(Tampa Bay, FL) -- A new survey by KnowBe4 shows the growing volume of ransomware victims despite increased efforts to prevent it. Companies totaling 1,138 across a variety of industries participated. The study compares levels of concern over ransomware from 2014 to 2016
The results showed there is growing apprehension over ransomware, rising to 79 percent from 73 percent of those who are very or extremely concerned about it. There was a huge jump in companies hit directly by ransomware at 38 percent in 2016 compared to 20 percent in 2014. Midsize companies 250-1,000 were the hardest hit at 54 percent. Two out of three knew someone who was hit at 65 percent compared to 43 percent in 2014. IT professionals surveyed are even more worried ransomware will continue to grow scoring 93 percent over 88 percent in 2014. Additional highlights of the study include:
- 61 percent feel email attachments pose the largest threat compared to 47 percent in 2014.
- Companies with 1000+ employees have been hit by ransomware 41 percent and below 250 at 35 percent.
- 71 percent of tech companies know someone who has been hit, higher than education and banking who hover at or slightly above 50 percent.
- Manufacturing has been hit the hardest at 54 percent compared with 44 percent in healthcare, education at 35 percent, tech at 29 percent and banking at 28 percent.
- 89 percent consider Security Awareness Training the most effective protection from ransomware, immediately followed by backup 83 percent, almost identical to 2014.
- Only 19 percent feel their current solutions are very effective, while 70 percent feel they are somewhat effective.
- Confidence in email and spam filtering effectiveness is 72 percent.
- If faced with 4 hours of lost work from ransomware encryption, only 40 percent would rely on backup compared with 81 percent in 2014. 51 percent would just reformat and start from scratch (nuke).
- The study asked when confronted with a scenario where backups have failed and weeks of work might be lost, 42 percent would begin with paying the $500 ransom and hope for the best vs 57 percent in 2014.
“We thought it would be interesting to see the level of impact that ransomware has had over the last few years. The threat of ransomware is very real and IT professionals are increasingly realizing traditional solutions are failing,” said Stu Sjouwerman, CEO of KnowBe4. “IT pros agree that end-user Security Awareness Training is one of the most effective security practices to combat these ransomware threats.”
Surprisingly, only 40 percent would rely on backup to solve the situation. However, faced with the potential scenario of several weeks of failed backups, nearly half say they would be forced to pay the ransom. This can have a grave impact on organizations as backups fail 50-66 percent of the time, according to the method used (tape vs cloud). According to a report by Symantec, 47 percent of enterprises lost data in the cloud and had to restore their information from backups, 37 percent of SMBs have lost data in the cloud and had to restore their information from backups and 66 percent of those organizations saw recovery operations fail.
Sjouwerman further stated, “Our study shows corporate awareness of phishing attack vectors has increased but users need more help as techniques evolve and criminal exploits become more sophisticated. The overwhelming majority of IT pros think the criminals behind ransomware should be prosecuted and sent to jail for a long time. KnowBe4 agrees, but U.S. law enforcement has no jurisdiction in Eastern Europe where these criminals are largely free to commit their crimes, and we have to rely on our own ingenuity to recognize these threats.”
According to report by EMA, 41 percent of employees still receive no security awareness training, and the programs that do exist have varying effectiveness. KnowBe4 recommends frequent simulated phishing attacks to keep employees aware and on their toes.
