India worst hit by ransomware: Study

Indian businesses are at a risk of repeated ransomware attacks and are vulnerable to exploits, according to Sophos’ India findings of its survey, The State of End-point Security Today. The survey polled more than 2,700 IT decision makers across mid-sized businesses in 10 countries worldwide, including the US, Canada, Mexico, France, Germany, the UK, Australia, Japan, South Africa and India. The survey concludes that despite the intensity and magnitude of attacks, Indian businesses are still not prepared to defend itself against determined attackers.  

Ransomware continues to be a major issue across the globe with 54% of organizations surveyed hit in the last year and a further 31% expecting to be victims of an attack in the future. On average, respondents impacted by ransomware were struck twice. India is the worst hit (67%) among all the surveyed countries, as seen in Figure 1:

“Unlike lightening, ransomware can strike again and again to the same organization. We’re aware of cybercriminals unleashing four different ransomware families in half-hour increments to ensure at least one evades security and completes the attack,” said Sunil Sharma, Managing Director Sales at Sophos India & SAARC. “Today’s persistent cybercriminals are deploying multiple attack methods to succeed, whether using a mix of ransomware in a single campaign, taking advantage of a remote access opportunity, infecting a server, or disabling security software. If IT managers are unable to thoroughly clean ransomware and other threats from their systems after attacks, they could be vulnerable to reinfection. No one can afford to be complacent.”

This relentless attack methodology combined with the growth in Ransomware-as-a-Service, the anticipation of more complex threats, and the resurgence of worms like WannaCry and NotPetya puts businesses in serious need of a security makeover, according to Sophos. In fact, more than 90% of Indian IT decision makers surveyed impacted by ransomware were running up to date endpoint protection, confirming that traditional endpoint security is no longer enough to protect against today’s ransomware attacks.

According to those impacted by ransomware last year, the median total cost of a ransomware attack was USD 133,000. Indian organizations median total cost stood at USD 1.17mn, the highest, in rectifying the impacts of ransomware. This extends beyond any ransom demanded and includes downtime, manpower, device cost, network cost, and lost opportunities.

Two-Thirds of IT Admins Surveyed Don’t Understand Anti-Exploit Technology

IT professionals also need to be aware of how exploits are used to gain access to a company’s system for data breaches, distributed-denial-of-service attacks, and cryptomining. Unfortunately, Sophos’ survey revealed considerable misunderstanding around technologies to stop exploits with 72% unable to correctly identify the definition of anti-exploit software. With this confusion, it’s not surprising that 45% do not have anti-exploit technology in place at all. This also suggests that a significant proportion of organizations have a misplaced belief that they are protected from this common attack technique yet are actually at significant risk.

Intrusions from exploits also have been happening for years but are still a prominent threat and often go undetected for months, if not years. Once inside a system, cybercriminals use complex malware that can hide in memory or camouflage itself. In many cases, businesses do not know they’ve been breached until someone finds a large cache of stolen data on the Dark Web.

“It’s time to disrupt these intrusions,” said Sunil. “Since traditional endpoint technologies are often unable to keep up with advanced exploit attacks used to compromise a system, Sophos has added predictive, deep learning capabilities to the newest version of its next-generation endpoint protection product, Sophos Intercept X.”

Although 94% of respondents admitted their endpoint defenses need to be stronger to block the attacks seen last year, only 34% have predictive threat technologies, such as machine or deep learning, leaving 66% vulnerable to repeated ransomware attacks, exploits, and evolving advanced threats. 63% plan to implement predictive threat technology within a year, yet confusion about it persists. Of those surveyed, 37% admitted that they do not have a full understanding of the differences between machine learning and deep learning.

“Given the speed at which IT threats are evolving and becoming more persistent and coordinated, it is a deep concern to see the adoption of the next-generation predictive technologies. It is important for organizations to keep up in this dynamic world of IT threats. Organizations need effective anti-ransomware, anti-exploit, and deep learning technology to stay secure in 2018 and beyond,” said Sunil.

Air Max 2018 Dunk SB