Report: Cyber Attacks on the Rise and Evolving, as Ransomware Declines | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Report: Cyber Attacks on the Rise and Evolving, as Ransomware Declines

June 14, 2018
by Heather Landi
| Reprints

Cyberthreats are continuing to increase and shift, and even though ransomware attacks are significantly declining, cyberattacks are on the rise, according to a new report from the global association ISACA.

Previously known as the Information Systems Audit and Control Association, ISACA, which now goes by its acronym only, is an independent, global, nonprofit association that engages in the development, adoption and use of globally accepted practices for information systems.

ISACA’s “State of Cybersecurity 2018: Part 2, Threat Landscape and Defense Techniques” report provides findings from a survey of 2,366 cybersecurity professionals and individuals in information security positions. Of the survey respondents, six percent work in healthcare/medical. Twenty-six percent of respondents work in technology services/consulting and 23 percent work in financial/banking, and the remaining work in various other fields.

According to the research, 50 percent of respondents have seen an increase in cyberattacks relative to last year, while also experiencing a 17-point drop in ransomware attacks from year to year. Forty-five percent of respondents experienced a ransomware attack this year, compared to 62 percent in 2016.

Motivation for cyber attacks remains monetary, according to half of respondents, yet the decrease in ransomware attacks seems to contradict the finding that attackers’ primary motivation is financial. One possible explanation, according to the survey results, is that potential victims have increased their preparedness. Ransomware countermeasures are nearing ubiquity and enterprises are defending against it more effectively, the survey found.

Enterprises have shifted strongly in favor of better preparation for ransomware relative to last year: 86 percent indicate that their enterprises have a strategy in place to prevent or reduce the odds of the occurrence for ransomware and 78 percent of organizations have a formal process to deal with ransomware this year, compared to only 53 percent last year. Also, anti-ransomware strategies, such as employee awareness training, are also widely deployed, while 94 percent of enterprises train or advise employees about phishing and/or malware, including ransomware.

What’s more, in this year’s survey, almost all respondents (92 percent) indicate that they do not believe that their enterprises will pay the ransom. Most respondents (96 percent) say that their enterprises do not maintain a supply of cryptocurrency for ransomware payments.

The drop-off in ransomware implies that attackers are shifting to alternate strategies with a better return on attacker investment, the report states. Declining ransomware attacks imply that ransomware is not the most effective strategy, and, assuming a constant or increasing number of attacks, it stands to reason that other methods are likely to rise in prevalence, including cryptocurrency mining malware. Cryptocurrency mining malware is similar in purpose to ransomware (i.e., as a mechanism to generate financial return by compromising a victim’s machine). However, instead of attempting to extort a ransom from a victim, cryptocurrency mining malware contributes CPU cycles to a cryptocurrency ecosystem (i.e., mining).

The report notes that cryptocurrency mining malware may rise in prevalence relative to ransomware attacks in the short-to-intermediate term. “Because cryptocurrency mining malware can operate and generate value for an attacker without access to a victim’s host filesystem, the method of detection employed by the enterprise may require adjustments,” the report states.

The report authors also suggest that enterprises should consider investigating the degree to which existing controls (e.g., antimalware tools and products) operate in a fileless malware context. “As ransomware is potentially displaced by other strategies that do not require filesystem access, new controls may need to be deployed or adjustments may need to be made to the operation of existing controls (e.g., enabling behavioral anomaly detection or heuristic-based antimalware scanning).”

Eighty percent of respondents indicate that it is either likely or very likely that their enterprises will experience a cyber attack in 2018. Despite the increase in overall numbers of attacks, however, techniques employed by attackers remain relatively constant. The most common attack vectors are phishing (44 percent), malware (38 percent) and social engineering (28 percent).

The most common types of threat actors identified were cybercriminals (33 percent), hackers (23 percent), non-malicious insiders (14 percent), malicious insiders (11 percent), nation states (10 percent) and hacktivists (six percent).

Looking at different defense strategies, the survey findings indicate that threat intelligence is prevalent, and active defense is less familiar but effective. Most enterprises employ some threat intelligence capability, often staffed in-house. Active defense strategies, although not understood universally among practitioners or employed in enterprises, demonstrate a high level of success when implemented

However, 40 percent of respondents are not very familiar with active defense strategies and 53 percent of respondents use active defense strategies.  Of those who employed active defense strategies, 87 percent indicate that they were successful.

The survey also found that the biggest barriers to implementing active defense measures are skill and/or resource limitations (43 percent), budget (37 percent), legal implications (34 percent) and technical implications (30 percent).

According to the report, the survey results “affirm that attacks are becoming more prevalent, attackers are adapting and evolving the methods they employ, and enterprises are shifting their defense strategies in response.” And, the report suggests organizations should consider deploying active defense strategies. “Although some notable barriers exist, the number of respondents reporting success with active defense suggests that it may be worth investing in—and laying the groundwork for—this approach.”


Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More



White House Proposes Restructuring, Renaming HHS as Part of Broad Reorganization Plan

A sweeping government reorganization plan released by the White House Thursday proposes restructuring and renaming HHS, including moving many public assistance programs from USDA to HHS.

CMS Introduces Data Element Library

The Centers for Medicare & Medicaid Services (CMS) has announced the launch of its Data Element Library (DEL), with the overarching goal to support the exchange of electronic health information.

Data Breach at Health Billing Company Exposes PHI of 270,000 People

A healthcare data breach at Med Associates, a Lathan, N.Y.-based health billing company, that may have exposed the protected health information (PHI) of 270,000 people, according to local media reports.

CMS to Host Blue Button 2.0 Developer Conference

The Centers for Medicare & Medicaid Services will host the first Blue Button 2.0 Developer Conference at the General Services Administration national headquarters in Washington, D.C., on Monday, Aug. 13, 2018.

House Passes Bill to Align HIPAA, 42 CFR Part 2

The U.S. House of Representatives recently passed a bill designed to align 42 CFR Part 2 with HIPAA for the purposes of health care treatment, payment, and operations. One goal of the change is so that care can be better coordinated and providers can have appropriate access to all of a patient’s medical record, including information about substance use disorders.

MedStar Health Awarded Grant to Pilot Apps for Patient-Reported Outcome Data

A team of researchers from Maryland-based MedStar Health has been awarded an 18-month contract from AHRQ to support the development and testing of technical tools and apps that can be used to collect patient-reported outcome data.