CrowdStrike’s fourth Global Security Attitude Survey reveals 63 per cent of organisations are losing trust in legacy vendors
Ransomware payout demands and extortion fees are increasing exponentially, while trust in legacy IT vendors has dipped and organisations are getting slower at detecting cybersecurity incidents, according to the 2021 CrowdStrike Global Security Attitude Survey.
“The survey presents an alarming picture of the modern threat landscape, demonstrating that adversaries continue to exploit organisations around the world and circumvent outdated technologies. Today’s threat environment is costing businesses around the world millions of dollars and causing additional fallout,” said Michael Sentonas, chief technology officer at CrowdStrike. “The evolving remote workplace is surely accentuating challenges for businesses as legacy software like Microsoft struggles to keep up in today’s accelerated digital world.”
“This presents a clear clarion call that businesses need to change the way they operate and evaluate more stringently the suppliers they work with,” added Sentonas. “The threat landscape continues to evolve at a frightening pace and it’s obvious that modern organisations need a cloud-native, holistic end-to-end platform approach to tackle and remediate threats in a swift manner.”
Customers are facing a crisis of trust in legacy vendors as software supply chain attacks continue to present challenges.
Recent attacks such as Sunburst and Kaseya have once again brought supply chain attacks to the forefront as evidenced by 63 per cent of respondents admitting their organisation is losing trust in legacy vendors, like Microsoft, due to frequent security incidents against these previously trusted technology suppliers.
The issue is so widespread that more than 3 out of every 4 respondents (77 per cent) have suffered a supply chain attack. It’s clear that swift action and newer technologies will be required by businesses looking to increase their cyber resiliency.
- 45 per cent of respondents had experienced at least one supply chain attack in the past 12 months.
- 64 per cent of respondents cannot claim that all their software suppliers have been vetted in the last 12 months
- 84 per cent of respondents are fearful of supply chain attacks becoming one of the biggest cybersecurity threats in the next three years
- Ransomware remains a persistent and highly pervasive threat, costing organisations nearly $2 million on average
Survey data indicates that ransomware attacks are continuing to prove effective, with average ransomware payments increasing 62.7 per cent in 2021 (from $1.1 million in 2020 to $1.79 million in 2021).
Not only that, organisations are almost universally getting hit with “double extortion,” when threat actors not only demand a ransom to decrypt data, they additionally threaten to leak or sell the data unless the victims pays more money. Survey data shows that 96 per cent of organisations that paid a ransom were forced to pay additional extortion fees, costing businesses on average $792,493.
Additional findings include the following:
- 66 per cent of respondents’ organisations suffered at least one ransomware attack in the past 12 months.
- More than half (57 per cent) of businesses did not have a comprehensive ransomware defense strategy in place.
- The average ransomware payment was $1.34 million in EMEA and $2.35 million in APAC and $1.55 million in the US.
- The average ransom payment increased by 63 per cent in 2021 to $1.79 million, compared to $1.10 million in 2020. CrowdStrike Intelligence has observed the average ransom demand from attackers is $6 million. While attackers aren’t getting quite the amounts they are seeking, they are still earning massive payouts. CrowdStrike attributes this to companies understanding both the threat and their exposure, and their ability to negotiate with attackers.
Organisations are moving in the wrong direction when it comes to detection and response time
CrowdStrike encourages organisations to strive to meet the 1-10-60 rule, where security teams demonstrate the ability to detect threats within the first minute of an intrusion, investigate and understand the threat within 10 minutes, and contain and eradicate the threat within 60 minutes. In today’s remote-first digital world, organisations continue to face massive challenges in detecting security incidents, as evidenced by eye-opening survey data.
- On average, respondents estimated it would take 146 hours to detect a cybersecurity incident, from 117 hours in 2020.
- Once detected, it takes organisations 11 hours to triage, investigate and understand a security incident and 16 hours to contain and remediate one
- 69 per cent of respondents said that their organisation suffered an incident because of staff working remotely
In the 2021 Threat Hunting Report, CrowdStrike’s Falcon OverWatch reported that eCrime threat actors are able to move laterally across an organisation’s network in an average of 92 minutes. This paints a sharp contrast between the capabilities of today’s swift attackers and defenders who are increasingly slowed down by high volumes of alerts and tools that lack integrated workflows.
If you liked reading this, you might like our other stories
Leaving A Legacy of Cloud
Modernising Legacy Systems? You Should Know This
