Global State of Ransomware Survey Reveals One in Three Organizations See Malicious Insiders as a Route for Ransomware

Insider threats become a common threat vector in the heightened ransomware crisis, yet many lack the visibility to determine whether it’s a malicious or accidental risk

Gigamon, the leading deep observability company, launched its first State of Ransomware 2022 and Beyond report aimed at providing valuable insights on how the threatscape is evolving and the severity of the ‘blame culture’ in cybersecurity is escalating. According to the global survey of IT and security leaders across the US, EMEA, and APAC, nearly one-third of organizations have suffered a ransomware attack enabled by a malicious insider, a threat seen as commonly as the accidental insider (35 percent). Furthermore, 59 percent of organizations believe ransomware has worsened in the last three months, with phishing (58 percent), malware/computer viruses (56 percent) and cloud applications (42 percent) cited as other common threat vectors.

As the ransomware crisis worsens, threat actors like Lapsus$ group are now well-known for preying on disgruntled employees to gain access to corporate networks – 95 percent (and 99 percent of CISOs/CIOs) view the malicious insider as a significant risk. Fortunately, 66 percent of these respondents now have a strategy for addressing both types of insider threats. However, it’s clear that many organizations lack the visibility required to distinguish which type of insider threat is endangering their business, which makes it significantly harder to mitigate risk.

Latest ITechnology News: SafeGuard Cyber Delivers Context-Aware Response with Microsoft Azure AD and Okta

Increasingly, organizations rely upon observability tools to monitor their hybrid cloud environments for security and performance issues at the application level, but these tools can leave them exposed because they lack visibility at the network level of their infrastructure. To eliminate these blind spots, organizations are increasingly turning to deep observability solutions as a means to gain advanced network-level security forensics and lateral threat detection and assure defense in depth across their hybrid and multi-cloud environments.

“Deep observability is acknowledged by security teams around the world as crucial to a successful ‘defense in depth’ posture,” said Ian Farquhar, Field CTO (Global) and director of the security architecture team at Gigamon. “This holistic visibility is essential to support Infosecurity professionals as they battle a number of challenges, including cloud misconfigurations and the rise in malicious insider threats, as well as a culture of finger pointing and blame when things go wrong.”

The Blame Culture

The survey also revealed that 88 percent of global respondents believe there is a ‘blame culture’ in the cybersecurity industry, with 38 percent in the US and 37 percent in Singapore seeing this tendency to point the finger when breaches occur as ‘heavily prevalent’. Worryingly, 94 percent of those who recognize the blame culture told Gigamon that it could also be a deterrent to the speed of reporting an incident. To overcome this issue, 42 percent of organizations are calling for more transparency, as well as industry-wide collaboration (29 percent) and the need to provide CIOs/CISOs with ‘deep observability’ (22 percent).

Latest ITechnology News: SAS Recognizes Global Partners Driving Innovation in the Cloud

A New Frontier: Deep Observability

Deep observability can be defined as harnessing actionable network-level intelligence to amplify the power of metric, event, log and trace-based monitoring tools. As well as being a solution in demand by CIOs/CISOs to tackle the blame culture, deep observability (66 percent) was cited on par with Zero Trust (66 percent) as key to mitigating the risk associated with the malicious insider threat.

However, since the release of the Zero Trust 2020 Gigamon report, awareness of Zero Trust’s complexities has grown, meaning many now lack confidence in its implementation: 44 percent of EMEA now believe that Zero Trust requires too much oversight and resources (up 21 percent). Conversely, deep observability is now recognized as central to cybersecurity, not only for ransomware protection, but even more so for protecting hybrid and multi-cloud infrastructures (89 percent of global respondents agree) and ensuring safe cloud migration (82 percent of global respondents agree).

Additional Key Findings:

– Ransomware is seen as a board-level priority. 89 percent of global boardrooms see this threat as a priority concern, a number that rises in the UK (93 percent), Australia (94 percent) and Singapore (94 percent). When asked how this cyber threat is viewed, the leading perception across all regions was that it is a ‘reputational issue’ (33 percent).

– Cyber insurance is causing concern. 57 percent of those surveyed agreed that the cyber insurance market is exacerbating the ransomware crisis. In APAC, where cyber insurance is most commonly employed, this concern is felt by 66 percent of Australian respondents and 68 percent of those in Singapore.

– The US is leading the way with Zero Trust. While EMEA may have lost some confidence in implementing Zero Trust, 59 percent in the US agree that this framework is attainable. What’s more, US respondents are the most certain about the complementary tie between Zero trust and deep observability, with 47 percent claiming the two are strongly connected.