Ransomware attacks, which were a growing problem last year, are expected to increase this year. But cyberattacks, which people assumed originated out their organizations, have also become iinternal threats.
A new survey from identity protection firm Hitachi ID Systems found that 65% of surveyed IT and security managers or their employees have been approached to participate in these cyberattacks. This represents a 17% increase from a similar poll last November.
- Overall, 57% of respondents said they or their employees have been offered cash or Bitcoin worth less than $500,000. Ransomware attackers primarily contacted executives and employees via email (59%).
- Of the 65% who said they had been approached to participate in a ransomware attack, 49% were victims of a ransomware attack.
- Although many (55%) consider themselves moderately or very prepared to defend against ransomware, more than half (51%) rely primarily or exclusively on perimeter defense.
26% paid ransom demands
In the new survey, most people said they consulted an external party before responding to a ransomware attack and were advised not to pay the ransom. But 26% said they had paid – requests ranged between $300,000 and $600,000.
Hitachi ID warned that “to combat this growing threat, organizations must take a proactive offensive approach to cybersecurity or face financial and reputational damage.”
The company surveyed 100 IT and security managers between December 7, 2021 and January 4, 2022 about how hackers approach employees, the impact of ransomware on the cybersecurity approach of an organization and on the preparation of companies to fight against these attacks.
Other survey results
Victim of attacks
- 38% of respondents say their business has been the victim of a ransomware attack.
- Of those who said they had been approached to participate in a ransomware attack, 49% were victims of a ransomware attack.
Prepared for attacks
- About half (51%) of executives feel moderately prepared to prevent a ransomware attack, with 4% saying they feel the most prepared.
- In the event a hacker breaches their system, 56% of leaders say their organization is moderately or more prepared to reduce the damage or stop the attack.
- Most (66%) said they have added or plan to add new security measures to curb ransomware attacks.
External attacks versus internal attacks
- While 36% are more concerned about external threats than internal threats, more than half (53%) are equally concerned about both.
- Of those approached to help with a ransomware attack, 49% reported the incident to federal law enforcement, and only 18% reported both internally and externally.
- Most companies (63%) have an insurance policy that covers ransomware attacks.
Advice for entrepreneurs
Nicholas Brown, CEO of Hitachi ID Systems, said: “The growing insider threat within organizations [means] that organizations need to augment their offensive cybersecurity strategies.
“Yet while around half (51%) of executives feel moderately prepared to prevent a ransomware attack, the survey also found an overreliance on perimeter defense, with 51% of companies also relying moderately or exclusively on perimeter defense.
” It’s worrying. Reliance on traditional perimeter defense is a problematic contrast to the industry standard and government-led push for a Zero Trust cybersecurity model through Identity and Access Management or two other common approaches. This exposes a false sense of security and a low level of maturity in the cybersecurity infrastructure.
Brown warned that, “… more than ever, cybersecurity strategies must protect not only from external threats, but also from internal threats.
He concluded that “cybersecurity is only as strong as the weakest password or identity. People have an average of 70-100 risky passwords in chat messages and spreadsheets, and worse, some even reuse corporate passwords to keep them straight.