2017勒索软件报告（英文版）_55页_4mb

2017 Ransomware Report Summary

Core Content

Ransomware has emerged as one of the fastest-growing cybersecurity threats, with the FBI estimating it to be a $1 billion industry. It is seen as the most significant threat to both business and government organizations. The report highlights the challenges and responses of cybersecurity professionals to ransomware attacks, emphasizing the need for comprehensive strategies to mitigate risks and enhance preparedness.

Key Survey Findings

• Ransomware Perception:

  • 80% of cybersecurity professionals perceive ransomware as a moderate or extreme threat.
  • 79% predict it will be a larger threat in the next 12 months.
  • Only 59% are confident in their ransomware defense capabilities.

• Attack Vectors:

  • Email and web use are the most common infection methods.
  • 73% of attacks involve malicious email attachments.
  • 54% involve phishing emails.
  • 28% involve visiting compromised websites.

• Data at Risk:

  • Financial data is the most at risk, with 62% of organizations reporting it as a target.
  • Customer information follows at 61%.
  • Employee information (51%) and company IP (50%) are also significant targets.

• Response Strategies:

  • 74% of organizations consider data backup and recovery the most effective solution for ransomware.
  • 96% have a data backup and recovery strategy in place.
  • 54% can recover within a day, while 39% estimate recovery to take more than a few weeks.

• Attack Frequency:

  • 75% of organizations affected by ransomware experienced up to five attacks in the last 12 months.
  • 25% experienced 6 or more attacks.
  • 78% expect an increase in attack frequency over the next 12 months.

• Response Tactics:

  • The most common response is identifying the ransomware, isolating infected systems, eradicating malware, and recovering from backups (81%).
  • 29% call law enforcement immediately.
  • 28% engage third-party incident response services.
  • 24% attempt to decrypt files themselves.
  • 77% of organizations are not likely to pay the ransom.

• Motivations for Attacks:

  • Financial gain is the primary motivation (86%).
  • Sabotage and disruption of business activities (58%) and political beliefs (17%) are also notable.

• Culprits Behind Attacks:

  • Organized cybercriminals (69%) are the top perceived threat.
  • Non-organized opportunistic hackers (58%) and state-sponsored hackers (28%) follow.

• Detection and Blocking Tools:

  • Endpoint security tools (83%) are most commonly used for ransomware detection.
  • Email and web gateways (64%) and intrusion detection systems (46%) are also widely used.

• Confidence in Defense and Remediation:

  • Only 12% are extremely confident in their organization's ability to detect and block ransomware.
  • 16% are extremely confident in their ability to remediate a ransomware attack.

• Budget and Resources:

  • 52% of organizations cite lack of budget as a major obstacle.
  • 60% expect to increase their ransomware security budget.

Ransomware Readiness

• Incident Response Teams:

  • 40% of organizations do not have an Incident Response team.
  • 72% have implemented employee awareness and security training programs.

• Speed of Detection and Recovery:

  • 61% of ransomware attacks are detected within hours.
  • 24% are detected near real-time.
  • 21% are detected within minutes.

• Recovery Time:

  • 54% believe they can recover within a day.
  • 39% estimate recovery to take more than one day to a few weeks.

Effective Prevention and Response

• Most Effective Prevention:

  • User awareness and training (77%).
  • Anti-malware/antivirus/endpoint security solutions (73%).
  • Updating/patching systems and software (72%).

• Most Effective Response:

  • Data backup and recovery (74%).
  • Threat intelligence, behavioral analytics, and cyber insurance are also considered effective.

Conclusion

Ransomware remains a critical threat to organizations, with a growing frequency and impact. Cybersecurity professionals emphasize the importance of multi-layered defense strategies, including user education, endpoint security, and robust data backup and recovery processes. Despite the challenges, there is a growing awareness and willingness to invest in better ransomware protection.