www.helpnetsecurity.com Open in urlscan Pro
54.148.174.253  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - monthly newsletter with top articles</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1707271902"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

 * News
 * Features
 * Expert analysis
 * Videos
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Please turn on your JavaScript for this page to function normally.
Help Net Security
February 6, 2024
Share


PAYING RANSOMS IS BECOMING A COST OF DOING BUSINESS FOR MANY



Today’s pervasive cyberattacks are forcing the majority of companies to pay
ransoms and break their ‘do not pay’ policies, with data recovery deficiencies
compounding the problem, according to Cohesity.



In fact, most companies have paid a ransom in the last two years, and the vast
majority expect the threat of cyberattacks to increase significantly in 2024
compared to 2023.


COMPANIES BRACE FOR INCREASED CYBER THREATS

Alarmingly, 79% of respondents said their company had been the ‘victim of a
ransomware attack’ between June and December. The cyber threat landscape is
expected to get even worse in 2024, with 96% of respondents saying the threat of
cyberattacks to their industry will increase this year and 71% predicting it
will increase by more than 50%.

Organizations’ attack surfaces are informed by the size and scope of their data
environments. However, 78% of respondents said their data security risk has now
increased faster than the growth in the data they manage. Respondents also
believe organizations’ cyber resilience and data security strategies are not
keeping up with the current threat landscape, with just 21% having full
confidence in their company’s cyber resilience strategy and its ability to
‘address today’s escalating cyber challenges and threats’.

Cyber resilience is the technology backbone for business continuity. It defines
companies’ ability to recover their data and restore business processes when
they suffer a cyberattack or adverse IT event. However, according to
respondents, every company has cyber resilience and business continuity
challenges.

All respondents said they need over 24 hours to recover data and restore
business processes, and just 7% said their company could recover data and
restore business processes within 1-3 days.

35% said they could recover and restore in 4 to 6 days, while 34% need 1-2
weeks, and 23% need over 3 weeks to recover data and restore business processes.


THE OVERLOOKED RISK OF INFREQUENT DATA TESTING

Further demonstrating cyber resilience gaps, just 12% said their company had
stress-tested their data security, data management, and data recovery processes
or solutions in the six months prior to being surveyed, and 46% had not tested
their processes or solutions in over 12 months.

Unsurprisingly, 94% of respondents said their company would pay a ransom to
recover data and restore business processes, while 5% said ‘maybe, depending on
the ransom amount.’

67% said their company would be willing to pay over $3 million to recover data
and restore business processes, with 35% of respondents saying their company
would be willing to pay over $5 million. The research also showed the importance
of being able to respond and recover, as 9 in 10 said their organization had
paid a ransom in the prior two years, despite 84% saying their company had a ‘do
not pay’ policy.

“Organizations can’t control the increasing volume, frequency, or sophistication
of cyberattacks such as ransomware. What they can control is their cyber
resilience, which is the ability to rapidly respond and recover from
cyberattacks or IT failures by adopting modern data security capabilities,” said
Brian Spanswick, CISO and head of IT, Cohesity.

“It is no surprise that the majority of companies have been hit by cyberattacks
like ransomware. What is alarming is that 90% have paid a ransom, breaking their
‘do not pay’ policies, and most are willing to pay over $3 million in ransoms
because they can’t recover their data and restore business processes or do so
fast enough,” added Spanswick.

Respondents identified executive awareness and responsibility for data security
as two areas for companies to improve, with just 35% saying their senior and
executive management fully understands the ‘serious risks and daily challenges
of protecting, securing, managing, backing up, and recovering data.’


CYBER RESILIENCE AS ORGANIZATIONAL PRIORITY

4 in 5 said executive management (C-Level) and boards should share the
responsibility for their company’s data security strategy, while 67% said their
company’s CIO and CISO, in particular, could be better aligned.

Prioritizing their biggest concerns about a successful data breach or
cyberattack, respondents selected brand and reputational damage (34%), a drop in
share price / investment / profitability (31%), a direct hit to revenue (30%),
and a loss of stakeholder trust (30%).

When asked who is most impacted by a data breach or cyberattack, respondents
said existing customers (29%), the Security team (29%), the IT team (28%),
employees (28%), and their third-party partners (27%) were most impacted.

“Cyber resilience and data security should be a holistic organizational priority
because the use of data and technology occurs in every function by every
employee. The severe impact of a successful cyberattack or data breach on
business continuity, revenue, brand reputation, and trust is enough to keep all
business, IT, and Security leaders awake at night,” said Sanjay Poonen, CEO of
Cohesity. “To rapidly respond to cyberattacks, organizations need modern
AI-powered data security and management solutions that protect their data,
detect when it is under attack, and recover it as fast as possible to restore
their business processes.”


REGULATION ISN’T DRIVING COMPANIES’ CYBER RESILIENCE

Despite governments and public institutions going to great lengths to encourage
stronger cybersecurity and data management, only 46% of respondents said
government initiatives, legislation, and regulations are actually driving their
companies’ data security, data management, or data recovery initiatives.

Of these respondents that said specific government initiatives, legislation, and
regulations are driving their data security, management, and recovery
approaches, 2 in 3 named these as the most influential:

United States:

 * California Consumer Privacy Act
   Federal Trade Commission Act of 1914
 * Department of Defense’s Cyber Security Maturity Model Certification (CMMC)
   Digital Millennium Copyright Act of 1998 (DMCA)
   Sarbanes-Oxley Act of 2002
 * California Privacy Rights Act of 2020 (CPRA)

Australia:

 * Privacy Act 1988
 * Digital Transformation Agency Guidelines
 * Office of the Australian Information Commissioner’s Notifiable Data Breach
   (NDB) Scheme

United Kingdom:

 * National Data Strategy (NDS)
 * Consumer Data Right (CDR)
 * Data Protection Act 2018
   UK Cloud Security Principles

“It may seem surprising that 54% say government efforts and policies aren’t
driving their companies’ data security, management, and recovery initiatives.
However, organizations should not be centering their entire data security, risk,
management, or recovery strategy around a set standard or compliance framework,”
said Spanswick. “Organizations should certainly adhere to legislation,
regulation, and standards, but these should be seen as the floor and not the
ceiling. The security risks to a company’s data and operations should be what
drives their data management, security, and recovery practices.”





More about
 * Cohesity
 * cyber resilience
 * cyberattacks
 * cybercrime
 * data security
 * ransomware
 * report
 * survey

Share


FEATURED NEWS

 * Spoutible API exposed encrypted password reset tokens, 2FA secrets of users
 * Lagging Mastodon admins urged to patch critical account takeover flaw
   (CVE-2024-23832)
 * How CISOs navigate policies and access across enterprises

Guidance for Securing Cloud Environments



SPONSORED

 * eBook: Defending the Infostealer Threat
 * Guide: SaaS Offboarding Checklist
 * eBook: Keeping Active Directory out of hackers’ cross-hairs




DON'T MISS

 * Spoutible API exposed encrypted password reset tokens, 2FA secrets of users
 * Lagging Mastodon admins urged to patch critical account takeover flaw
   (CVE-2024-23832)
 * How CISOs navigate policies and access across enterprises
 * 3 ways to achieve crypto agility in a post-quantum world
 * 10 must-read cybersecurity books for 2024




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - monthly newsletter with top articles
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2024 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×