By Andrew Rubin, CEO and cofounder of Zero Trust unicorn Illumio
Organizations are losing in cyberspace. Companies are not only hemorrhaging millions of dollars to ongoing ransomware raids, but attacks on critical infrastructure are impacting real-world services on a regular basis (from impairing water treatment facilities, to shutting down national oil and gas pipelines, to halting global food distribution).
Nearly every week, there’s a new catastrophic breach – at a time when organizations are pouring more than $150 billion a year into cybersecurity. Something’s not right – in fact, something’s broken. And it’s about time organizations recognize that it’s not security technology that’s failing them, it’s the model that’s broken.
Ransomware is worse than ever – and it’s not easing up anytime soon.
Earlier this year, the firm Cybersecurity Ventures released new estimates that project ransomware costs will reach $265 billion by 2031. What’s more, they predict, “There will be a new attack every two seconds as ransomware perpetrators progressively refine their malware payloads and related extortion activities.”
Not only is the volume of ransomware attacks expected to increase in the years ahead, but those attacks are expected to be even more successful. Gartner’s latest Emerging Risks Monitor Report suggests that the threat of “new ransomware models” remains the top cybersecurity concern facing business leaders in the year ahead, warning, “The rise of new ransomware models as a top threat to organizations in many ways tracks the growth in popularity of cryptocurrencies... The ransomware business model has become more specialized and otherwise efficient, including ‘ransomware-as-a-service (RaaS),’ and demand for bitcoin payouts, resulting in a proliferation of attacks.”
In other words, ransomware is getting worse – and like any global disaster, leaders need to understand its root cause before they can begin to safeguard their organizations, stakeholders, and customers against it.
Breaking down the great ransomware catalyst.
At their core, ransomware attacks have proven so effective for one simple reason: they work. Organizations are willing to pay the ransom following an attack – some to avoid shutting down their business or losing their data, others because they have no other choice. However, this practice only further incentivizes attackers to strike. A report from Atlas VPN, released in July, estimated that in 2021 alone, ransomware had cost organizations $45 million.
The DarkSide-led ransomware attack on Colonial Pipeline in May cost the company $4.4 million to recover stolen assets and resume operations. Another costly ransomware payout in 2021 was JBS Meats – one of the world’s largest meat producers who suffered a ransomware attack later in May, effectively freezing the global meat supply chain across 20+ countries. The company ended up paying a ransom of $11 million.
In short, ransomware-as-a-service (RaaS) is a thriving business today because bad actors are seeing that effective attacks on organizations can garner millions of dollars (or the cryptocurrency equivalent) in revenue. For organizations to be resilient in 2022, business leaders need to rethink the way they’re approaching cybersecurity. And one of the most effective ways to bolster business resiliency at scale is by embracing the framework known as “Zero Trust.”
The new cybersecurity model.
The term “Zero Trust” was coined more than a decade ago, though it’s only recently hit full hype cycle and been thrust into the cybersecurity spotlight. Zero Trust is predicated on an ‘assume breach’ mentality. You should operate as if bad actors and intruders already have access to your assets – or your partners’ assets, or a third-party vendor’s assets. Assume they’ve already infiltrated those networks, bypassed a firewall, or exploited a vulnerability in the supply chain – because they probably have.
And today, a failure of imagination and hoping you’re secure can cost millions. Hope is not a security strategy, but implementing a Zero Trust model is.
In the past year especially, Zero Trust architectures have achieved a new level of global recognition – most notably from the President of the United States. In his Executive Order on ‘Improving the Nation’s Cybersecurity’ issued in May 2021, President Joe Biden states:
“To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, the Federal Government must take decisive steps to modernize its approach to cybersecurity… The Federal Government must adopt security best practices; advance toward Zero Trust Architecture; accelerate movement to secure cloud services… and invest in both technology and personnel to match these modernization goals.”
Shortly after, Anne Neuberger, President Biden’s Deputy National Security Advisor for Cyber and Emerging Technology, issued a memorandum that outlined and reiterated several Zero Trust best practices – segmenting your networks, putting multi factor authentication in place, etc. – for organizations looking to shore up infrastructure and digital assets against ongoing ransomware attacks.
In short, in all the recommendations the Biden Administration has made for organizations looking to bolster their cybersecurity wherewithal, Zero Trust tactics remain chief among them.
While ransomware may be here to stay, there are ways businesses can effectively mitigate threats to prevent them from having devastating impacts. Prioritizing organizational security, practicing cybersecurity basics (patching, segmenting, testing incident response plans, etc.), and implementing strategies like Zero Trust segmentation are just a few of the ways that leaders can begin bolstering their business resiliency in a way that accounts for scale, speed and the breaches that will inevitably come.
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.