Think Ransomware Can’t Put You Out of Business?

We hear about the big ones. Manufacturing giant Honda had its networks brought to a standstill by just such an attack. Millions of inboxes have been hit with a variant of Avaddon ransomware. High-profile entertainment law firm Grubman Shire Meiselas & Sacks suffered a one-two punch of infection via REvil ransomware followed by a dark web auction of the firm’s client documents.

Small companies get hit all the time, but when they go out of business as a result it’s not news. It doesn’t matter how big your company is. In fact, what may matter more is how easy you are to hack.

A compounded threat for businesses

While there’s no shortage of examples of ransomware attacks, a recent study by data protection firm Veritas suggests an even bigger problem that few, if any, companies are prepared for: Customers are increasingly laying the blame on companies, specifically their CEOs, rather than on the hackers perpetrating the attacks.

The statistics are sobering. Twelve thousand respondents in the U.S., U.K., Germany, Japan, France, and China thought companies were to blame, with 40 percent saying CEOs should be doing a better job. In the same survey, 35 percent thought CEOs should be fined for a cyber failure, and 30 percent wanted to see a CEO lose his or her right to run any company following a serious cyber event. Another 23 percent thought the CEO should face a prison sentence.

Some of the survey’s findings suggest there’s some cognitive dissonance. For instance, 71 percent of respondents said companies shouldn’t pay ransoms to hackers, but 55 percent wanted businesses to pay a ransom if their own personal data was at risk. The numbers point to a nascent blame game, which in turn points to the need for companies large and small to make sure they have cyber insurance–often the only thing between your company and an extinction-level cyber event.

What can CEOs do?

With 44 percent in the Veritas survey claiming that they would stop using a business’s services following a ransomware-related breach regardless of how the company responded–it matters how you handle cyber.

With customers pointing the finger at business leadership, CEOs face a new layer to what was already an extinction-level threat. If the combined costs of paying a ransom and the resulting breach-related expenses aren’t enough to ruin a company, customers and clients are increasingly poised to drive the final nail in the coffin.

Preventing data breaches and implementing adequate cybersecurity safeguards was a daunting assignment even before the Covid-19 pandemic. A 2019 study showed that 80 percent of IT business leaders expected a critical breach or a successful cyberattack within a year, double what a similar study had indicated in 2015.

The inevitability of a successful cyberattack, ransomware-related or otherwise, cannot be mitigated by any CEO, but managing the aftermath can.

Much has been made of the shortage of skilled cybersecurity workers, to say nothing of supply chain vulnerabilities, unpatched or outdated software, or employee malfeasance. But the answer for management here lies in being prepared.

While corporate security fails are complex, a good leader needs only to be prepared for the day the inevitable happens. More than half of security personnel surveyed in 2019 believed that CEOs ignored security plans, and 14 percent said that their CEOs hadn’t received any cybersecurity training. Another study showed that 40 percent of IT professionals specifically cited their company’s CEO as the weakest link in their company’s security. Only you know if this is true of your organization. And if it is, only you can take steps to get cyber right.

There’s an oft-quoted saying that “culture eats strategy for breakfast,” and that’s very true when it comes to cyber. Know the risks, get help if you need it, get insured, and take it seriously.