As ransomware and phishing attacks increase in frequency and sophistication, information security professionals remain apprehensive in their organizations’ abilities to protect themselves. When asked if their companies could recover from a ransomware infection without losing critical data, only thirty-four percent of the respondents said they are “very confident” they could do so. Tripwire asked the same question at both RSA Conference 2016 and Infosecurity Europe 2016, finding thirty-eight percent and thirty-two percent of respondents were “very confident,” respectively. “Successfully recovering from ransomware is well documented, whether through data recovery to paying ransom,” said Travis Smith, senior security research engineer at Tripwire. “It’s important for businesses to understand the costs associated with data recovery so that they’re prepared for a ransomware infection. Follow the 3-2-1 data backup rule: gather three copies of the data on two different types of media, with one of these copies stored off-site.”
The FBI has reported that ransomware attacks amassed over $200 million during the first three months of 2016, signaling that cyber criminals are on track to gain over $1 billion through ransomware by the end of the year. According to research from Malwarebytes, nearly 40 percent of businesses experienced ransomware attacks between June 2015 and June 2016. Ransomware infections can be spread through a variety of tactics, including spear-phishing, malvertising, exploit kits and more. Additional findings from the survey included:
- Fifty-three percent of the respondents were confident their executives could spot a phishing scam. Only forty-eight percent of the respondents at both the RSA Conference 2016 and Infosecurity Europe 2016 answered similarly.
- Only nineteen percent of the respondents considered ransomware one of the top two security threats their organizations face.
- Only twenty-two percent of the respondents considered phishing one of the top two security threats their organizations face.
Smith continued: “Training is a vital aspect of preventing successful phishing attacks, especially as spear-phishing and ‘whaling’ campaigns can be more difficult to detect. It’s increasingly important for executives and high-profile employees to be prepared. Users should assume links and attachments are guilty until proven innocent; verify the sender’s intent before trusting their data.”
