Many businesses are still not prepared to defend against determined attackers, according to The State of Endpoint Security Today released by Sophos.

The survey polled more than 2,700 IT decision makers from mid-sized businesses in 10 countries worldwide, including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India and South Africa.

Ransomware continues to be a major issue across the globe, with 54 percent of organisations surveyed hit in the last year, and a further 31 percent expecting to be victims of an attack in the future. On average, respondents impacted by ransomware were struck twice.

“Ransomware is not a lightning strike – it can happen again and again to the same organisation. We’re aware of cybercriminals unleashing four different ransomware families in half-hour increments to ensure at least one evades security and completes the attack,” said Dan Schiappa, senior vice president and general manager of products at Sophos. “If IT managers are unable to thoroughly clean ransomware and other threats from their systems after attacks, they could still be vulnerable to reinfection. No one can afford to be complacent. Cybercriminals are deploying multiple attack methods to succeed, whether using a mix of ransomware in a single campaign, taking advantage of a remote access opportunity, infecting a server, or simply disabling security software.”

This relentless attack methodology, Ransomware-as-a-Service growth, the anticipation of more complex threats and the resurgence of worms like WannaCry and NotPetya puts businesses in serious need of a security makeover, according to Sophos. In fact, when last impacted by ransomware, more than 77 percent surveyed were running up to date endpoint protection, confirming unfortunately that traditional endpoint security is no longer enough to prevent today’s ransomware attacks.

“Organisations of all sizes are starting 2018 with inadequate protection against ransomware, even with last year’s international headlines,” said Schiappa. “Given the ingenuity, frequency and lofty price tag of attacks, Sophos urges businesses to reevaluate their security to include predictive security technology that has the higher-level capabilities needed to combat ransomware and other costly cyber threats.”

Last year, the median total cost of a ransomware attack was US$133,000, according those impacted by it in the survey. This extends beyond any ransom paid and includes downtime, manpower, device cost, network cost and lost opportunities. Five percent reported US$1.3 million to US$6.6 million as total cost.

Two-Thirds of IT Admins Surveyed Don’t Understand Anti-Exploit Technology

IT professionals also need to be aware of how exploits are used to gain access to a company’s system for data breaches, distributed-denial-of-service attacks and cryptomining. Unfortunately, Sophos’ survey revealed considerable misunderstanding around technologies to stop exploits, with 69 percent unable to correctly identify the definition of anti-exploit software. With this confusion, it’s not surprising that 54 percent do not have anti-exploit technology in place at all. This also suggests that a significant proportion of organisations have a misplaced belief that they are protected from this common attack technique, yet are at significant risk.

“The lack of awareness and lack of protection against exploits is alarming. We’ve seen a resurgence in cybercriminals looking for vulnerabilities to actively use in myriad attack campaigns. Five or six years ago, we saw one per year, and this year as many as five new Office exploits used for cybercriminal activity, according to SophosLabs,” said Schiappa. “Cybercriminals deliberately seeking out both known and zero-day vulnerabilities and a deficit in defenses is not a good security situation.”

Intrusions from exploits have been happening for years, but are still a prominent threat, and often go undetected for months, if not years, says Sophos. Once inside a system, cybercriminals use complex malware that can hide in memory or camouflage itself. In many cases, businesses do not know they’ve been breached until law enforcement finds a large cache of stolen data on the Dark Web.

“It’s time to disrupt these intrusions,” said Schiappa. “Since traditional endpoint technologies are often unable to keep up with advanced exploit attacks used to compromise a system, Sophos has added predictive, deep learning capabilities to the newest version of Sophos Intercept X.”

Although 60 percent of respondents admitted their endpoint defenses are not enough to block attacks seen last year, only 25 percent have predictive threat technologies, such as machine or deep learning, leaving 75 percent vulnerable to repeated ransomware attacks, exploits and evolving advanced threats. Sixty percent plan to implement predictive threat technology within a year, yet confusion about it persists. Of those surveyed, 56 percent said they do not have a full understanding of the difference between machine learning and deep learning.

“For such a critical set of capabilities to thwart the latest cybercriminal techniques this is deeply concerning. Businesses need effective anti-ransomware, anti-exploit and deep learning technology to stay secure in 2018 and beyond,” said Schiappa.

The State of Endpoint Security Today survey was conducted by Vanson Bourne, an independent specialist in market research. This survey interviewed 2,700 IT decision makers in 10 countries and across five continents, including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India and South Africa. All respondents were from organisations of 100 to 5,000 users.