It is hard to overstate the level of havoc generated on global enterprises by year-over-year increases in ransomware attacks. We can point to any number of analyst findings to substantiate this position, but the latest Verizon Data Breach Investigations Report provides a credible, state-of-the-world snapshot. Their headline this year notes that the 13% increase in reported ransomware instances last year was greater than those measured across the preceding 5 years — combined. 

The fallout of hit-and-miss IR planning for ransomware attacks

Enhancing your organizational readiness with an up-to-date Incident Response plan is a common-sense approach for confronting your next cyberattack. However, when it comes to ransomware, the standard 48-hours-or-less response window associated with many double extortion ransomware attacks creates a real-world cybersecurity crisis for even those organizations with well-established IR plans. 

 A cautionary note — an organizational IR plan prepared by a third-party to demonstrate industry-standard compliance to auditors can largely be discounted here. Generally, these IR plans were not developed with the up-to-the-moment threat landscape in mind, nor are they purpose-built for the nuances of a ransomware attack.

 Even with comprehensive Incident Response planning, lack of advanced readiness for a ransomware attack places in-house Incident Response or general-purpose IR vendors in a reactive, catch-up mode as the 48-hour clock rapidly ticks away.

 Recent research findings indicate 73% of organizational respondents had been financially or operationally impacted by these ransomware attacks in the last year. When 56% of those hit by ransomware paid their ransom, just 1-in-7 reacquired their unencrypted data. 

Rethinking your ransomware readiness approach

Beyond the recent rise of double extortion ransomware attack instances, an evolving triple extortion model involves adding greater scale for cybercriminals by also extending the threat to the end-customers of the targeted company. In response, industry discussion of a ransomware preparedness model has emerged. We believe effective ransomware readiness planning to counterattack threat actors before an incident is suspected must involve:  

• Up-front, automated, rapid collection of cloud, SaaS, IaaS, and PaaS log data, stored for longer-period timeframes than those stored by the providers themselves.
• An investigation and crisis management platform that then enables cross-organizational executive and technical teams to continuously visualize their level of cyberattack preparedness – including ransomware. That same console should be equipped to analyze emerging threats, differentiate exposure levels based on analysis of the extended forensic data baseline, provide guidance on how best to quickly remediate and provide recommended-practices on organizational communications when a breach occurs – including internal business functions, impacted customers, business partners, and, as necessary, regulators.
• Ongoing organizational ransomware readiness activities, including executive-level drills and tabletop exercises that review organizational processes and procedures to identify gaps and dependencies in incident response planning.

It’s hard to keep cool when a ransomware attack includes a timeline that even the best IR plans may have not been designed to address. The automated Migita Cloud Incident Readiness and Response (IR²) solution enables your organization to respond to and recover from breaches faster than humanly possible. With IR², Mitiga emphasizes ransomware readiness by executing and testing IR processes prior to an incident, Readiness-first means validating completeness and accessibility of key forensic cloud data, with Mitiga-enriched storage assuring your incident response commences within 4 hours of notification, with minimal disruption to your customers or business. 

Taking your first steps toward ransomware readiness

Unfortunately, breaches are inevitable occurrence to today’s cloud-based digital technology environments. Minimizing future risk with ransomware readiness is the best course of action in quickly getting you back to business.

 Learn how ransomware readiness can protect your enterprise against the most dangerous cyberthreats by downloading our eBook. 

‍