A third of organizations that pay ransoms are still unable to recover data
- Details
- Published: Thursday, 19 May 2022 07:55
Veeam Software has released the results of its 2022 Ransomware Trends Report. This highlights some of the business impacts that are being felt due to ransomware attacks. The survey-based report states that cybercriminals are successfully encrypting an average of 47 percent of production data and victims are only able to recover 69 percent of impacted data.
The Veeam 2022 Ransomware Trends Report contains the results of a survey by an independent research firm of 1,000 IT leaders whose organizations had been successfully attacked by ransomware at least once during the past 12 months, making it one of the largest reports of its kind.
Paying the ransom is not a ransomware recovery strategy
Of the organizations surveyed, the majority (76 percent) of cyber-victims paid the ransom to end an attack and recover data. Unfortunately, while 52 percent paid the ransom and were able to recover data, 24 percent paid the ransom but were still not able to recover data - resulting in a one out of three chance that paying the ransom still leads to no data. It is notable that 19 percent of organizations did not pay the ransom because they were able to recover their own data.
Prevention requires diligence from both IT and users
The ‘attack surface’ for criminals is diverse. Cybercriminals most often first gained access to production environments through users clicking malicious links, visiting unsecure websites, or engaging with phishing emails - exposing the avoidable nature of many incidents. After having successfully gained access to the environment, there was very little difference in the infection rates between data center / centre servers, remote office platforms and cloud-hosted servers. In most cases, the intruders took advantage of known vulnerabilities, including common operating systems and hypervisors, as well as NAS platforms and database servers, exploiting any unpatched or outdated software that they can find. It is notable that significantly higher infection rates were reported by Security professionals and backup administrators, compared with IT operations or CISOs, implying that ‘those closer to the problem see even more of the issues’.
Remediation starts with immutability
Respondents to the survey confirmed that 94 percent of attackers attempted to destroy backup repositories and in 72 percent of cases this strategy was at least partially successful. This removal of an organization’s business continuity lifeline is a popular attack strategy as it increases the likelihood that victims would have no other choice than to pay the ransom. The only way to protect against this scenario is to have at least one immutable or air-gapped tier within the data protection framework - which 95 percent of those surveyed stated they now have. In fact, many organizations reported having some level of immutability or air-gap media in more than one tier of their disk, cloud, and tape strategy.
Other key findings from the Veeam 2022 Ransomware Trends Report include:
- Orchestration matters: To proactively ensure recoverability of their systems, one in six (16 percent) IT teams automate the validation and recoverability of their backups to ensure their servers are restorable. Then, during remediation of a ransomware attack, 46 percent of respondents use an isolated sandbox or staging/test area to ensure their restored data is clean prior to reintroducing the systems into production.
- Organization alignment must unify: 81 percent believe their organizations’ cyber and business continuity / disaster recovery strategies are aligned. However, 52 percent of respondents believe the interactions between these teams requires improvement.
- Diversifying the repositories holds the key: Nearly all (95 percent) organizations have at least one immutable or air-gapped data protection tier, 74 percent use cloud repositories that offer immutability; 67 percent use on-premises disk repositories with immutability or locking; and 22 percent use tape that is air-gapped. Immutable or not, organizations noted that in addition to disk repositories, 45 percent of production data is still stored on tape and 62 percent goes into a cloud at some point in their data lifecycle.
