<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<h2>What are the true costs of ransomware?</h2> </div>
</div>
<div>
<div>
<div>
<p>Attackers’ demands are growing along with an increase in ransomware attacks, with the average ransom coming in at a hefty <a href="https://www.coveware.com/blog/2020/1/22/ransomware-costs-double-in-q4-as-ryuk-sodinokibi-proliferate" rel="noreferrer" target="_blank">$84 thousand.</a> However, in addition to this obvious expense, companies also need to consider other hidden costs, such as productivity loss, that can result from a successful attack.</p><p>In today’s fast-evolving environments, most security professionals expect it’s only a matter of time before perimeter security is compromised. However, one solution to this seeming inevitability is to dramatically limit the impact of a successful breach with an approach that includes network segmentation. What is network segmentation’s value in a ransomware defense strategy? If implemented successfully, it can prevent ransomware from spreading beyond its landing point and successfully encrypting other assets.</p> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<a href="https://www.guardicore.com/resources/stop-ransomware-encrypting-network-stopping-lateral-movement/" rel="noreferrer" target="_blank">
Want to learn more about Ransomware? Check out our eBook <img alt="⬇" src="https://s.w.org/images/core/emoji/13.0.1/72x72/2b07.png" style="height: 1em;" />
</a>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<h2>The consequences of losing access to data</h2> </div>
</div>
<div>
<div>
<div>
<p>Increasingly, bad actors employing this kind of malware use public-key encryption techniques that are unlikely to be cracked by any recovery team. With backups often targeted, many companies may find themselves without access to critical data while they debate paying up or waiting for a response from the attackers. This can mean different things for different industries, from shutting down production lines in manufacturing to services suddenly unavailable from technology companies or even patients unable to receive care in a healthcare setting. </p><p>In addition to disrupting operations, this can also impact the bottom line. In March 2021, CompuCom, a managed technology service provider, <a href="https://www.businesswire.com/news/home/20210326005466/en/The-ODP-Corporation-Provides-Update-On-CompuCom%E2%80%99s-Malware-Incident-And-Business-Impact" rel="noreferrer" target="_blank">confirmed that it expected to lose up to $8 million in revenue</a> due to disruption from ransomware in addition to an anticipated total spend of $20 million to completely restore services and address other issues caused by the attack.</p><p>With the average ransomware incident lasting <a href="https://www.coveware.com/blog/2020/1/22/ransomware-costs-double-in-q4-as-ryuk-sodinokibi-proliferate" rel="noreferrer" target="_blank">16.2 days</a>, building a defense strategy that prevents lateral movement early in an attack can help an organization avoid widespread data loss, high costs and downtime if the worst should happen.</p> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<h2>Permanent loss of data</h2> </div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p>Some organizations pay the ransom fees in full, only never to receive the means to decrypt their data. Alternatively, in rare cases, files may have become corrupted during the encryption process. Months or even years of important project work or files can vanish in the wake of a successful attack. In these cases, an organization can expect to spend significant time and money to recreate or rebuild what was lost.</p><p>Companies of all sizes and in all industries are at risk of losing access to data both temporarily or permanently. Since the goal is to wreak havoc on as much of an environment as possible, the consequences and potential for data loss are widespread.</p> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<h2>Reputation and liability</h2> </div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p>Additionally, in some cases, the inability to access encrypted assets isn’t the only issue. Some attackers may exfiltrate sensitive materials to sell or leverage them further.</p><p>Once proprietary company data is leaked or compromised, damage to a brand and loss of customer loyalty are often close behind. According to a<a href="https://www.ibm.com/security/data-breach" rel="noreferrer" target="_blank"> 2020</a> survey, 80% of data breaches included customer PII; intellectual property was compromised in 32% of breaches; anonymized customer data was compromised in 24% of breaches. </p><p>In some cases, consumers and regulators may take additional action that increases the impact and total cost of the incident. In early 2021 patients of US Fertility (USF) sued the third-party vendor after a ransomware incident compromised both healthcare, financial and other PII data. </p> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<h3>Collateral damage of lateral movement</h3> </div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p>A ransomware campaign often begins with an initial incident. Phishing emails that compromise an employee endpoint are popular choices with attackers. However, to be successful once they have access, the goal of most attackers using ransomware is to encrypt as many assets as possible, and ideally, any backups. This action is dependent on lateral movement.</p><p>If an organization can <a href="https://www.guardicore.com/solutions/prevent-lateral-movement/" rel="noreferrer" target="_blank">prevent lateral movement</a>, it can effectively limit malware propagation in its environment. Techniques for preventing unauthorized east-west activity include:</p><ul><li>Limiting server communications with the internet.</li><li>Practicing ring-fencing to reduce the attack surface between applications.</li><li>Strong protection policies for critical backups</li></ul><p> </p><p>It’s also important to note that lateral movement between peers is a common propagation path for many strains of malware that traditional firewall rules can’t address. Teams should consider solutions that prevent this when building out a ransomware defense strategy. </p> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<h2>Assess the risk</h2> </div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p>Planning a ransomware defense and mitigation strategy should begin long before an organization receives its first ransom note. Understanding the real-time and historical trends of a network’s communication patterns is key to deciding what may be most vulnerable. Mapping what can communicate with critical assets, data and backups will allow security teams to create informed segmentation policies that an organization can use for prevention and attack surface reduction.</p><p>By using network segmentation policies, organizations can block common ransomware propagation techniques. Using zero-trust micro-perimeters around critical applications, backups, file servers and databases, IT security teams can also create segmentation policies that restrict traffic between users, applications and devices, which will also drastically reduce the attack surface.</p><p>Curious about how ransomware might impact your critical applications? <a href="https://www.guardicore.com/cybersecurity-tools/attack-surface-reduction-analysis/" rel="noreferrer" target="_blank">Check your attack surface</a> with our free tool today.</p> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
Article Link: https://www.guardicore.com/blog/what-are-ransomware-costs/