iscover
ReporterShare this article on:
Powered by
MOMENTUM
MEDIA
Australian organisations are increasingly at risk of ransomware compromise via their extensive supply chains, a new Trend Micro research reveals.
In May and June 2022, Trend Micro commissioned Sapio Research to poll 106 IT decision-makers across Australia. The research revealed that 68 per cent of Australian IT leaders believe their partners and customers are making their own organisation a more attractive ransomware target. The challenge is particularly acute considering that potentially less well-secured small and midsize businesses (SMBs) make up a “significant” portion of the supply chain for over half (53 per cent) of these organisations.
Mick McCluney, technical director, Trend Micro, ANZ, revealed that 48 per cent of Australian organisations have had a supply chain organisation hit by ransomware, potentially putting their own systems at risk of compromise.
"But many aren’t taking steps to improve partner cyber security.
"The first step towards mitigating these risks must be enhanced visibility into and control over the expanding digital attack surface," McCluney said.
The supply chain can also be exploited by attackers to gain leverage over their targets.
A year ago, a sophisticated attack on a provider of IT management software led to the compromise of scores of managed service providers (MSPs) and thousands of downstream customers. Yet only 45 per cent of Australian organisations share knowledge about ransomware attacks with their suppliers. Additionally, 25 per cent said they don’t share potentially useful threat information with partners.
This could be because organisations don’t have information to share in the first place.
Detection rates were worryingly low for ransomware activities including:
Among organisations that had experienced a ransomware attack in the past three years, 72 per cent said their attackers contacted customers and/or partners about the breach to force payment.
[Related: Cyber workforce need professionals with expertise, not numbers boost]
Be the first to hear the latest developments in the cyber industry.
