Unrecoverable encrypted data

Issue 3 2022 News & Events, Information Security

Veeam unveiled the results of its 2022 Ransomware Trends Report at VeeamON 2022, finding that cybercriminals are successfully encrypting an average of 47% of production data and victims are only able to recover 69% of impacted data.

Businesses are losing the battle when it comes to defending against ransomware attacks, according to the Veeam 2022 Ransomware Trends Report, which found that 72% of organisations had partial or complete attacks on their backup repositories, dramatically impacting the ability to recover data without paying the ransom. Veeam found that 80% of successful attacks targeted known vulnerabilities, reinforcing the importance of patching and upgrading software. Almost all attackers attempted to destroy backup repositories to disable the victim’s ability to recover without paying the ransom.

The report reveals the results of an independent research firm that surveyed 1000 IT leaders whose organisations had been successfully attacked by ransomware at least once during the past 12 months, making it one of the largest reports of its kind. The first of its kind study examines the key learnings from these incidents, their impact on IT environments and the steps taken to implement modern data protection strategies that ensure business continuity moving forward. The research project specifically surveyed four IT personas (CISOs, security professionals, backup administrators and IT operations) to understand cyber-preparedness alignment across organisations.

“Ransomware has democratised data theft and requires a collaborative doubling down from organisations across every industry to maximise their ability to remediate and recover without paying the ransom,” said Danny Allan, CTO at Veeam. “Paying cybercriminals to restore data is not a data protection strategy. There is no guarantee of recovering data, the risks of reputational damage and loss of customer confidence are high, and most importantly, this feeds a self-fulfilling prophecy that rewards criminal activity.”

Paying the ransom is not a recovery strategy

Of the organisations surveyed, the majority (76%) of cyber victims paid the ransom to end an attack and recover data. Unfortunately, while 52% paid the ransom and were able to recover data, 24% paid the ransom but were still not able to recover data, resulting in a one out of three chance that paying the ransom still leads to no data. It is notable that 19% of organisations did not pay the ransom because they were able to recover their own data. This is what the remaining 81% of cyber-victims must aspire to: recovering data without paying the ransom.

“One of the hallmarks of a strong modern data protection strategy is a commitment to a clear policy that the organisation will never pay the ransom, but do everything in its power to prevent, remediate and recover from attacks,” added Allan. “Despite the pervasive and inevitable threat of ransomware, the narrative that businesses are helpless in the face of it is not an accurate one. Educate employees and ensure they practice impeccable digital hygiene; regularly conduct rigorous tests of your data protection solutions and protocols; and create detailed business continuity plans that prepare key stakeholders for worst-case scenarios.”

Prevention requires diligence from both IT and users

The “attack surface” for criminals is diverse. Cyber villains most often first gained access to production environments through errant users clicking malicious links, visiting unsecure websites or engaging with phishing emails — again exposing the avoidable nature of many incidents. After having successfully gained access to the environment, there was very little difference in the infection rates between data centre servers, remote office platforms and cloud-hosted servers.

In most cases, the intruders took advantage of known vulnerabilities, including common operating systems and hypervisors, as well as NAS platforms and database servers, leaving no stone unturned and exploiting any unpatched or outdated software that they can find. It is notable that significantly higher infection rates were reported by security professionals and backup administrators, compared with IT operations or CISOs, implying that “those closer to the problem see even more of the issues”.

Remediation starts with immutability

Respondents to the survey confirmed that 94% of attackers attempted to destroy backup repositories and in 72% of cases this strategy was at least partially successful. This removal of an organisation’s recovery lifeline is a popular attack strategy as it increases the likelihood that victims would have no other choice than to pay the ransom. The only way to protect against this scenario is to have at least one immutable or air-gapped tier within the data protection framework — which 95% of those we surveyed stated they now have. In fact, many organisations reported having some level of immutability or air-gap media in more than one tier of their disk, cloud and tape strategy.

Other key findings from the Veeam 2022 Ransomware Trends Report include:

• Orchestration matters: To proactively ensure recoverability of their systems, one in six (16%) IT teams automate the validation and recoverability of their backups to ensure their servers are restorable. Then, during remediation of a ransomware attack, 46% of respondents use an isolated “sandbox” or staging/test area to ensure their restored data is clean prior to reintroducing the systems into production.

• Organisation alignment must unify: 81% believe their organisations’ cyber and business continuity/disaster recovery strategies are aligned. However, 52% of respondents believe the interactions between these teams requires improvement.

• Diversifying repositories holds the key: Nearly all (95%) organisations have at least one immutable or air-gapped data protection tier, 74% use cloud repositories that offer immutability; 67% use on-premises disk repositories with immutability or locking; and 22% use tape that is air-gapped. Immutable or not, organisations noted that in addition to disk repositories, 45% of production data is still stored on tape and 62% goes into a cloud at some point in their data lifecycle.

The full Veeam 2022 Ransomware Trends Report is available for download at https://vee.am/RW22.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Fire Ops SA Partners with Matrix
News & Events Fire & Safety Residential Estate (Industry)
Fire Ops SA, a South African private fire and rescue service, has announced its partnership with Matrix Vehicle Tracking to launch FireStop, providing Matrix and Beame clients with direct access to a dedicated professional private fire service.

Read more...
SABRIC Annual Crime Statistics 2024
News & Events Security Services & Risk Management Residential Estate (Industry)
SABRIC has released its Annual Crime Statistics for 2024, reflecting a significant decline in financial crime losses, but also warning of the growing threat posed by artificial intelligence (AI) in fraud schemes.

Read more...
Adding AI analytics to security monitoring
SEON South Africa News & Events Perimeter Security, Alarms & Intruder Detection Residential Estate (Industry) AI & Data Analytics
SEON has announced its latest integration with Refraime, an AI-powered video analytics platform designed to elevate CCTV surveillance through real-time object detection and intelligent alerting.

Read more...
Local-first data security is South Africa's new digital fortress
Infrastructure Information Security
With many global conversations taking place about data security and privacy, a distinct and powerful message is emerging from South Africa: the critical importance of a 'local first' approach to data security.

Read more...
Blue Security ranked best reaction team in KZN
News & Events Commercial (Industry)
Blue Security has been ranked the Best Reaction Team in KwaZulu-Natal following its outstanding performance at the SAIDSA Reaction Man Competition 2025, which took place on 25 September at the Ballito Defensive Sport Shooting Club.

Read more...
Sophos launches advisory services to deliver proactive cybersecurity resilience
Information Security News & Events
Sophos has launched a suite of penetration testing and application security services, designed to identify gaps in organisations’ security programs, which is informed by Sophos X-Ops Threat Intelligence and delivered by world-class experts.

Read more...
Why Securex matters more than ever
Securex South Africa News & Events Fire & Safety Facilities & Building Management
Visitors will observe the application of integrated security solutions, including AI-enhanced surveillance, cloud-based access control, cybersecurity tools, and perimeter protection within residential, commercial, logistics, and industrial environments

Read more...
SA’s private security industry receives multi-million USD investment
News & Events Security Services & Risk Management
South Africa's private security sector has attracted significant international attention, with the world’s largest tactical flashlight manufacturer, Nextorch, announcing a major investment in its local operations, Nextorch Africa.

Read more...
Kaspersky highlights biometric and signature risks
Information Security News & Events
AI has elevated phishing into a highly personalised threat. Large language models enable attackers to craft convincing emails, messages and websites that mimic legitimate sources, eliminating grammatical errors that once exposed scams.

Read more...
Keenfinity launches Radionix as new intrusion brand
Perimeter Security, Alarms & Intruder Detection News & Events
Keenfinity Group’s Intrusion & Access Business Unit has launched Radionix as its new brand for intrusion alarm systems, unlocking new potential and growth opportunities.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.