Connect with us

Cyber Security

Ransomware Reality is Biting, So How Do Businesses Bite Back?

Published

on

Written by Dave Russell, VP, Enterprise Strategy, Veeam

Ransomware attacks have bitten a gaping hole in the pockets of businesses that are having to pay extortionate ransoms in response to highly targeted attacks by sophisticated criminal organisations. The problem has only worsened with the onset of mass remote working. The extension of the office’s boundaries into online and remote locations has exposed severe vulnerabilities, and criminals are all too willing to take advantage.

Right now, a new ransomware attack will occur every 11 seconds. To put this in context, in the five minutes it takes you to read this article, 27 businesses will have been attacked by ransomware. The best piece of advice on ransomware is not to give in and pay. But despite the majority of businesses will pay the ransom that this attack demands. Many feel under extreme pressure to limit the damage of downtime caused by ransomware, and the quickest resolution is to pay up.

It’s not a surprise that so many have chosen to pay when they’re already grappling with the challenges and pressures of operating throughout the risky business terrain that COVID-19 has created. However, this is simply encouraging cyber-attackers to continue exploiting this lucrative illegal market, as is evident from the 600% uplift in attacks since COVID-19 first emerged.

On a positive note, businesses and governments have recognised that this can’t continue. Ransomware is now on the agenda of every boardroom and even made the cut for discussion at the G7, as well as numerous other diplomatic talks between global leaders. Now is the time to think about modern data protection and its future. And now is the time to bite ransomware back.

This is organised crime
It’s easy to forget that there’s a criminal behind the ransomware that makes itself at home within your business system. While it may once have been deemed something loitering on the web and only harmful if clicked on, many are starting to recognise the severe, complex, and targeted nature that ransomware really has. This is organised crime, and it works innovatively to infiltrate your business and your supply chain. It quite honestly poses a genuine threat to entire industries and communities.

So how can we start clamping down on the perpetrators behind this? The downside to such a connected and digital world means an attacker can operate in completely different areas of the world, making it difficult to prosecute using the same legal system your business is subject to. The reality is that a clampdown of this scale is going to require international cooperation and government action beyond anything we’ve seen in the cybersecurity sphere. And of course, this is going to take time, which, as you know, is something businesses don’t have when facing constant threats.

Therefore, while we wait for these political interventions to happen, businesses must be fully prepared for the ongoing onslaught of ransomware attacks, especially now they’re operating in remote locations. Previous cybersecurity measures won’t be enough, we have to adapt to the enemy by deploying modern data protection measures.

Think like a hacker
In the same way that a detective has to think like a criminal to solve a crime, the only way businesses will successfully protect themselves sufficiently from cyberattacks is to think like hackers. They’re relentless, hyper-aware, and stringent. Employers and employees must act the same to stop vulnerabilities from opening up.

Good digital hygiene must become second nature, as opposed to something practiced for a week following annual cybersecurity training, and forgotten about until the next one. Failure to patch software should create the same attention as failing to lock up the office overnight. Not having a disaster recovery plan is akin to skipping contents insurance. We can’t simply think about security in the physical space because the enemies are operating in the digital one.

Another important aspect is thinking about the hacker’s success rate. In many cases, they’ll spend all day attacking systems. They dedicate their time to evolve and innovate their attacks to overcome the security barriers that are holding them back. We need to anticipate they will eventually be able to do this, even if the best cybersecurity defences are in place. As we can see from the number of businesses paying ransoms, an attack can cause enough damage to push businesses into paying out rather than taking alternative routes.

It’s up to every organisation across every industry to invest in modern data protection practices to minimise the impact of ransomware attacks. Viewing attacks as an inevitability is the first step towards creating a more cyber-secure culture, with employees who are more educated and aware of ransomware. At the same time, businesses need to have the right safeguards in place to minimise disruption, including anti-virus software and firewalls, plus continuous backup and recovery to offer adequate insurance against the crippling effects of ransomware.

If the worst happens, and your systems are compromised, the business won’t collapse, and the attacker won’t get everything they want. The cybersecurity landscape may feel rocky right now, but there are steps we can and should take to better protect ourselves from the damages. It’s time to bite the ransomware hackers back.

Cyber Security

Beyond Blocklists: How Behavioural Intent Analysis Can Safeguard Middle East Businesses from Rising AI-Driven Bot Threats

Published

on

The Middle East is facing an unprecedented surge in AI-driven bot attacks, with malicious automation now outpacing traditional defenses. Mohammad Ismail, Vice President for EMEA at Cequence Security, warns that legacy tools like IP blocklists and rate limiting are no match for today’s sophisticated threats (more…)

Continue Reading

Cyber Security

Sophos Boosts Firewall with New Protection and Incident Response Features

Published

on

Sophos has announced a significant update to its Sophos Firewall software, introducing enhanced protection and incident response capabilities. This update notably includes Sophos NDR Essential, a new feature now available free of charge to all customers holding an XStream Protection license for Sophos Firewall.

This integration empowers Sophos Firewall with two dedicated artificial intelligence (AI) engines specifically designed to detect both malware communications and those utilizing algorithmically generated domain names. This advanced functionality, derived from the Sophos Network Detection and Response (NDR) probe, aims to identify sophisticated malware communications even if they are previously unknown or not yet indexed. It serves as a powerful complement to the Active Threat Response capabilities already embedded within Sophos firewalls.

Chris McCormack, Senior Product Marketing Manager at Sophos

Addressing the technical demands of such advanced detection, Chris McCormack, Senior Product Marketing Manager at Sophos, explained the strategic approach, “NDR traffic analysis requires substantial processing power. That’s why we’ve adopted a new approach by deploying an NDR solution in Sophos Cloud to offload the heaviest tasks from the firewall.” This cloud-centric design ensures optimal performance without burdening the firewall’s on-device resources.

Beyond network detection, the update also brings significant improvements to connectivity and user authentication. Sophos Connect now integrates EntraID for Single Sign-On (SSO). This new feature for the VPN client, bundled with Sophos Firewall, is set to enhance both the security and user experience for SSL and IPsec VPN connections. The integration with EntraID (Azure AD) enables users to authenticate and leverage multi-factor authentication for both Sophos Connect and access to the user portal hosted by the firewall, streamlining secure access.

Further VPN-related enhancements include:

  • Improved user interface and usability: Connection types have been renamed for greater clarity, with “site-to-site” now referred to as “policy-based” and tunnel interfaces as “route-based,” making configurations more intuitive.
  • Dynamic validation of the IP address pool: For VPN connections (SSL VPN, IPsec, L2TP, and PPTP), the system now dynamically validates the allocated IP address pool, helping to better resolve potential IP address conflicts.
  • Strict profile enforcement: IPsec profiles now exclude default values to ensure algorithm synchronization, effectively eliminating potential fragmentation of session negotiation packets that could otherwise prevent site-to-site VPN tunnels from being established.
  • Route-based VPN and SD-RED scalability: The system has been optimized to support up to 3,000 simultaneously established tunnels. Specifically, Sophos Firewall solutions can now manage up to 1,000 SD-RED site-to-site tunnels and connect up to 650 concurrent SD-RED devices.

Additional management improvements enhance administrative flexibility and search capabilities:

  • More flexible DHCP Prefix Delegation (IPv6 DHCP-PD): The system now supports a broader range of prefixes, from /48 to /64, improving compatibility with various internet service providers.
  • Router Advertisement (RA) and DHCPv6 server: These features are now enabled by default, simplifying IPv6 network setup.
  • Resizable table columns: The web admin interface continues its adaptation for ultra-wide screens, with many configuration pages now allowing users to resize columns as needed for improved usability.
  • Enhanced object search functionality: The search field within the SD-WAN routing configuration screen now supports more granular criteria, including route name, ID, objects, and object values like IP addresses and domains. Similarly, local ACL rules now also support object name and value searches, extending to content-based searches for more precise results.
  • Default configuration changes: To streamline initial setups, default firewall rules and rule groups previously created during new firewall deployments have been removed. The initial configuration now only includes the default network rule and MTA rules. Furthermore, the default firewall rule group and the default gateway probe for custom gateways are now set to “None” by default.

Sophos continues its commitment to cybersecurity through a “Secure by Design” approach, enhancing the intrinsic security of its firewalls. This methodology involves the containerization of specific features and rigorous integrity checks on critical operating system files using mathematical checksums. Any detected checksum mismatch triggers a potential compromise alert, enabling monitoring teams to proactively identify possible security incidents affecting the firewall OS integrity. This proactive detection allows incident response and development teams to react swiftly to critical security events.

This update is now available for manual download and deployment by customers with any Sophos Firewall equipped with a valid license.

Continue Reading

Cyber Security

Honeywell Report Reveals 46% Quarterly Spike in Industrial Ransomware

Published

on

A new report from Honeywell reveals a significant escalation in cyber threats facing the industrial sector, with ransomware attacks surging by 46% from Q4 2024 to Q1 2025. The company’s 2025 Cybersecurity Threat Report indicates a widespread increase in both malware and ransomware activity, notably including a 3,000% spike in a specific trojan designed to steal credentials from industrial operators.

The allure of industrial targets for cybercriminals is clear, as explained by Paul Smith, director of Honeywell Operational Technology (OT) Cybersecurity Engineering and author of the report, “Industrial operations across critical sectors like energy and manufacturing must avoid unplanned downtime as much as possible – which is precisely why they are such attractive ransomware targets.” He further emphasized the agility of attackers, stating, “These attackers are evolving fast, leveraging ransomware-as-a-service kits to compromise the industrial operations that keep our economy moving.”

The urgency of these threats is underscored by definitions from the Cybersecurity and Infrastructure Security Agency (CISA) in the United States, which classifies incidents as “substantial” if they lead to unauthorized access causing significant operational downtime or impairment. Industry analyses corroborate the severe financial impact, showing that unplanned downtime—whether from cyberattacks or equipment failure—costs Fortune 500 companies approximately $1.5 trillion annually, representing a substantial 11% of their revenue.

To compile these critical findings, Honeywell’s researchers undertook an extensive analysis, reviewing over 250 billion logs, 79 million files, and blocking 4,600 incident events across the company’s global installed base. Their detailed examination yielded several concerning trends:

  • Ransomware’s Relentless Ascent: The first quarter of 2025 alone saw 2,472 potential ransomware attacks, already accounting for 40% of the entire annual total recorded in 2024, signaling a rapid acceleration of this threat.
  • Trojan Exploitation Targeting OT: A particularly dangerous trojan, identified as W32.Worm.Ramnit, was responsible for 37% of files blocked by Honeywell’s Secure Media Exchange (SMX). This figure represents an alarming 3,000% increase in this specific trojan compared to the preceding quarter, indicating a concerted effort to exploit industrial access.
  • Persistent USB-Based Risks: Despite awareness campaigns, external media continues to pose a significant threat. Honeywell’s SMX detected 1,826 unique USB threats in Q1 2025, with 124 of these being entirely new and previously unseen. This follows a 33% increase in USB malware detections in 2023 and an astounding 700% year-over-year surge in 2022, highlighting the enduring vulnerability posed by removable devices.

The scope of the report’s analysis also expanded to include threats introduced via other plug-in hardware, known as Human Interface Devices (HIDs). This encompasses commonly used items such as mice, mobile device charging cords, laptops, and various other peripherals, which are frequently connected to on-premise systems for software updates or patching, creating additional vectors for potential compromise.

In light of these escalating risks and evolving regulatory landscapes—such as new SEC reporting regulations requiring the disclosure of material cybersecurity incidents—industrial operators face increasing pressure to enhance their defenses. As Smith concluded, “Leveraging Zero Trust architecture and AI for security analysis can speed detection and enable smarter decision making and proactive defense in an increasingly complex digital landscape.” His recommendation underscores the need for decisive action and advanced security strategies to mitigate costly operational downtime and safety-related risks in the industrial environment.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.