Persistent ransomware threat requires holistic solution

Despite the efforts of government agencies and cyber security professionals, ransomware attacks continue to hit the headlines on a regular basis. In the first quarter of 2023, 838 organisations fell victim to ransomware attacks and were named on dark-web data-leak sites, according to the Reliaquest Quarterly Cyber Threat Report (April 2023). According to the report, this sets the record for most ransomware victims in a quarter since the start of double extortion.

The threat posed by ransomware attacks is not about to subside any time soon. In fact, it is likely to remain a key driver for cyber risk for many years to come. Cyber criminals continue to reap large financial gains from ransomware for relatively little risk. They are well organised and resourced, and constantly refining their business model and techniques, finding more effective ways to infiltrate systems and extort money from their victims.

Number 1 cyber threat

Ransomware remains the biggest cyber threat and the single largest driver of cyber insurance claims. Following a spike in ransomware claims between 2019 and 2021, frequency began to stabilise in 2022, but has since started to rise again this year. According to cyber security firm Black Kite, the first quarter of 2023 saw a resurgence in the number ransomware attacks, in part due to an increase in supply chain attacks and as cyber criminals exploit vulnerabilities in third party vendors.

While frequency stabilised in 2022, the severity of ransomware attacks continued to rise, driven by the cost of business interruption, IT forensics, and to a lesser degree, extortion payments. On average, a ransomware attack in 2022 took 237 days to identify and 89 days to contain – 49 days longer than the average data breach, according to IBM. The average cost of a ransomware attack, excluding the ransom, hit $4.54 million in 2022, according to IBM’s Cost of Data Breach report.

New levels of extortion

Ransomware-as-a-service (RaaS) has turned ransomware into big business. RaaS groups provide affiliated criminals with all the technical advice and tools they need, supported by a host of ransomware attack services, including customer service hotlines, leak-websites, extortion negotiation and payment services.

Recent years have seen the ransomware model evolve, as criminals find new ways to threaten and extort money. Where cyber criminals would once just encrypt data and demand a ransom, there are now four levels of extortion. In addition to encryption, attackers now typically steal data – known as double extortion – and threaten to release it unless a ransom is paid. If an organisation refuses to pay, they may also be threatened with a distributed denial-of-access-attack, or stolen data might be used to harass and threaten the victim’s customers and business partners.

Exploiting supply chain vulnerabilities

Cyber criminals are also turning their attention to third party service providers and supply chains, which enable criminals to hit multiple targets in one attack. According to IBM, around one-fifth of breaches in 2022 were the result of a supply chain compromise.

In March, a ransomware group claimed to have stolen data from 130 organisations after launching a mass ransomware attack using a flaw in the GoAnywhere MFT secure file transfer tool. It is this type of supply chain attack that has led to an increased number of impacted companies in 2023. Other notable supply chain attacks include the 2020 SolarWinds and 2021 Kaseya attacks.

Supply chain cyber attacks are an important topic for businesses, as they are only as secure as the weakest link in their supply chains. While many companies have improved their own cyber security in recent years, they need to also consider third-parties. Insurers such as Zurich are able to help companies assess and monitor the security and resilience of suppliers and business partners.

Continual risk assessment

Understanding the threat of ransomware has never been more important. The tactics and methods of cyber criminals continually evolve, and what might have been considered strong cyber security a year ago, may no longer be adequate – some hackers, for example, are starting to find ways to bypass multi-factor authentication.

Basic cybersecurity hygiene measures remain essential to help prevent ransomware attacks, but it is imperative that companies continually assess, monitor and test their cyber security and resilience. Time is also key, the faster a company identifies a problem and responds, the better the chances of blocking the infection and limiting damage.

Paying a ransom is not the answer. In many cases, criminals will prioritise companies that have shown a willingness to pay ransom demands in the past. It is also possible to contain a ransomware attack without paying an extortion demand, through robust cyber business continuity planning and close collaboration with stakeholders, including security agencies and insurers.

Holistic approach

Ransomware also requires a holistic response, with risk prevention and mitigation, incident response, and risk transfer, all working together. Cyber security is not a tool but a process. This is governance, risk assessment and management.

To that end, Zurich is providing customers with a growing range of risk management tools and services, including risk assessment, penetration testing, crisis management and response combined with Insurance offerings. Companies can now more easily quantify their exposure to ransomware, which helps gain the support of top management and the cyber security team, and prioritise investments in cyber security and resilience.

As part of Zurich’s aim to help companies build and maintain their cyber resilience, the Group is in the process of strengthening its cyber offering, expanding risk assessment, risk engineering services and cyber insurance solutions, working with specialist third-party providers, and adding skills and talent. For example, Zurich is working with Swiss university ETH to identify and prioritise the top security controls for companies to reduce their risks and improve their cyber resilience. The model will also enable underwriters to focus on the most effective controls, reducing the burden on customers.

Solving the ransomware problem

Ransomware will continue to evolve, as must our response to the threat. Artificial intelligence, for example, will enable criminals to automate attacks at scale, increasing the attack surface and expand their capacity to extort. But cybercriminals will not have everything their way. AI will also help companies detect potential threats and block intrusions before they can infect a system.

Moves to regulate cryptocurrency, which is used to make ransomware payments, could make life more difficult for cyber criminals. Likewise, requirements to report ransomware events to authorities could also help: The EU’s NIS 2 Directive will introduce obligatory reporting of attacks by critical infrastructure companies, for example.

In the meantime, there is much we can do to better understand the risks and quantify the impact, taking steps to bolster cyber security and resilience, and make life harder for the cyber criminals.

Originally published in Commercial Risk on July 18, 2023