April 3, 2018 By David Bisson 2 min read

Less than 30 percent of IT security executives who responded to a recent survey reported that they would be able to prevent large-scale ransomware attacks.

Despite this, SolarWinds MSP’s new report, “The 2017 Cyberattack Storm Aftermath,” found that IT security executives have a high level of knowledge of crypto-malware. More than two-thirds (69 percent) of respondents said they were deeply familiar with ransomware attacks such as WannaCry, which infected hundreds of thousands of endpoints within 48 hours earlier in May 2017, and Petya, which affected systems in dozens of countries in June 2017.

This familiarity led approximately three-quarters of survey participants to rate the risk of both WannaCry and Petya as very high, but it didn’t translate to better protection against this type of incident. While most respondents indicated that they would be able to detect WannaCry (72 percent) and Petya (67 percent), only 28 percent and 29 percent, respectively, said they would be able to prevent these attacks.

Organizations Struggle to Curb Ransomware Attacks

For the survey, SolarWinds MSP commissioned the Ponemon Institute to speak to 202 senior-level IT security executives in the U.S. and U.K. about some of the most high-profile threats that emerged in 2017. Their responses revealed that enterprises could be doing more to protect against these widespread attacks.

For example, just one-quarter of respondents said their organization employs specialists who possess the necessary expertise to defend against ransomware and other threats. Meanwhile, one-third admitted that their employer doesn’t have any specialized personnel on the payroll and doesn’t consult with external experts.

Many of these problems can be attributed to lack of resources. Less than half of survey participants reported having sufficient technology to prevent, detect and contain significant threats, and 48 percent said their organization’s IT security budget was inadequate.

Patching and Basic Security Hygiene

Tim Brown, vice president of security architecture at SolarWinds, said the best way for organizations to close these gaps and protect themselves against ransomware is to apply software patches.

“People often don’t think of basic security hygiene as one of the most important things they need to do, but it really is — although it’s really not easy,” Brown told Infosecurity Magazine. “Doing the basics well is not ‘sexy’ or ‘cool,’ it’s a lot of hard work that needs to get done, but no technology is going to really save you from that hard work.”

For companies that lack the necessary resources to fulfill those security basics, Brown suggested contracting security functions to a managed services provider (MSP).

More from

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

2 min read - Summary Adobe has released a security bulletin (APSB24-107) addressing an arbitrary file system read vulnerability in ColdFusion, a web application server. The vulnerability, identified as CVE-2024-53961, can be exploited to read arbitrary files on the system, potentially leading to unauthorized access and data exposure. Threat Topography Threat Type: Arbitrary File System Read Industries Impacted: Technology, Software, and Web Development Geolocation: Global Environment Impact: Web servers running ColdFusion 2021 and 2023 are vulnerable Overview X-Force Incident Command is monitoring the disclosure…

What does resilience in the cyber world look like in 2025 and beyond?

6 min read -  Back in 2021, we ran a series called “A Journey in Organizational Resilience.” These issues of this series remain applicable today and, in many cases, are more important than ever, given the rapid changes of the last few years. But the term "resilience" can be difficult to define, and when we define it, we may limit its scope, missing the big picture.In the age of generative artificial intelligence (gen AI), the prevalence of breach data from infostealers and the near-constant…

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today