ExtraHop Report Finds 82% of Australian and New Zealand Organisations Paid up in Ransomware Attacks

Posted: Thursday, Apr 13

KBI.Media
$
Posts
$
BUSINESS
$
Reports & Predictions
$
ExtraHop Report Finds 82% of Australian and New Zealand Organisations Paid up in Ransomware Attacks

i 3 Table of Contents

ExtraHop Report Finds 82% of Australian and New Zealand Organisations Paid up in Ransomware Attacks

SYDNEY – April 13 2023 – ExtraHop, the leader in cloud-native network detection and response (NDR), today released the 2023 Global Cyber Confidence Index: Cybersecurity Debt Drives Up Costs and Ransomware Risk, which identified a link between cybersecurity debt and heightened exposure to cybersecurity incidents, including ransomware, among Australian and New Zealand organisations.

The research, which compares IT leaders’ cybersecurity practices with the reality of the attack landscape, found organisations experienced a significant increase in ransomware – from an average of four attacks over five years in 2021 versus four attacks over the course of one year in 2022. Of those who fell victim, 82% admitted to paying the ransom at least once.

As organisations increasingly find themselves under attack, the data discovered they are drowning in cybersecurity debt – unaddressed security vulnerabilities like unpatched software, unmanaged devices, shadow IT, and insecure network protocols that act as access points for bad actors. Key findings from the report include:

Outdated practices are to blame

Eighty per cent of Australian and New Zealand IT decision makers say outdated cybersecurity practices have contributed to at least half of the cybersecurity incidents their organisations have experienced. Despite these concerning figures, only 62% of respondents said they have immediate plans to address any of the outdated security practices that put their organisations at risk.

Basic cyber hygiene is lacking

The survey found that all Australian and New Zealand respondents are running one or more insecure network protocols. Despite calls from leading technology vendors to retire SMBv1, which played a significant role in the explosion of WannaCry and NotPetya, 84% are still running it in their environments.

When it comes to unmanaged devices, 53% say some of their critical devices are capable of being remotely accessed and controlled and are exposed to the public internet.

Confidence in cloud security is on the rise

As organisations move mission critical applications and sensitive data to the cloud, the need to monitor cloud workloads has never been greater. With a greater focus on their cloud environments, 79% of respondents said they were completely or mostly confident in the security of their organisation’s cloud workloads.

“As organisations find themselves overburdened by staffing shortages and shrinking budgets, it’s no surprise that IT and security teams have deprioritised some of the basic cybersecurity necessities that may seem a bit more mundane or expendable,” said Mark Bowling, Chief Risk, Security and Information Security Officer, ExtraHop. “The probability of a ransomware attack is inversely proportional to the amount of unmitigated surface attack area, which is one example of cybersecurity debt. The liabilities, and, ultimately, financial damages that result from this deprioritisation compounds cybersecurity debt and opens organisations up to even more risk. Greater visibility into the network with an NDR solution can help reveal the cyber truth and shine a light on the most pressing vulnerabilities so they can better take control of their cybersecurity debt.”

ExtraHop recommends that organisations take the following steps to assess and remediate cybersecurity debt

Step 1: Perform Continuous Network Monitoring

Maintaining an inventory of software and hardware in your environment is a fundamental necessity for security hygiene, and is recommended in the first and second security controls in the CIS Top 20. Despite being a vital security practice, maintaining this inventory is a challenge for organisations that rely on manual, point-in-time audits to identify devices and protocols on their networks.

A better approach is to use a network monitoring tool that passively and continuously analyses network traffic to pinpoint every device connecting to your network and each protocol in use at any given moment. The increase in both remote work and cloud environments has created more ways to introduce insecure protocols into organisation’s environments. These trends have made continuous monitoring of network traffic for device protocol identification essential.

Step 2: Update Configuration Templates and Settings

Devices and software that communicate across the network are configured with default settings that may go out of date over time. If a new device or solution is introduced into the environment and left to its default configuration, it may run protocols that are no longer considered secure.

Similarly, cloud systems and workloads use configuration templates to determine their protocol usage. Over time, as new protocols are developed and old versions deprecated, these configuration templates may go out of date and need to be updated. Any new workloads created with an older template may introduce insecure protocols into the environment. Because of the often short-lived and ephemeral nature of cloud workloads, it can be very challenging to catch these instances of insecure protocol usage and know how to get them out of your system. This is where a network monitoring solution can help.

Step 3: Disable Unused Ports

Other steps organisations can take to remediate network-related cybersecurity debt is to disable unused ports, as well as any unnecessary services, on internet connected networking devices, and of course, to develop and implement a roadmap for replacing legacy protocols.

Download the 2023 Global Cyber Confidence Index:Cybersecurity Debt Drives Up Costs and Ransomware Risk.

This survey was conducted by Wakefield Research.

ABOUT EXTRAHOP

ExtraHop is the cybersecurity partner enterprises trust to reveal the unknown and unmask the truth. The company’s Reveal(x) 360 platform is the only network detection and response platform that delivers the 360-degree visibility needed to uncover the cybertruth. When organisations have full network transparency with ExtraHop, they see more, know more, and stop more cyberattacks. Learn more at www.extrahop.com.

The Production Team

The KBI Production Team is a staff of specialist technology professionals with a detailed understanding across much of cybersecurity and emerging technology. With many decades of collective industry experience, as well as expertise in marketing & communications, we bring news and analysis of the cybersecurity industry.