Intelligent CISO Issue 03 | Page 74

Internal Ministry, the Romanian Ministry of Foreign Affairs, four Indian state governments, one Indian state police force and 42 National Health Service Trusts, choking frontline public health services in the UK. That’s some productivity loss. It took around a month for it all to happen again. The NotPetya attacks wreaked a similar, if slightly diminished, amount of havoc on public institutions and multinational giants. not millions, in lost revenue. And that's before you even pay the ransom. This doesn't just go for the non-technical employees, but IT staff too. There are a variety of cases in which workforces have done the right thing, for the most part, only for their IT providers not to have patched or backed up regularly, leaving all that good work for nothing. Losses from ransomware are estimated to have ballooned 15 times over the last two years to reach US$5 billion for 2017. Much of that figure will not even be 74 from ransom payments which often end up being cheaper than the restoration costs, data loss and most importantly, business paralysis that prove so costly. To be clear, that isn't an endorsement of paying up, it's merely a warning against ever having to make that choice. The scale upon which it can sew destruction was revealed only a few months ago. When the WannaCry ransomware attacks hit in May 2017, it took down parts of the Chinese public security bureau, the Russian FedEx, Russian oil company Rosneft and the world’s largest advertising agency, WPP, were all hit with the ransomware. International consumer goods giant, Reckitt Benckiser, which is responsible for household brands like Dettol, Strepsils and Clearasil said that the attack could have punched a £100 million sized hole in the company’s revenue. The world’s largest shipping container business, Maersk, revealed a US$300 million loss a short while after. Responsible for around 15% of the globe’s shipping, the NotPetya attacks took a large swing at the company’s third quarter results. Even a month after the attacks, some companies were still scrambling to make Issue 03 | www.intelligentciso.com