ExtraHop has released findings from a new survey on ransomware that sheds light on the discrepancies between how IT decision makers (ITDMs) see their current security practices, and the reality of the ransomware attack landscape. The ExtraHop Cyber Confidence Index 2022 report shows that however capable IT organizations have been in managing the dramatic transformations of the past couple of years, confidence still tends to outstrip actual security posture.
The survey, conducted by Wakefield Research, found that 77 percent of ITDMs are very or completely confident in their company's ability to prevent or mitigate cyber security threats. Despite this confidence, 64 percent admit that half (or more) of their cyber security incidents are the result of their own outdated IT security postures, including widespread use of insecure and deprecated protocols, as well as growing numbers of unmanaged devices. This inflated confidence is even more dangerous in light of the frequency of ransomware attacks - as 85 percent reported having suffered at least one ransomware attack, and 74 percent reported experiencing multiple incidents in the past five years.
Other key survey findings include:
- The cost of ransomware is high: 72 percent of respondents admitted to ever paying a ransom while 42 percent of companies that suffered a ransomware attack said they paid the ransom demanded most or all of the time.
- The business impacts of ransomware attacks: ransomware attacks affect the entire organization. 51 percent of respondents reported business downtime resulting from attacks on IT infrastructure, 44 percent reported business downtime resulting from attacks on OT infrastructure, such as medical devices, factory automation systems, and 46 percent reported end user downtime resulting from attacks targeting users.
- Everyone is looking for better insights, data, and cooperation: when asked to identify their top challenges, 43 percent cited the lack of cooperation between their network, security, and cloud operations teams. Additionally, 40 percent cited a lack of investment, 39 percent cited the long time required to train new hires, and 35 percent cited inadequate or overlapping tooling.
- WFH with outdated protocols: despite the shift to working from home, 69 percent of respondents acknowledged transmitting sensitive data over unencrypted HTTP connections instead of more secure HTTPS connections. Another 68 percent are still running SMBv1, the protocol exploited in major attacks like WannaCry and NotPetya, leading to more than $1 billion in damages worldwide.
- Organizations are less than transparent: while two-thirds (66 percent) of respondents agreed it was good to disclose attacks, only 39 percent said they were fully open about attacks and willing to make information available for public knowledge when they actually took place.
- Slow response times to critical vulnerabilities: when it comes to responding to critical vulnerabilities by installing patches or shutting down a vulnerable solution, response times vary. Only 26 percent respond in less than a day—probably fast enough to prevent most attacks, while 39 percent take one to three days, 24 percent take up to a week, and 8 percent take up to a month.
This study shows that, even as companies continue to innovate with cloud technologies and remote workforces, their IT infrastructures remain mired in the past, with obsolete protocols providing ongoing opportunities for attackers to infiltrate networks and unleash ransomware attacks. A lack of visibility and effective use of data has also contributed to organizations' obstacles in identifying vulnerabilities and preventing ongoing ransomware attacks.
"This research highlights the discrepancies between the reality of today's sophisticated attack landscape and the overconfidence that many business leaders have in their ability to manage an attack," said Jeff Costlow, CISO at ExtraHop. "Defenders need tools that can track attacker activity across cloud, on-premises, and remote environments so they can identify and stop an attack before they can compromise the business."
The survey of 500 security and IT decision makers in the US, UK, France, and Germany was conducted by Wakefield Research and sponsored by ExtraHop. Survey participants came from a wide range of industries, including financial services, healthcare, manufacturing, and retail, and worked at companies of varying sizes, including companies with annual revenue exceeding $50 million. About half the participants were in the US, with the rest hailing from the UK, France, and Germany.