At our recent Data Security Summit, Bipul Sinha sat down with author and award-winning The New York Times cybersecurity journalist Nicole Perlroth to discuss learnings from her research and thousands of interviews with security leaders, government officials, hackers, spies, and more.
This is How They Tell Me the World Ends
Despite the ominous title of her new book on the cyber arms race, the two had a candid and proactive conversation about the state of cybersecurity in the U.S. as well as how businesses can secure themselves against increasing cyber threats.
First, it’s important to set the stage for how we got here, how we got to a place where we’re saying it’s not a matter of “if” you’re hit with a cyberattack, but “when?” As organizations adopt more digital modes of delivering and transacting services, the availability and security of data has become ever more critical. Our adversaries see a real opportunity in just how automated and digitized the United States has become. As consumers and businesses operate in a more remote and distributed fashion, the threat surface for attackers has widened more than ever before. The combination of the ease of executing attacks, the increased threat surfaces, and the lucrative nature of attacks for bad actors has manifested in an exponential rise in ransomware attacks.
Just a few years ago, data security and cyber resilience were not a top priority for many companies. Companies would often rather invest their money in new products rather than create or build out their security. Now that organizations are experiencing the unfiltered devastation ransomware can wreak, businesses are finding themselves vulnerable to attacks and the resulting ransom.
To exacerbate the issue and while there are many variables, legacy approaches to data protection technology have also been a contributing factor. According to Perlroth, legacy software is our biggest vulnerability here in America and can be life or death in safety-critical infrastructures. Legacy technologies are missing the basics of a Zero Trust approach to securing data. They are creating bandages on their systems, labeling them as security-first, when in reality they were never built for cybersecurity.
To prepare for an attack, organizations need a ransomware recovery plan in place to ensure a faster incident response. Once attacked, the incident response team needs to quickly identify the infected data and recover that data set from an encrypted backup for a rapid recovery. No one wants to pay the ransom, but if you don’t have the right data security solutions in place, you may have no other choice. To make matters worse, if you decide to pay, that money is going directly to the cybercriminals to further fund and expand their enterprise.
This is not sustainable, otherwise we're going to be having ransomware attacks forever, so how do we raise the baseline for cyber security?
Nicole Perlroth
Award-winning Cybersecurity journalist for the New York Times![]()
Modernize, or else...
According to Perlroth, there is only one sustainable solution, to raise the bar for cybersecurity–and we couldn’t agree more. As she described, “we need to rip out legacy software.” The security landscape has changed, and new data security strategies are required to protect against ransomware.
While legacy systems can protect against natural disasters and operational failures, they are not built to defend against sophisticated hackers and ransomware attacks. If data and backups are the target, then security must start there. And if hackers are getting through perimeter security, a Zero Trust approach that assumes everyone and everything is untrustworthy and can be compromised is needed. Zero Trust sounds technical but it comes down to just continuously asking if we should be connecting two things just because we can.
The good news is, it’s not too late for businesses to achieve cyber resilience. Here are some important questions you should be asking:
Are we using multifactor authentication?
Where does our data live, does it contain sensitive information, and who and why do they have access to it?
Are our employees cybersecurity literate, and do they know the important role they play?
In the event of a ransomware attack, what is our response plan?
“No one is going to come save you from your poor cyber security posture. It’s really up to you to invest in the tools and the people who are skilled at taking inventory of your network, of ripping out that legacy software, of mandating multi factor authentication, of communicating well both to the board, to senior executives, but also to employees how critical a role we each play in keeping these organizations secure.” – Nicole Perlroth, Award-winning Cybersecurity journalist for the New York Times.
Interested in learning more about how to keep your data secure from ransomware attacks and avoid paying a ransom? Check out the Rubrik Data Security Summit on-demand, featuring security leaders from both the private and public sectors.