Cyber threats, particularly in the UK, have continuously been on the rise over recent years with Covid-19, Russia’s invasion of Ukraine, and, most recently, economic uncertainty providing catalysts for an increase in both the volume and sophistication of cyber-attacks.

As a result, many organisations have turned to implementing preventative cybersecurity measures such as training staff to identify and report threats and deploying basic security tools, but it only takes one successful attack to breach these systems and shut down an entire organisation for several days.

Whilst preventative measures have historically been the focus, it is vital that organisations also put in place protocols and cybersecurity measures to recover from attacks when – not if – they happen.

Reacting can save billions

In 2021, it was reported that a new ransomware attack would occur every 11 seconds. The latest Cybersecurity Ventures report estimates that by 2031, a ransomware attack will hit a business, consumer or device every 2 seconds, costing victims an annual sum of £235 billion.

A successful ransomware attack can freeze an entire organisation, preventing access to critical data and preventing them from doing business, and some attackers will also use their control over core systems to publicly threaten companies.

According to The State of Ransomware 2021 report by Sophos, 54% of all ransomware attacks were successful at encrypting data in 2021. Given the crippling nature of these attacks, it is essential that organisations ensure they have reactive cybersecurity measures in place, outlining clear protocols for staff and IT systems, and crucially implementing tools for remediation and recovery.

Especially in the work from anywhere world which has emerged from the pandemic, the task of response and recovery has grown increasingly complex. Devices are spread out across cities, countries, and continents, heightening the need for endpoint visibility and secure access controls.

Bespoke solutions such as Absolute Ransomware Response offer assessments and reports of hardware and software, enable the ability to freeze endpoints to potentially limit breaches from spreading across multiple devices and expedite recovery tasks, and most crucially, provide self-healing capabilities to help restore and re-install mission-critical applications.

The self-healing aspect of cybersecurity solutions is essential as many cyber-attacks often leave endpoint devices, such as work computers, in a state where they are open to reinfection. In both short and long term recovery, ensuring devices are resilient and protected against future attacks, while also keeping them operational, is important.

As we have seen by several high-profile attacks in the UK recently, full recovery and remediation can take months, or even years – compromising the capacity of businesses and resulting in costly backlogs. Having reactive response measures for when an attack occurs is hugely beneficial for businesses to remain operational in the face of a successful attack, and ultimately protect critical data.

Prevention remains preferable

Whilst The State of Ransomware 2021 report revealed that 54% of ransomware attacks were successful, it also uncovered that 39% of attacks were stopped before the data could be encrypted, highlighting that preventative measures were still effective in many cases.

Preventing a cyber-attack is certainly more preferable than recovering from one, and it is important that organisations still invest in proper preventative measures to deal with incoming threats.

The issue of working from anywhere remains a significant hurdle for IT teams to navigate, with a recent study from Absolute Software indicating that 97% of surveyed IT experts believe that remote workers are exposed to increased risk, with nearly half (47%) claiming that risk to be high or extremely high. Visibility over endpoints anywhere in the world is more important than ever for cybersecurity teams.

Therefore, organisations need to leverage solutions which utilise secure access controls and resilient Zero Trust, allowing IT teams to monitor devices and applications from a central location, and be alerted to suspicious activity across their company network.

Recommended

• Protecting tour data | Some practical tips
• How inclusive is STEM, and how do we diversify the relevant fields?
• AI poses an ‘existential threat to humanity,’ say 49% of IT pros

If a company laptop is reported as missing and then logs on from an unfamiliar location, cybersecurity teams need to have the ability to monitor that device and freeze it, or even shut it down, to ensure it can’t breach other devices and applications on the network.

The resilient aspect of resilient Zero Trust is particularly key in this instance to maintain operational efficiency. If an employee who is working from their local coffee shop logs onto the company network and acts without suspicion, they should not be automatically disconnected or shut down, which is what some legacy Zero Trust solutions advocate. The goal is to maintain user productivity without compromising the security of the entire company network.

Technology has a large part to play in the prevention of cyber-attacks, but training staff is another important way of limiting cyber risks.

Organisations should utilise their IT teams to train staff on potential cyber threats every few months. For example, with Christmas coming up, it is important for staff to recognise and properly report Christmas scams to prevent unwanted malware and spyware from infecting their device.

For smaller businesses and start-ups, if budget is scarce, relying on upskilling, automation and outsourcing can help bridge the gap for cybersecurity technology and training.

Creating a strong cybersecurity posture

The constantly evolving threat landscape and increased sophistication of cyber-attacks demands that organisations re-evaluate and revamp their cybersecurity measures to combine both preventative and reactive solutions.

Leveraging technology such as resilient Zero Trust and secure access controls can help centralised IT teams have visibility and control of endpoint devices and applications across their company network in order to isolate and shut down threats before data is encrypted.

These reactive cybersecurity measures and protocols can save organisations huge sums of money, years of remediation, and protect critical data whilst ensuring they remain operational in the face of a threat.

However, with over half of ransomware attacks successful resulting in a breach, it is vital that businesses also prepare for when an attack happens, not just if. It is more important than ever for organisations to ensure they have a strong cybersecurity posture.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.