Since back in 2008 Verizon has been putting out a report each year called the Data Breach Investigation Report (DBIR). In 2013 they first wrote about ransomware. Social engineering was already happening and growing in popularity with bad actors. The latest edition of DBIR shows that 9 years later Ransomware and Social Engineering are still top threats.
Ransomware Still on the Rise
This most recent report shows that ransomware is still on the rise, with a reported 13% increase over last year. This increase is as large as the last five years combined increases.
The way the attackers are getting in has remained largely consistent over time. As they have been doing for years, attackers are still getting in via (Remote Desktop Protocol) RDP. They gain access through either unpatched vulnerabilities or weak passwords that lack MFA.
The sad truth is that it appears hackers haven’t been forced to change their tactics because the tried-and-true methods of 2013 are still working. Ransomware is on the rise because it can be a lucrative business. Those that are breached continue to pay up, and further fund the bad actors.
Ransomware Stats
At a recent IT conference Jay Ryerse VP of Global Security Sales for ConnectWise shared a few additional statistics about ransomware.
- Average dwell time for ransomware is 23 days.
That means that the bad guys have already been in your system for 23 days before they execute ransomware and hold you hostage. At that point they’ve likely seen all your data and could have access to all systems.
- Average downtime for ransomware is 21 days.
After an attack it can take a LONG time to get back to fully productive. 21 days of downtime would have a substantial financial impact on most businesses.
- Average cost of recovery reached $1.8 million in 2021.
For most SMB any event that costly would essentially close them down. Business owners need to start taking cyber security more seriously and getting the right protections in place.
Social Engineering is How They Get You
The DBIR report also shows that the “human element” of social engineering is tied to 82% of all breaches. This means that attackers used social engineering to trick users into give up credentials with a convincing story. They also preyed on them with phishing attacks, misuse, or gained access via human error.
Phishing still appears to be bad actors’ primary technique, with over 60% of this year’s breaches beginning that way. Click rates on phishing emails are exceptionally high. Only 2.9% of employees end up clicking on phishing emails. However, because email is easy to use for mass distribution that’s plenty of exposed targets for hackers running a phishing campaign.
Cyber Security Training
There is no cure all for the “human element”. People are always going to make mistakes that could put you or your business at risk. There are solutions out there that can help. Companies like Breach Secure Now, KnowB4, Webroot and others are fighting the good fight, working to better educate and protect employees from all types of cyber threats.
These kinds of programs can significantly reduce the risk of human error in your organization and help to better protect your company.
Don’t Stay Vulnerable
The frustrating thing for security professionals about a report like this is that we’ve known how to prevent most of these breaches for years. They keep giving the same advice and SMB’s are slow to listen until they get hit. At that point it’s too late.
Lack of security patches, having RDP open to the world, weak passwords, and poor training are all addressable problems. We can get better at these things and be more protected. If lack of time, resources, or something else is holding you back its time to change your mindset.
I’ve talked to hundreds of businesses that “didn’t have budget” for cybersecurity over the years. I’ve never talked to a single business that had a breach where they didn’t have budget to fix it. An ounce of prevention is worth a pound of cure. Today is the day to get your security in a better spot. If you want help, the experts at i.t.NOW are here for you. Give us a call.
