Ransomware Threat Alarmingly High for SMBs as They Place Security on the Back Burner

Small and medium-sized businesses are still a top target for ransomware attacks, and the number of attacks will most likely increase in 2019, according to a recent survey of MSPs. Over half of MSPs confirmed their clients experienced at least one ransomware attack in the first half of the year, while 35 percent said their clients were attacked more than once a day, regardless of their operating system. In fact, the number of ransomware attacks targeting Apple devices has increased five-fold in the past year, the survey found.

Employees are a key factor in ransomware breaches because they often fall for phishing schemes, click bait, web ads or malicious websites. Regular security training workshops will help small companies reduce ransomware attacks, while the study claims business continuity and disaster recovery technology should be top priority as it helps companies recover in 24 hours.

Ransomware attacks inflict significant revenue loss, with the attack itself often costing more than the ransom. According to the survey, a company might end up spending ten times the ransom on a ransomware attack, “with attacks costing a business $46,800 on average and the ransom requested averaging $4,300 per attack.”

The costs are extremely high because SMBs most often think they’re not interesting enough to draw the attention of hackers, so they don’t invest in a cybersecurity strategy or ransomware response plan. This is where they’re wrong because, ultimately, their company will struggle with ransomware, among other attacks, and the final remediation and containment cost can be outrageous enough to put them out of business.

Due to limited capabilities and complexity of the environment, data breaches are detected late and insider threats can go undetected, potentially destroying a small company that lacks proper infrastructure monitoring and real-time analysis of malicious behavior. What’s worse, companies rarely report ransomware attacks. Less than one in four is disclosed to higher entities.

Enterprises should focus on preventing threats first but, unfortunately, not all have the capabilities to detect advanced attacks on their endpoints. Hackers are well aware that SMBs are willing to pay ransom to get their data back and that they are an easier target than larger businesses.

In 2017, Bitdefender found that even though 38 percent of SMBs had paid an average ransom of $2,423, they did not recover the encrypted data. Not even half of SMBs that paid to decrypt their data ever regained access.

The intense interest in infecting small companies is not even in the slightest unusual. Hackers can manipulate SMBs as entry points to infiltrate larger companies they do business with. Even though budgets can be tight, SMBs should invest in an endpoint security solution, regularly patch and update software, keep backups in multiple environments, install content filtering solutions for their email servers and train staff on security awareness.