axio - kn

Maintaining calm during the storm

After many of the large-scale cyber events hit the news over the past few years, frantic calls made from CEOs and Board of Director members to Chief Information Security Officers typically started with a question along the lines of “Could this happen to us?” In response, CISOs typically provided some security metrics and KPIs supporting a belief that the organization was well protected, albeit followed with a reminder that more money for more controls would always be helpful.

On Saturday, May 8th 2021, 45% of the United States east coast fuel supply was suddenly shut down. A dramatic visual of the states affected is presented below.

Since the early 2000s, many companies have purchased cyber insurance to protect them when data is stolen, networks are breached, regulatory agencies levy fines, or other related incidents occur. In recent years, cyber insurance is also used to protect against increasingly popular ransomware events.

Ransomware attacks — where cybercriminals extort companies by holding data and networks ransom — continue to rise in popularity. Recent trends suggest hackers will use ransomware more frequently in 2021 and beyond, which means companies need to be more vigilant than ever to prepare for attacks.

It’s no secret that cybercriminals continuously test company networks and employees to seek out vulnerabilities. Hackers use every digital trick up their sleeves to steal data and, in some cases, even threaten to publicly release sensitive information. As the world has moved into an increasingly digital direction, ransomware attacks are growing sharply and causing more headaches than ever for companies.

We are excited to announce the official release of our comprehensive ransomware preparedness tool which we are offering free of cost. The assessment is based on data from hundreds of real ransomware events, guidance from the U.S. Department of Homeland Security, and our own research.

The whole thing can happen in less than a day. At one company, it was two hours from initial compromise to domain compromise of hundreds of machines.