can help an organization better understand cloud configuration to prevent potential security incidents.

Microsoft Breach by Midnight Blizzard (APT29): What Happened?

Understand the Midnight Blizzard Microsoft breach by APT29, what happened, and key steps organizations should take to strengthen their defenses.

What Most SOC Teams are Missing in Their Cloud Security

For decades, Security Operations Center (SOC) have been at the foundation of organizational security and risk mitigation. SOCs perform critical operations, helping to keep systems updated and handle the day-to-day monitoring of organizational IT.

Overcoming the Challenges of Securing SaaS

Generally speaking, when most CISOs think about their cloud security, they’re keyed into their cloud infrastructure held at big providers like AWS, Azure, and GCP. Their typical focus is on securing virtual machines, storage and networks that run on cloud infrastructure. All of this is hugely important.

How Behavioral Detections Aid Healthcare Security

Healthcare organizations face unique cybersecurity challenges due to their hybrid IT (information technology) environments, sensitive data, and resource constraints.

The Red Team Mindset: Why Adversarial Testing is Critical for Cloud Security

Attacks against cloud and SaaS deployments are unfortunately inevitable.