Businesses are facing an increasing number of risks from ransomware. You can lose customers, revenue, and the trust you’ve built with partners and customers as a result of an attack. In your role as an executive, malware isn’t your focus; rather, you’re responsible for making sure the organization is prepared in the event of a crisis, protecting the business, and recovering when things go wrong.
The Real Cost of Ransomware
These numbers are sobering: According to Coveware, the average ransom payment in Q2 2023 was over $740,000 USD, with some cases reaching millions of dollars, while IBM’s Cost of a Data Breach Report for 2023 concluded that ransomware incidents typically cost $4.54 million USD in recovery costs, not including ransom. The cost of downtime is also significant. Industry reports state that companies are usually offline for three to four weeks after an attack.
What Leaders Should Focus On
- Preparedness: Executive oversight should encompass both Protection and Resilience. Protection includes multi-factor authentication, network segmentation, least privilege access, and endpoint monitoring, while Resilience means tested backups, redundant infrastructure, clear recovery objectives, and continuity plans that keep the business running if systems go down.
- Communication: A ransomware attack quickly becomes a business crisis. There needs to be a clear plan for communicating with customers, regulators, investors, law enforcement, and government agencies. Poor or delayed communication often causes more damage than the attack itself.
- Risk Appetite: The board and leadership teams need to be aligned in their decision on whether ransomware payments are even to be considered or not, since in a crisis, the IT team can’t be in a rushed, inconsistent, or reactive mindset.
- Third-Party Exposure: Many attacks start with vendors or partners. Vendor risk management should include assessing ransomware exposure and holding partners accountable through clear security requirements.
- People and Culture: Ensure that regular training and phishing simulations, and clear expectations for staff behavior are in place to reduce the chance that attackers succeed.
Executive Takeaways
- Treat ransomware as a board-level risk with financial, operational, and reputational consequences.
- Ensure protection and resilience measures are in place and are tested regularly.
- Ensure that the organization has a communication plan in place that includes law enforcement and government agencies.
- Set the company’s position on ransom payments before a crisis occurs.
- Make sure vendor risk management includes ransomware considerations.
- Support a culture where employees play an active role in defending the organization.
The Bottom Line
Ransomware is not just an IT issue; it’s also a Business issue. You don’t need to understand the technical mechanics, but you do need confidence that your organization is protected, resilient, and prepared to respond quickly and transparently when an attack happens.