June 30, 2022 Study Reveals Traditional Data Security’s Failure Rate

Titaniam’s study finds over 70% of organizations had heavy investments in data security tools but still give into attackers’ demands.

Titaniam, Inc. has announced its ‘State of Data Exfiltration & Extortion Report.’ This survey revealed that while over 70% of organizations have an existing set of prevention, detection, and backup solutions, nearly 40% of organizations have been hit with ransomware attacks in the last year, and more than 70% have experienced one in the previous five years, proving existing solutions to be woefully inadequate in managing the risks and impacts from these attacks.

Data exfiltration during ransomware attacks is up 106% relative to where it was five years ago. We are seeing the emergence of a new trend where cybercriminals are no longer limiting themselves to just encrypting entire systems—they are making sure to steal data ahead of the encryption so that they can have additional leverage on the victim. The survey found that 65% of those who have experienced a ransomware attack have also experienced data theft or exfiltration due to the incident. Of those victims, 60% say the hackers used the data theft to extort them further, known as double extortion. Most of them, i.e., 59% of victims, paid the hackers, implying that they were not helped by their backup or data security tools to prevent this fate.

Data is being exposed for theft and extortion in other ways too. Nearly half (47%) uncovered publicly exposed data in their systems in the last 24 months. It was found that respondents have a mix of data security & protection (78%), prevention & detection (75%), and backup and recovery (73%) in their cybersecurity stacks. Still, exposure and extortion numbers imply a missing puzzle piece regarding attacks.

Interestingly, observing peers being attacked (33%), management’s request (29%), and compliance (24%) are mostly driving budget decisions, while just 10% say it’s learning from their own attacks. 90% agree or somewhat agree that they have a sufficient budget for data security tools. 59% claim data security has the highest security spend. Yet, in the face of these attacks and data exposures, nearly all (99+%) respondents would be interested in data security solutions that protect sensitive data at all times, including while active and in use.

Promisingly, the survey revealed organizations have enough budget to improve which solutions security and data teams are using. This indicates that boards and executives appear to recognize the importance of cybersecurity to business success.

“Reliance on legacy technologies worked for years, but as bad actors continue to evolve, our technology must evolve as well,” said Arti Raman, CEO and Founder of Titaniam. “It is unfortunate that organizations continue to believe that investing in detection, backup, and recovery solutions constitutes the complete solution to ransomware. These organizations overlook data security, which, when not implemented adequately, becomes the ultimate reason attackers gain excessive leverage and win—the results of this survey highlight this enormous gap in current cybersecurity solutions. Suppose over 70% of experts claim to use data protection, prevention and detection service, and backup and recovery. Why are 60% still being extorted, and even further, why are 59% paying the ransom? There needs to be a deep look at how we as an industry approach ransomware protection. We need to understand that while prevention, detection, and backup are essential, no ransomware defense strategy is complete without eliminating data exfiltration. This is what would take us beyond the notions of impenetrability and towards immunity.”

With survey results showing that along with overall backup and recovery, data masking (54%), encryption at rest (49%), encryption in transit (49%), and tokenization (25%) are the main means of protection, we must accept that these are simply not enough to get enterprises the data protection they need to beat ransomware.

Fortunately, organizations can now look to advanced data security platforms like Titaniam, which combine traditional data protection techniques like the ones above, with high-performance encryption-in-use, and highly sophisticated key control to close the gaps being exploited by ransomware and extortion actors. Systems protected by Titaniam do not yield unencrypted data even if they are attacked using highly privileged credentials, as in a vast majority of data exfiltration-based attacks.

*This survey was conducted by CensusWide, polling 100 IT security professionals.

Subscribe to Industry Today