Connect with us

Hi, what are you looking for?

HEADLINES

Ransomware attacks drive zero-trust network access adoption – Sophos

Organizations w/ recent direct experience of a ransomware attack have considerably higher adoption of zero-trust network access (ZTNA) technology.

A study of 5,400 IT professionals has revealed a correlation between the direct experience of ransomware and the adoption of a zero-trust approach.

Organizations that had experienced a ransomware attack in the previous year, defined as multiple devices being impacted but not necessarily encrypted, reported considerably higher levels of awareness of the zero-trust approach. They were more advanced in implementing zero-trust network access (ZTNA) solutions than those that hadn’t experienced an incident.

ZTNA demands verification of every endpoint, server, and user before granting access to an application or any part of the network. As adversaries grow ever more skilled in exploiting remote tools and credentials and turning a target’s security policies against them, a defense-in-depth approach to security based on the concept of ‘trust nothing, verify everything’ is becoming the benchmark for protection.

These organizations’ direct experience of ransomware likely accelerated the implementation of a zero-trust approach to help prevent future attacks.

Advertisement. Scroll to continue reading.

The findings result from an independent survey of 5,400 IT professionals in organizations with between 100 and 5,000 employees conducted by research house Vanson Bourne on behalf of Sophos in 2021.

The role of ZTNA in preventing ransomware attacks

Breaching the victim’s network is one of the first steps in a ransomware attack. The rapid increase in remote working over the last two years has hugely increased the opportunity for attackers to exploit vulnerable VPN clients to get a foothold in an organization. Once inside, they are often free to move laterally throughout the network, escalating privileges and progressing the attack.

By eliminating vulnerable VPN client software, granularly controlling access based on device health and identity, and micro-segmenting applications, ZTNA stops attackers from breaching the organization and moving around it, even if they obtain legitimate credentials.

Key findings from the research include: 

Advertisement. Scroll to continue reading.

Finding one: Ransomware victims have much greater familiarity with the ZTNA approach

IT professionals in organizations that had been hit by ransomware in the previous year are almost 50% more likely to be ‘very familiar’ with the ZTNA approach than those whose organizations hadn’t experienced an incident (59% vs. 39%). It rises to 71% among those whose organizations had been hit and paid the ransom.

Finding two: Ransomware victims are more advanced in their adoption of the zero-trust approach

One quarter (25%) of those whose organizations experienced a ransomware attack in the previous year have already fully adopted a zero-trust approach, rising to 40% of those whose organizations were hit and paid the ransom. In comparison, just one-sixth (17%) of those that hadn’t experienced an attack had already fully migrated to this approach.

Finding three: Ransomware victims have different motivations for adopting a zero-trust approach

Advertisement. Scroll to continue reading.

Respondents were asked about their motivations for adopting a zero-trust approach and, while there were several commonalities, there were also clear areas of difference.

  • To improve our overall cybersecurity posture’ was the most common motivator among both victims and non-victims
  • The second most common motivator among ransomware victims was the desire to ‘simplify our cybersecurity operations’ (43%), potentially reflecting that complex security had contributed to their previous attack.
  • Ransomware victims are also heavily motivated by ‘supporting our move to increased use of the cloud’ (42%). It dropped to 30% amongst those that hadn’t experienced a recent attack.
  • Similarly, ransomware victims were also much more likely to say that ‘to move from a CAPEX to an OPEX model´ was one of the main factors behind their zero-trust approach adoption (27% vs. 16%, and rising to 34% among those that had been hit by ransomware and paid the ransom)

Finding four: The pandemic was more likely to impact the zero-trust adoption plans of ransomware victims positively.

For many organizations, the pandemic positively impacted their plans for adopting a zero-trust approach. For many, it created a need for zero trust that they didn’t have before. It is understandable as many companies and public bodies were previously wholly office-based and didn’t need to provide secure remote access.

Half (50%) of ransomware victims and 36% of non-victims reported that the pandemic enabled them to move budget to adopt a zero-trust approach. At the same time, many said that it helped them to divert people and/or money from other activities to zero trust.

The survey findings highlight that organizations that fell victim to ransomware and paid the ransom were most likely to experience a positive pandemic impact on their zero-trust adoption. It seems that the pain of the ransomware attack might have concentrated minds and resources on effectively mitigating a future incident.

Sophos recently launched  Zero Trust Network Access (ZTNA), which provides a much more secure and easy-to-manage remote access solution that delivers end-users a transparent, frictionless experience.

Advertisement. Scroll to continue reading.

Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

From December 5, 2024 to January 31, 2025, enjoy exclusive deals on the best ASUS laptops and ROG devices, and enjoy matching them with the newest kicks...

HEADLINES

This move underscores Globe's commitment to expanding its services to meet the evolving needs of its customers, particularly the Overseas Filipino Worker (OFW) market.

HEADLINES

Smart also sounds the alarm on criminals using ‘fake cell towers’ to bypass network defenses. The Philippine National Police had earlier called on the...

HEADLINES

“Our free AI-powered platform provides access to in-demand job skills that address the gaps in the school-to-work journey of K-12 students in the Philippines,”...

HEADLINES

The program is a step-up from the standard on-the-job training in college level education. The tie-up involves students from the College of Accountancy, Business Administration...

HEADLINES

Through this collaboration, Smart and PLDT Enterprise will leverage Ericsson’s expertise in private 5G to offer tailor-made network solutions for enterprises, helping them maximize...

HEADLINES

"Every technology is now either enabling AI or is enabled by AI. We are evolving from static and reactive AI to a more dynamic,...

HEADLINES

With AWS, Grab is pursuing a technology-led strategy to accelerate growth across its mobility, deliveries and financial services verticals, including its new digibanks, while...

Advertisement