Most businessmen, nine-in-ten, think they can get back their hostaged data if they pay when attacked by ransomware. They will even cough up cash faster if they had been victimized before, according to a study.

Specifically, business leaders in 88 percent of organizations previously attacked by ransomware would choose to pay a ransom if faced with another attack, according to cybersecurity firm Kaspersky's study released Monday, May 16.

media

Across organizations that have yet to be victimized, 67 percent would be willing to pay, atthough they would be less inclined to do so immediately.

While ransomware remains a prominent threat, with two-thirds (64 percent) of companies already having suffered an attack, paying ransom seems to be perceived by executives as a reliable way of addressing the issue.

Kaspersky conducted a study of 900 respondents across Asia-Pacific, North America, South America, Africa, Russia and Europe in April, 2022.

The study, “How business executives perceive ransomware threat”, covered senior non-IT management, such as CEOs, VP and Director level, as well as business owners or partners in companies with 50—1,000 employees.

Ransomware has become a buzzword in the corporate world, with large attacks on enterprises appearing in headlines week after week and the number of attacks using ransomware almost doubling in 2021 alone.

The Kaspersky study found that companies are more inclined to pay as soon as possible to get immediate access to their data (33 percent of previously attacked companies versus 15 percent of companies that have never been victimized), or to pay after only a couple of days of unsuccessful decrypting attempts (30 percent versus 19 percent).

Business leaders within organizations that previously paid a ransom seem to believe that this is the most effective way to get their data back, with 97 percent of them willing to do this again.

This willingness for companies to pay could be attributed to having little awareness of how to respond to such threats, or to the length of time it takes to restore data, as businesses can lose more money waiting for data restorations than they would paying the ransom.

The bulk, or two-thirds (64 percent) of companies confirm they have experienced this type of incident and 66 percent anticipate that an attack on their business will happen at some stage, viewing it as more likely than other common attack types, such as DDoS, supply-chain, APT, cryptomining or cyber-espionage.

“Ransomware has become a serious threat to corporations with new samples regularly emerging and APT groups using it in advanced attacks," says Sergey Martsynkyan, VP, Kaspersky Corporate Product Marketing.

"Even an accidental infection can cause problems for a company. And because it's about the business’ continuity, executives are forced to make tough decisions about paying the ransom," he pointed out.

However, "Giving money to criminals is never recommended as this doesn’t guarantee that the encrypted data will be returned and it encourages cybercriminals to do it again," Martsynkyan underscored.

Instead, companies should follow basic security principles and look into reliable security solutions to minimize the risk of a ransomware incident.

They should always keep software updated on all their devices to prevent attackers from exploiting vulnerabilities and infiltrating their network.

Focus defense strategy on detecting lateral movements and data exfiltration to the internet. Pay special attention to outgoing traffic to detect cybercriminals’ connections to one's network.

Set up offline backups that intruders won’t be able to tamper with. Make sure they can be accessed in the event of an emergency.

Enable ransomware protection for all endpoints. Enterprises should use solutions for advanced threat discovery and detection, investigation and timely remediation of incidents, and access to the latest threat intelligence.

"And never pay the ransom if you become a victim," the VP admonished.

"It won’t guarantee you get your data back but it will encourage criminals to continue their business. Instead, report the incident to your local law enforcement agency."