Organizations Strengthen Their Cybersecurity Defense Against Ransomware and Cyber Attacks

To date, 2021 was the most disruptive year with regards to cyberattacks — and it’s looking like 2022 could be even more challenging for organizations who are still working to implement security measures.

In recent months, global conflict has caused mounting concern about potential cyberattacks. Organizations have begun to think more critically about their current infrastructure, and many are putting additional safeguards in place in an effort to reduce their risk. Should you be taking the same steps as your peers?

In our 2022 Compliance Benchmark Report, we surveyed more than 700 cybersecurity, IT, quality assurance, internal audit, finance, and other professionals about their compliance programs to gain a better understanding of their organization’s position when it comes to compliance, including strengths, weaknesses, and opportunities.

Here’s what we learned about organizations’ response to the increase in ransomware and cyberattacks.

2021 Brought an Increase in Ransomware 

Ransomware dominated the news cycle in 2021, with a plethora of headline-grabbing attacks targeting industries from government to retail. According to the latest Ransomware Study from IDC, a staggering 37% of global organizations were the victim of some form of ransomware attack in 2021.

Ransomware attempts certainly haven’t slowed down in 2022 — if anything, they have accelerated. Earlier this year, a prolific ransomware variant compromised at least 52 entities across 10 of the 16 U.S. critical infrastructure sectors. The same ransomware has also affected scores of commercial organizations since its discovery in April 2020.

The increasing prevalence of ransomware attacks has caused many organizations to take greater care when creating a strategy to prevent attacks and reduce the potential damage if — or more likely, when — an attack does occur. In our 2022 Compliance Benchmark Survey we found that:

While it’s encouraging to see that most organizations either have a ransomware preparedness plan in place or are working to develop one, it is also noteworthy that one in 10 organizations  don’t view ransomware as a significant cybersecurity concern. This is worrying, as an effective security posture requires organizations to think proactively, not reactively, about cybersecurity threats.

The (Potential) Impact of the Executive Order on Improving the Nation’s Cybersecurity 

By the time the U.S. government issued its Executive Order (EO) on Improving the Nation’s Cybersecurity in May 2021, the Colonial Pipeline attack had already occurred. Knowing that much of the country’s domestic critical infrastructure is owned and operated by the private sector, the EO has highlighted the importance of improving cybersecurity across the board.

That’s why the EO outlined a plan to modernize the security of federal information systems, and called on the private sector (e.g., organizations that provide cloud-based software to the federal government) to enhance their security posture.

When we asked organizations if they believe the Executive Order will impact their approach to cybersecurity, responses were mixed:

• 37% said “yes”
• 30% said “no”
• 28% said “not sure”

However, in industries typically thought of as being closer to the federal supply chain, “yes” responses were higher: 51% of government, 46% of IT services, and 43% of technology organizations said they agree the EO will affect their approach to cybersecurity.

Unfortunately, attacks continue to harm various government sectors. The first half of 2022 has already presented a number of serious incidents, such as the Okta supply chain breach and the government-targeted attack on Bernalillo County in New Mexico.

What You Can Do to Address the Increase in Cyberattacks 

Increased cyberattacks on our nation have organizations across industries on edge — a full 83% of survey respondents said they believe they would be impacted by an attack on their organization’s critical infrastructure.

Despite these worries, there are preventative steps that can be taken right now. Take a comprehensive look at your current cybersecurity posture and place an emphasis on:

• Adopting a tactical mindset to remain proactive about emerging cyber threats
• Identifying gaps in your current ransomware preparedness plan  
• Uncovering cybersecurity vulnerabilities through Penetration Testing and Social Engineering
• Leveraging compliance certifications to create peace of mind for customers and demonstrate the proper security measures are in place

A third-party assessment firm like A-LIGN can help you discover where your cybersecurity posture currently stands. Our one-of-a-kind Ransomware Preparedness Assessment reviews your risk, security preparedness, and the strength of your existing controls, helping you determine if your planned response to a security event is acceptable.