What's Happening?

Facebook Twitter Youtube Linkedin

NEED HELP? QUESTIONS@FIA.ORG.ZA

become A FIA member TODAY
member login

The Ransomware Epidemic

ARTICLE BY

  • Zamani Ngidi

SHARE THIS POST

Ransomware is, by multiple measures, the top cyber threat facing businesses today, with damages caused including downtime costs and recovery time.  Current incident statistics are sobering:

  • Every eleven seconds[1], a company will be hit by a ransomware attack in 2021.
  • The average ransom demand in 2020 was $178,000[2] (R2.7mil)
  • The largest 2020 ransomware demand[3] made to French construction firm, Bouygues was €10mil(R150m).
  • Predicted damages from ransomware are expected to be $20 billion (R600bn) in 2021[4].

What is Ransomware?

In a ransomware attack, threat actors gain unauthorised access to company networks and files using malicious software or malware. After gaining access, these cybercriminals encrypt files making them inaccessible, and demand a ransom payment in cryptocurrency in exchange for the digital key code(s) to decrypt the files. Ransomware attacks have become more advanced in their approach, including pre-emptive measures intended to coerce ransom payment such as targeting and destroying data backups to prevent restoration, and stealing data prior to encryption with the threat of public release. This leaves many victims with the difficult choice of either permanent loss of data and extended business disruption or paying a ransom to regain access and restore operations.

The Payment Conundrum

The South African Cybercrimes and Cybersecurity Bill (B6–2017) criminalises cyber extortion in section 10 of the bill. But at present the legal route is often a lengthy one which most companies do not have the time to venture down, explaining why many ransomware victims opt to pay the ransom to recover critical files or restore the operation of critical systems.

“For most victimised entities, their decision to pay the ransom is based on whether it makes business sense to do so and, if so, how to both engage with the threat actor to negotiate and navigate the often-unfamiliar cryptocurrency landscape to facilitate payment. Post-payment, the most difficult issue facing a victimised entity is the time-consuming and technically taxing decryption process,” says Zamani Ngidi, Client Manager: Cyber Solutions at Aon South Africa, a leading global professional services firm providing a broad range of risk, retirement and health solutions.

“At present, many ransomware victims handle aspects of the incident response investigation themselves, including root-cause analysis of the incident, the scope of the intrusion and restoration of the business. The inherent challenge that comes with handling such a matter internally, is taking up a responsibility that the team may not be adequately equipped or sufficiently experienced to handle, which is why transferring that risk to an experienced cyber risk expert is crucial to save on time and costs,” Zamani explains.

Risk mitigation strategies

At its core, cybercrime is committed by sophisticated and motivated threat actors, who are actively trying to gain access for financial gain. Better protection inherently translates into sensitive, ergo valuable, information being guarded, which could be leveraged against a company during a ransomware attack. The recent SolarWinds debacle[5] highlights the fact that billions of Rands of IT security can be undermined by one weak entry point, an example of the ingenuity of criminal attackers and their methods to obtain access.

Aon offers seven tips to help mitigate the risk of falling victim to ransomware and better prepare for a ransomware incident:

  • Be proactive – Being victimised by ransomware is a jarring experience. It tests an organisation’s emotional responses to crisis, escalation procedures, technical prowess, business continuity preparedness and communication skills. Ensure that the Incident Response (IR) Plan/Playbooks, and/ or Business Continuity Plan/Disaster Recovery Plan has been recently assessed, reviewed, and updated. But, most important, these plans and playbooks must be tested through simulated practice across realistic scenarios to help improve resilience.
  • Educate employees on cyber security and phishing awareness – Phishing is still a leading cause of unauthorised access to a corporate network, including being the entry point for ransomware attacks. Training users to not only spot a phishing email, but to also report the email to their internal cyber security team is a critical step in detecting a ransomware attack. Phishing awareness is a critical cornerstone to such a cyber secure culture.
  • Employ multi-factor or “two-step” authentication – Multi-factor authentication (e.g. a password – something employees know, plus an authentication key – something employees have) across all forms of login and access to email, remote desktops, external-facing or cloud-based systems and networks (e.g., payroll, time-tracing, client engagement) should be a requirement for all users. Multi-factor access controls can be even more effective if coupled with the use of virtual private network (VPN) interaction.
  • Keep systems patched and up-to-date – The rudimentary cyber hygiene activity of system updates and patching often falls by the wayside, especially as operations and security teams are stretched, systems and endpoints age and move towards legacy status, and new systems, hardware, and applications are introduced as businesses grow, mature, merge and divest. Attackers can identify a vulnerable system with a simple scan of the Internet using free tools, looking for exploitable systems on which to unleash ransomware and other cyberattacks.
  • Install and properly configure endpoint detection and response tools – Tools that focus on endpoint detection and response can help decrease the risk of a ransomware attack and are useful as part of incident investigation and response. Properly configured security tools give a much greater chance of detecting, alerting on, and blocking threat actor behaviour.
  • Design your networks, systems and backups to reduce the impact of ransomware – Ensure your privileged accounts are strictly controlled. Segment your network to reduce the spread of adversaries or malware. Have strong logging and alerting in place for better detection and evidence in the event of incident response. Having a technical security strategy that is informed by industry experts that know the latest attacks and adversary trends is important, as is the use of continuous threat intelligence monitoring in open source and on the dark web.
  • Pre-arrange your third-party response team – An effective ransomware response will often include all or some third-party expertise across the disciplines of forensic incident response, legal counsel, crisis communications and ransom negotiation and payment. As time is of the essence, it is critical to pre-vet and pre-engage a team of professionals to monitor and be ready to respond to a ransomware attack when it happens.

“While the complete risk of ransomware is unlikely to be fully mitigated when considering your brand’s reputation and goodwill as well as legal repercussions, it is crucial for organisations to consider risk transfer options by obtaining appropriate cyber insurance coverage. In doing so, organisations should review how coverage addresses indemnification for financial loss, business interruption, fees and expenses associated with the ransom and incident response, as well as considerations for service providers, such as the ability to work with incident response providers of choice. The process is best undertaken with the aid of an expert broker to address every eventuality in its entirety,” concludes Zamani.

[1] Ransomware statistics trends and facts – Cloudwards – 11 Nov 2020

[2] Ransomware statistics trends and facts – Cloudwards – 11 Nov 2020

[3] Ransomware statistics trends and facts – Cloudwards – 11 Nov 2020

[4] 20 Ransomware statistics you’re powerless to resist reading – Hashedout – 27 Feb 2020

[5] Justice department, federal court system hit by Russian hack – AP news – 7 Jan 2021

Subscriber Terms and Conditions

  1. APPLICATION OF TERMS
    • These terms and conditions (“Subscriber Terms”) apply to the subscription by any qualifying member of the South African Underwriting Managers Association NPC (“SAUMA”) to the services and benefits offered by FIA Services (Pty) Ltd (“FIA Services”) under the SAUMA affiliation arrangement (“Subscription”).

  2. NATURE OF SUBSCRIPTION
    • A Subscription under this arrangement:
      • does not constitute membership of FIA NPC;
      • does not confer any voting rights or governance participation in FIA NPC; and
      • is governed solely by the contractual relationship between the Subscriber and FIA Services.

  1. ELIGIBILITY
    • To qualify for the Subscription, the applicant must, at the time of application, be a current paid-up member of SAUMA.
    • FIA Services will verify the applicant’s SAUMA membership status with SAUMA prior to activation, and may re-verify such status periodically.
    • If a Subscriber ceases to be a paid-up member of SAUMA, the Subscription will correspondingly be terminated.
    • Applicants are required to authorise FIA Services to confirm their SAUMA membership status with SAUMA as part of the application process.

  1. SERVICES
    • The Subscription entitles the Subscriber to the following benefits:
      • Complimentary access to the FIA CPD Platform;
      • Complimentary access to the FIA Insight Magazine (digital edition);
      • Advertising opportunities on FIA platforms at a discounted rate of 15% (fifteen percent) off the prevailing published rates; and
      • Invitations to attend FIA Technical Webinars annually.
    • FIA Services reserves the right to update, vary or substitute the Services from time to time, provided that the overall value and nature of the benefits remain materially the same.

  1. FEES AND PAYMENT
    • The monthly subscription fee is R260.00 (two hundred and sixty rand) for up to seven registered individuals (Key Individuals and Representatives), and R36.00 (thirty-six rand) per additional registered individual thereafter, excluding VAT.
    • The Subscriber shall provide FIA Services with the required details of each individual to be registered under the Subscription for the purposes of activation and billing.
    • All fees are exclusive of VAT, which shall be charged at the prevailing statutory rate.
    • Subscription fees are reviewed annually in March and may be adjusted with effect from 1 April.
    • Any changes to the Subscription, including but not limited to the number of Representatives and Key Individuals registered under the Subscription, may only be effected once annually during the annual review period in March of each year, with such changes taking effect from 1 April.
    • Subscription fees shall be billed monthly in arrears, unless the Subscriber elects an annual billing cycle at the time of application.
    • The Subscriber shall ensure that all billing information (including contact details, authorised signatories and bank account details) is kept accurate and up to date.
    • Non-payment of subscription fees may result in suspension of access to the Services until such fees are brought up to date.
    • The Subscriber acknowledges and agrees that all subscription fees payable under these Subscriber Terms may be collected by way of debit order, which shall be processed by the holding company, FIA NPC (The Financial Intermediary Association of South Africa), on behalf of FIA Services. Payment to FIA NPC shall be deemed to constitute valid and sufficient discharge of the Subscriber’s payment obligations to FIA Services under these Subscriber Terms.

  1. ONBOARDING
    • Onboarding will be conducted as a Subscription with FIA Services under the SAUMA affiliation arrangement.
    • Onboarding will not confer FIA NPC membership status or any associated rights.
    • Onboarding is conditional on confirmation of the Subscriber’s current SAUMA membership at the time of application

  1. DATA PROTECTION
    • FIA Services will process all personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) as set out in our POPIA policies.
    • By subscribing, the Subscriber authorises FIA Services to confirm their SAUMA membership status with SAUMA and to process personal information for the purposes of fulfilling the Subscription.

  1. TERMINATION
    • The Subscriber may terminate the Subscription by giving FIA Services one calendar month’s written notice.
    • FIA Services may terminate the Subscription on one calendar month’s written notice, or immediately if the Subscriber breaches these Subscriber Terms and fails to remedy such breach within 14 (fourteen) days of receiving written notice.
    • Termination of the SAUMA–FIA Services affiliation agreement shall not automatically terminate these Subscriber Terms.
    • Termination by the Subscriber shall not relieve the Subscriber of liability for any subscription fees accrued up to the effective date of termination.
    • FIA Services may suspend or terminate the Subscription with immediate effect in the event of non-payment of fees by the Subscriber.

  1. GENERAL
    • These Subscriber Terms are governed by the laws of the Republic of South Africa.
    • Any disputes arising under these Subscriber Terms shall be dealt with in accordance with the dispute resolution provisions contained in the FIA NPC membership terms and conditions, as modified to reflect that the contractual relationship is with FIA Services.
    • Any notices required under these Subscriber Terms may be validly delivered by email to the addresses provided in the Subscriber’s application form, and such notices shall be deemed received on the day of transmission if sent during business hours.
    • The Subscriber may not assign, cede or transfer any of its rights or obligations under these Subscriber Terms without the prior written consent of FIA Services.
    • No variation of these Subscriber Terms shall be of any force or effect unless reduced to writing and signed by both FIA Services and the Subscriber.