Businesses Impacted by Repeated Ransomware Attacks and Failing to Close the Gap on Exploits, According to Sophos Global Survey

Sophos Press Release

OXFORD, U.K., Jan. 30, 2018 – Sophos (LSE: SOPH), a global leader in network and endpoint security, today announced the findings of its survey, The State of Endpoint Security Today which shows the extent to which businesses are at risk of repeated ransomware attacks and are vulnerable to exploits. The survey polled more than 2,700 IT decision makers from mid-sized businesses in 10 countries worldwide, including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India, and South Africa. The survey concludes that despite the high profile headlines of 2017, businesses are still not prepared to face today’s fast-evolving threats.  

Ransomware continues to be a major issue across the globe with 54 percent of organizations surveyed hit in the last year and a further 31 percent expecting to be victims of an attack in the future. On average, respondents impacted by ransomware were struck twice.

“Ransomware is not a lightning strike – it can happen again and again to the same organization. We’re aware of cybercriminals unleashing four different ransomware families in half-hour increments to ensure at least one evades security and completes the attack,” said Dan Schiappa, senior vice president and general manager of products at Sophos. “If IT managers are unable to thoroughly clean ransomware and other threats from their systems after attacks, they could be vulnerable to reinfection. No one can afford to be complacent. Cybercriminals are deploying multiple attack methods to succeed, whether using a mix of ransomware in a single campaign, taking advantage of a remote access opportunity, infecting a server, or disabling security software.”

This relentless attack methodology combined with the growth in Ransomware-as-a-Service, the anticipation of more complex threats, and the resurgence of worms like WannaCry and NotPetya puts businesses in serious need of a security makeover, according to Sophos. In fact, more than 77 percent of those impacted by ransomware were running up to date endpoint protection, confirming that traditional endpoint security is no longer enough to protect against today’s ransomware attacks.

“Organizations of all sizes are starting 2018 with inadequate protection against ransomware, despite last year’s international headlines,” said Schiappa. “Given the ingenuity, frequency, and financial impact of attacks, all businesses should re-evaluate their security to include predictive security technology that has the capabilities needed to combat ransomware and other costly cyber threats.”

According to those impacted by ransomware last year, the median total cost of a ransomware attack was $133,000. This extends beyond any ransom demanded and includes downtime, manpower, device cost, network cost, and lost opportunities. Five percent of those surveyed reported a $1.3 million to $6.6 million as total cost.

Two-Thirds of IT Admins Surveyed Don’t Understand Anti-Exploit Technology

IT professionals also need to be aware of how exploits are used to gain access to a company’s system for data breaches, distributed-denial-of-service attacks, and cryptomining. Unfortunately, Sophos’ survey revealed considerable misunderstanding around technologies to stop exploits with 69 percent unable to correctly identify the definition of anti-exploit software. With this confusion, it’s not surprising that 54 percent do not have anti-exploit technology in place at all. This also suggests that a significant proportion of organizations have a misplaced belief that they are protected from this common attack technique yet are actually at significant risk.

“The lack of awareness and lack of protection against exploits is alarming. We’ve seen a resurgence in cybercriminals looking for vulnerabilities to actively use in countless attack campaigns. Five or six years ago we saw one per year, and last year as many as five new Office exploits have been used for cybercriminal activity, according to SophosLabs,” said Schiappa. “When cybercriminals are deliberately seeking out both known and zero-day vulnerabilities and an organization has a deficit in defenses, it adds up to a bad security situation.”

Intrusions from exploits have been happening for years but are still a prominent threat and often go undetected for months, if not years. Once inside a system, cybercriminals use complex malware that can hide in memory or camouflage itself. In many cases, businesses do not know they’ve been breached until someone finds a large cache of stolen data on the Dark Web.

“It’s time to disrupt these intrusions,” said Schiappa. “Since traditional endpoint technologies are often unable to keep up with advanced exploit attacks used to compromise a system, Sophos has added predictive, deep learning capabilities to the newest version of its next-generation endpoint protection product, Sophos Intercept X.”

Although 60 percent of respondents admitted their endpoint defenses are not enough to block the attacks seen last year, only 25 percent have predictive threat technologies, such as machine or deep learning, leaving 75 percent vulnerable to repeated ransomware attacks, exploits, and evolving advanced threats. Sixty percent plan to implement predictive threat technology within a year, yet confusion about it persists. Of those surveyed, 56 percent admitted that they do not have a full understanding of the differences between machine learning and deep learning.

“Given the speed at which cyber threats have evolved it is not surprising that many IT managers are unable to stay ahead of the next-generation technology required for security. Yet this knowledge gap could be placing operations at risk. Organizations need effective anti-ransomware, anti-exploit, and deep learning technology to stay secure in 2018 and beyond,” said Schiappa.

The State of Endpoint Security Today survey was conducted by Vanson Bourne, an independent specialist in market research. This survey interviewed 2,700 IT decision makers in 10 countries and across five continents, including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India and South Africa. All respondents were from organizations of between 100 and 5,000 users.
The State of Endpoint Security Today survey results are available in a PDF report.

For further information about Sophos Intercept X, please visit: www.sophos.com/interceptx.

To start a free trial of Intercept X visit: https://secure2.sophos.com/en-us/products/intercept-x/free-trial.aspx.

Acerca de Sophos

Sophos, líder mundial en ciberseguridad next-gen, protege a más de 400 000 empresas de todos los tamaños en más de 150 países de las ciberamenazas más avanzadas de la actualidad. Gracias al respaldo de SophosLabs, un equipo global de ciencia de datos e información sobre amenazas, las soluciones con IA y nativas en la nube de Sophos protegen endpoints (portátiles, servidores y dispositivos móviles) y redes contra las técnicas de ciberataque en evolución, como el ransomware, el malware, los exploits, la exfiltración de datos, las intrusiones de adversarios activos y el phishing, entre otras. Sophos Central, una plataforma de administración nativa en la nube, integra todo el catálogo de productos next-gen de Sophos, incluidos la solución para endpoints Intercept X y el firewall next-gen XG, en un único sistema de “Seguridad Sincronizada” accesible a través de una serie de API. Sophos ha estado impulsando una transición a la ciberseguridad next-gen, aprovechando las capacidades avanzadas de la nube, el Machine Learning, las API, la automatización y la respuesta administrada a las amenazas, entre otras, a fin de ofrecer una protección de nivel empresarial a empresas de todos los tamaños. Sophos vende sus productos y servicios exclusivamente a través de un canal global de más de 53 000 partners y proveedores de servicios administrados (MSP). Asimismo, Sophos pone a disposición de los usuarios particulares sus innovadoras tecnologías comerciales a través de Sophos Home. La empresa tiene su sede en Oxford, Reino Unido. Encontrará más información en es.sophos.com