| CyberheistNews Vol 6 #47
| New Survey: It Takes 33 Hours To Recover From A Ransomware Infection
Here is some fabulous ammo for more IT security budget.
In a new Vanson Bourne survey of 500 cybersecurity decision makers sponsored by SentinelOne, 48 percent said their organizations had been hit by at least one ransomware attack in the last 12 months, with the average victim hit six times.
Of those respondents whose organization has suffered a ransomware attack in the last 12 months, just over eight in ten (81%) report that the ransomware attacker gained access to their organization’s network through phishing via email or social media network.
Half (50%) report that the attacker gained access through a drive-by-download caused by clicking on a compromised website, and four in ten (40%) state that it was through an infection via a computer that was part of a botnet.
Practically all of them (94%) stated that there was an impact on their organization as a result of these ransomware attacks. The most common impacts are increased spending on IT security (67%), and change of IT security strategy to focus on mitigation (52%).
44% Say Antivirus Is Dead But 85% Still Run It
Over five in ten (54%) of those surveyed agree that their organization has lost faith in traditional cyber security and over four in ten (44%) also agree that antivirus is dead. Despite this, the majority (85%) of respondents’ organizations install antivirus on all company owned static devices.
Just under two thirds (65%) of respondents agree that traditional cyber security techniques cannot protect them from the next generation of malware like ransomware attacks. Over seven in ten (71%) agree that they need a new solution to protect organizations from ransomware.
Fewer than half (45%) of respondents whose organization has suffered a ransomware attack in the last 12 months report that the attacker was able to encrypt some files/data, but their organization was able to decrypt them.
Moreover, around a quarter state that the attacker was unable to successfully encrypt any files/data (27%), or that the attacker was able to encrypt some files/data, but a back-up was held and respondents’ organizations were able to replace the encrypted files (25%).
On average, this replacement process took 33 employee hours.
Of the respondents whose organization has suffered a ransomware attack in the last 12 months, employee information (42%), financial data (41%) and customer information (40%) were types of data most likely to have been affected by these attacks.
Only 54% Notified Law Enforcement
Just over six in ten (61%) respondents state that upon suffering a ransomware attack, they did or would notify the CEO/board. Around half of respondents did/would notify law enforcement (54%) and lawyers (50%), but only 38% did/would notify customers. Here is the full report with all results:
Numbers like this make it clear as daylight that you need to step your users through new-school security awareness training as ransomware mitigation step number one.
The choice is simple. Two options:
A) Spend an average of 33 hours restoring a backup which is a major pain in the neck.
B) Spend less than one hour to upload your users, schedule training and then phish your users which is a lot of fun. (Ask our 7,000 customers.)
Q4 is the time of year to get budget for this and a PO cut, so that you can do your baseline test and start the new year with an effective awareness program that your employees are going to love.
You know what comes out of the mouth of your users after they stepped through the training? "Wow, I did not know it was that dangerous on the internet, how do I share this with my family?" And we are happy to say that we have that covered.
Get a quote now. Find out how affordable this is for your organization and be pleasantly surprised:
| Ransomware Roundup November 2016
Crysis decryption keys posted
The decryption keys of the Crysis ransomware were posted on Pastebin, which allows victims to decrypt their hijacked files without paying. Crysis was notorious for spreading through attacks on the Windows Remote Desktop Protocol, using brute force attacks.
Why the keys were released is also unknown, but it may be due to the increasing pressure by law enforcement on ransomware infections and the developers behind them. Kaspersky recently added the decryption keys to their ransom-decryption tool and the BleepingComputer site explained how to get your files back.
Blog post with much more background, screenshots and links:
| Why Senior Managers Are The Most Dangerous Negligent Insiders
Excellent infographic at CSO: "If you really want to move the needle on data security in your organization, start at the top." This is ever so true.
"Hardly a day goes by that there isn't news of another vulnerability, another attack, another patch — and often the biggest, baddest of its kind. You'd think we'd all be on hyper alert, but that is far from the case.
Instead, pleas for compliance with data security basics fall on deaf ears. Here's why: employees, including senior managers and business owners, don't assume personal responsibility for security.
Consider this: 43 percent of C-level executives say negligent insiders are the greatest risk to sensitive data in their organizations, according to data cited in this infographic compiled by the University of Alabama at Birmingham’s Online Master of Science in Management Information Systems program.
Yet, senior managers are twice as likely workers overall to take files with them after leaving a job. And 58 percent of senior managers (compared to 25 percent of all workers) have accidentally sent sensitive information to the wrong person." Check out the numbers and shiver:
| Poll: Sex Or Cybersecurity? 40 Percent Of Americans Pick Abstinence If It Means They Won’t Be Hacked
In light of the recent AdultFriendFinder hack, The Washington Times reported something hilarious. "Nearly four in ten Americans would rather be abstinent for a year than risk being hacked, according to the results of survey published Thursday.
Harris Poll interviewed more than 2,000 adults last month on the topic of cybersecurity, and found Americans aren’t entirely unwilling to skip a years’ worth of sex if it means keeping their internet account and private information protected from hackers.
Broken down by gender, 44 percent of women said they’d skip sex for a year in exchange for some digital peace of mind, compared to 34 percent of men. With regards to the millennial generation, meanwhile, pollsters said 43 percent similarly agreed to sacrifice sex in exchange for their online safety.
With high-profile data breaches and cyberattacks making headlines on a routine basis — evidenced most by the reported compromise this week of the AdultFriendFinder website and more than 412 million of its users — it’s hardly surprising that a significant percentage of Americans are willing to make privacy a priority.
But while the study suggests a good chunk of respondents are willing to make all sorts sacrifices for the sake of security — 41 percent said they’d forego their favorite food for a month in lieu of having to reset the passwords for all of their internet accounts — the same poll revealed Americans don’t treat their passwords and log-in credentials with the protection they should." More:
| Warm Regards,