Getting one's data breached is like smoking: it's easier not to start. Good news: it seems we're getting better at backups and cloud sync. Bad news: the bad guys have noticed, and they're shifting gears.
In their ranking of attack techniques (using MITRE ATT&CK), Picus Security found that asking for money for decrypting data is so 2024, and the trend went to threatening to release data. This suggests targets also change:
- Encryption impacts verticals needing to run 24/7, such as freight and large companies
- Extortion impacts verticals with sensitive information to protect, such as law firms and health sector
Different verticals, different threats, different risks. Do you know where you stand? Is your cyber resilience strategy tackling the high-risk areas first?