2020 was an eventful year on the security front, and 2021 promises to be no different. As in recent years, one the key scourges for enterprises to fight are increasingly sophisticated cyberattacks, including ransomware attacks.
Ransomware attacks are only going to accelerate in the coming year, for several reasons. For starters, there’s a well-organised criminal element that has determined that there are piles of money to be made by denying companies access to their data. In fact, the average ransomware demand jumped in 2020 to nearly USD $180,000.
Additionally, crypto currency is becoming more available to more people, providing an ideal financial ecosystem for these attacks to flourish. Adding fuel to the fire, criminals are helping each other out by creating platforms for ransomware attacks (Ransomware-as-a-Service, anybody?).
Enterprises, for their part, are willing to pay the ransom, because they simply can’t do business without their data – and the criminals know it. As a result, if a company is big enough to pay a ransom, they will be targeted.
The enterprises who will bear the brunt of these ransomware attacks, though, won’t be the Amazons and Googles of the world, or members of the Fortune 10 who have loads of resources to devote towards securing their IT infrastructure.
The most vulnerable will actually be “the Fortune 490” and small- to mid-size enterprises. There will be no bending of the curve with regards to the acceleration of ransomware attacks until these SMEs are at the same security level as the big players – and there are two key steps these enterprises should take to help make that happen.
Reduce the target on their backs by moving to the cloud.
There is increasing recognition that unless you’re a very large, very well-resourced company, the “security war” is only winnable in the cloud. Every technology that you add to your on-premises network adds to your security exposure and paints a bigger target on your back.
So, why fight the war on that battlefield? The more you can remove systems and data from your on-premises environment and move them to a secure cloud provider, the better off you are – and the more you reduce the size of the target on your back
In the coming year, expect more and more services to move to the cloud. It won’t just be payroll, sales, and document management: Security technologies, from identity management to threat monitoring, will make the leap as well.
The bottom line? It just makes more and more sense to have these services in the cloud. The well-designed cloud players are simply going to do a better job of securing important data and files from ransomware attacks than SMEs and other members of the “Fortune 490” could hope to achieve through in-house, on-premises efforts.
Automate out the weakest link by removing human vulnerabilities.
IT has historically relied on people to “keep the lights on” and maintain the IT infrastructure. Unfortunately, we’ve learned over time that humans are also the weak link in the security chain – whether that’s human beings logging into servers, logging into databases, running patches, or even doing troubleshooting.
For most cyberattacks – and ransomware attacks in particular – what an attacker is leveraging is the soft spot embodied by a human being. Humans are the ones who accidentally make a mistake and leave a setting unsecured or accidentally click on an email that they shouldn’t have, causing a chain reaction of unintended consequences.
Given this fact, customers in 2021 need to be asking their IT service providers – especially their cloud providers – “How have you gotten away from that approach? Have you automated everything that comes with managing an infrastructure or managing an application, so that humans are largely removed from the equation?”
Every step, from server maintenance to troubleshooting, should aim to be automated. In line with the “zero trust” approach, no one person should be able to execute a change to the system that can affect the security of the system.
Getting rid of the human vulnerabilities in any kind of hosted IT environment has massive security value, and this will increasingly become a customer expectation – or even a customer demand.
A Fighting Chance
No one is saying that the largest enterprises in the world have a worry-free road to travel when it comes to security – they still suffer the slings and arrows of cyberattacks and ransomware threats. But it is the “Fortune 490”and the SMEs who are most at risk of being impacted, simply because they don’t have the same amount of resources to throw at their IT infrastructure as the large heavyweights.
Fortunately, by migrating their critical systems and data to the cloud and automating out the weakest link by removing human vulnerabilities, these smaller companies can significantly strengthen their security posture – giving them a fighting chance at winning the security war in 2021.
CEO
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.