Cyber attacks surge, ransomware leading the way
The Online Trust Alliance (OTA) found that cyber incidents targeting businesses nearly doubled from 82,000 in 2016 to 159,700 in 2017. Since the majority of cyber incidents are never reported, OTA believes the actual number in 2017 could easily exceed 350,000.
“Surprising no one, 2017 marked another ‘worst year ever’ in data breaches and cyber incidents around the world,” said Jeff Wilbur, director of the OTA initiative at the Internet Society. “This year’s big increase in cyberattacks can be attributed to the skyrocketing instances of ransomware and the bold new methods of criminals using this attack.”
OTA found that in 2017 there were 134,000 ransomware attacks on businesses, nearly doubling that of 2016. In mid-2017 another type of ransomware attack emerged—the ransom denial-of-service attack (RDoS). In this attack, criminals send an email to domain owners threatening a DDoS attack that will make a website inoperable unless a ransom (usually via Bitcoin) is paid.
Dealing with ransom
OTA recommends proactive planning for crisis management, forensics specialists and law enforcement, and suggests that organizations be prepared by setting up a Bitcoin wallet in the event ransom payment is deemed necessary for a given incident.
“I would strongly recommend against such activity. One of the main reasons ransomware is so prevalent is that victims are paying the criminals behind these attacks. In doing so victims are creating a market that encourages criminals to exploit,” Brian Honan, CEO at BH Consulting, told Help Net Security.
“Organisations would be better served in spending time and resources in simple security steps such as backing up their data, ensuring appropriate access controls are in place, that systems are patched with the latest updates, and that effective anti-virus software is installed. They should also look into building recovering from a ransomware attack into their business continuity planning. Time and money spent on preventing such attacks, on building resilience into their systems, and on recovering from attacks. For companies that become victims I recommend they do not pay the ransom, they report the issue to law enforcement so valuable intelligence about the attackers can be garnered, and to recover their data in whatever way they can. Victims can also look to the Europol website to see if they have keys to help them recover,” Honan concluded.
Breaches easily avoidable
As in past years, OTA found most breaches could have been easily prevented. It calculated that in 2017, 93 percent of all breaches could have been avoided had simple steps been taken such as regularly updating software, blocking fake email messages using email authentication and training people to recognize phishing attacks.
Of the reported breaches in 2017, OTA found 52 percent were the result of actual hacks, 15 percent were due to lack of proper security software, 11 percent were due to physical skimming of credit cards, 11 percent were due to a lack of internal controls preventing employees’ negligent or malicious actions and eight percent were due to phishing attacks.
“Regular patching has always been a best practice and neglecting it is a known cause of many breaches, but this received special attention in 2017 in light of the Equifax breach,” said Wilbur. “In 2018 we expect patches to play an even more integral role due to the recently discovered Spectre and Meltdown vulnerabilities where nearly every computer chip manufactured in the last 20 years was found to contain fundamental security flaws.”