Fighting back against the growing threat of ransomware

Earlier this year, Southern Water, which provides water and wastewater service to millions of people in the South of England, was targeted in a ransomware attack by Black Basta. The ransomware group claimed to have successfully stolen 750 GB of files, including corporate documents and the personal data of nearly 500,000 customers. And yet, such an attack is not an outlier but the canary in the coalmine. According to a recent report from the National Cyber Security Centre (NCSC), the U.K. government is at a high risk of a "catastrophic ransomware attack" against critical infrastructure because of poor planning and outdated systems. Such an attack, the report said, could "bring the country to a standstill." 

Such vulnerabilities also exist beyond the U.K., as the largest private water company in the world suffered a ransomware attack on its North American operations in January as well. But the U.K. is particularly vulnerable. According to IBM's 2024 X-Force Threat Intelligence Index, Europe is the most attacked region in the world, and the U.K. is the most attacked country within it. Thus, it's extremely urgent for organizations to mitigate the risk of malware—ransomware especially—to ensure information security and continuity of operations. 

Protecting data the content level
While ransomware has always been a threat, it's becoming easier to execute due, in part, to the rise of ransomware-as-a-service. One incident response team said ransomware was responsibile for near half of the attacks it investigated in 2023 and that the average ransom demanded is on the rise. Ransomware can enter an organization through a suspicious link or embedded in .doc, .pdf or .jpg files. Many organizations rely on portals and submission boxes to confirm user identities, but many sandbox solutions and firewalls fail to check the nature of the content passing through.  

To protect against ransomware and other threats at the content level, one option is for organizations must deploy a Zero Trust Content Disarm and Reconstruction (CDR) solution, which applies a "never trust, always verify" philosophy to content. With Zero Trust CDR, any content that passes through the solution is completely stripped down-- the file's business information is extracted, verified, and then rebuilt, ensuring a fully functional, malware-free file passes through. This mitigates the threat of even the most advanced zero-day attacks and helps organizations pivot from detection to prevention. 

Zero Trust CDR is particularly effective because it can be configured to protect the full range of content-focused business applications and processes by being embedded into web gateways, email gateways, remote browsers, and cloud APIs. Most Zero Trust CDR solutions are simple to deploy and scalable. In turn, organizations can seamlessly and securely share information without the threat of malware. All data that enters the organization is sanitized in seconds—no waiting for the system to scan files and no delays for isolation and inspection. 

Never trust, always verify.
The bottom line is that far too many organizations in the U.K. remain extremely vulnerable to ransomware attacks. Last year, ransomware payments exceeded $1 billion, while attacks in Europe specifically grew by 52% year-over-year. When such attacks are carried out against critical infrastructure, they impact not just the organization in question but everyday people. The real-world impact of cyberattacks was seen with the Colonial Pipeline hack in the U.S. three years ago, as a hack shut down the company's operations for five days and sent Americans scrambling for gasoline. 

In the U.K., attacks could easily disrupt everything from water to transportation. To prevent a catastrophic incident, organizations should never trust and always verify. That means assuming all content may contain malware and stripping it of such before it travels to its destination.

As digital content becomes the vector of choice for cyber criminals looking to steal data and halt operations, and as ransomware-as-a-service continues to grow in popularity, organizations must pivot from detection to prevention by assuming all content is infected and sanitizing it accordingly. By implementing Zero Trust CDR, organizations can stifle one of the most popular and accessible entry points for cyber criminals or nation state attackers.