Less than 30 percent of IT security executives who responded to a recent survey reported that they would be able to prevent large-scale ransomware attacks.

Despite this, SolarWinds MSP’s new report, “The 2017 Cyberattack Storm Aftermath,” found that IT security executives have a high level of knowledge of crypto-malware. More than two-thirds (69 percent) of respondents said they were deeply familiar with ransomware attacks such as WannaCry, which infected hundreds of thousands of endpoints within 48 hours earlier in May 2017, and Petya, which affected systems in dozens of countries in June 2017.

This familiarity led approximately three-quarters of survey participants to rate the risk of both WannaCry and Petya as very high, but it didn’t translate to better protection against this type of incident. While most respondents indicated that they would be able to detect WannaCry (72 percent) and Petya (67 percent), only 28 percent and 29 percent, respectively, said they would be able to prevent these attacks.

Organizations Struggle to Curb Ransomware Attacks

For the survey, SolarWinds MSP commissioned the Ponemon Institute to speak to 202 senior-level IT security executives in the U.S. and U.K. about some of the most high-profile threats that emerged in 2017. Their responses revealed that enterprises could be doing more to protect against these widespread attacks.

For example, just one-quarter of respondents said their organization employs specialists who possess the necessary expertise to defend against ransomware and other threats. Meanwhile, one-third admitted that their employer doesn’t have any specialized personnel on the payroll and doesn’t consult with external experts.

Many of these problems can be attributed to lack of resources. Less than half of survey participants reported having sufficient technology to prevent, detect and contain significant threats, and 48 percent said their organization’s IT security budget was inadequate.

Patching and Basic Security Hygiene

Tim Brown, vice president of security architecture at SolarWinds, said the best way for organizations to close these gaps and protect themselves against ransomware is to apply software patches.

“People often don’t think of basic security hygiene as one of the most important things they need to do, but it really is — although it’s really not easy,” Brown told Infosecurity Magazine. “Doing the basics well is not ‘sexy’ or ‘cool,’ it’s a lot of hard work that needs to get done, but no technology is going to really save you from that hard work.”

For companies that lack the necessary resources to fulfill those security basics, Brown suggested contracting security functions to a managed services provider (MSP).