Ransomware recovery targets missed by most organizations, report finds

According to Infosecurity Magazine, a new report from incident response firm Fenix24 reveals that a vast majority of organizations are failing to meet their own ransomware recovery time objectives, with identity systems and backup integrity posing significant challenges.

Fenix24's inaugural State of Recoverability report, based on over 500 ransomware recovery engagements, found that only 0.5% of over 800 clients came close to their 24 to 48-hour recovery targets, and none achieved full operational capacity for several weeks. A critical failure point identified was the lack of robust identity recovery plans, with 99.2% of clients lacking documented plans. Active Directory, often the first system to fall, was frequently linked to backup systems, hindering recovery. Furthermore, 95% of organizations lacked meaningful multi-factor authentication on critical infrastructure consoles.

Even when backups survived attacks, 38% of engagements failed to restore businesses due to outdated, corrupt, or improperly formatted data. Physical constraints like insufficient storage (82%) and inadequate network bandwidth for data transfer (38%) also impeded recovery efforts. The report emphasizes the need for organizations to map critical business service dependencies and conduct end-to-end restore path testing, rather than relying on untested plans or simulations.

Source: Infosecurity Magazine