Protecting your business against ransomware attacks? Explaining the motivations of entrepreneurs to take future protective measures against cybercrimes using an extended protection motivation theory model

Bekkers, L. M. J.; Goede, M. Susanne van ‘t Hoff-de; Ellen, Misana-ter Huurne; Ynze, Van Houten; Remco, Spithoven; Rutger, Leukfeldt Eric

doi:10.1016/j.cose.2023.103099

Cited by 24 publications

(14 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Organizations equipped with resilient backup systems and recovery protocols can potentially negate the financial incentives for attackers to prolong the attack duration. Additionally, this correlation highlights the economic motivations behind ransomware attacks [72]. Attackers aim to maximize their financial gains by prolonging the disruption, leading to increased pressure on victims to comply with their demands.…”

Section: MImentioning

confidence: 91%

“…Consequently, this unpredictability necessitates a more dynamic and adaptive approach to ransomware defense and response. For cybersecurity practitioners and organizations, this implies a need for comprehensive risk assessments and scenario planning rather than relying on fixed protocols [71], [72]. Understanding that ransomware attackers might adjust their demands according to the perceived value or potential damages underscores the need for robust backup and recovery mechanisms, cybersecurity hygiene practices, and proactive security measures.…”

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

“…As the victim's urgency to regain control or access to their systems increases over time, the likelihood of them meeting the attacker's demands also rises, resulting in potentially higher payouts. From a cybersecurity standpoint, this correlation underscores the urgency of rapid detection, containment, and mitigation of ransomware attacks [72]. The objective becomes not only restoring systems but also minimizing the time during which the ransomware remains active.…”

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

“…Timely response and effective containment measures can reduce the window of opportunity for the attacker to escalate their demands and limit the financial losses incurred by the victim. Furthermore, this insight emphasizes the critical role of robust backup and recovery strategies in mitigating the impact of ransomware attacks [72], [73]. Rapid restoration of systems and data from backups can significantly reduce the leverage of attackers who seek to prolong the attack to extort higher payments.…”

Section: MImentioning

confidence: 99%

See 3 more Smart Citations

RFSA: A Ransomware Feature Selection Algorithm for Multivariate Analysis of Malware Behavior in Cryptocurrency

Nkongolo Wa Nkongolo

2024

IJCDS

View full text Add to dashboard Cite

This research introduces innovative features tailored to capture distinctive characteristics of ransomware activity within the cryptocurrency ecosystem. The study employs a multifaceted analysis to delve into ransomware-related data encompassing transaction metadata, ransom analysis, behavioral patterns, and financial aspects. A feature selection algorithm is explored to discern ransomware transactions in Bitcoin (BTC) and the United States Dollar (USD) using the UGRansome dataset. This comprehensive dataset of ransomware-related transactions facilitates the proposal of novel features designed to capture the unique traits of ransomware activity. The correlation matrix and temporal analysis of these features contribute to a nuanced understanding of the dynamic nature of ransomware threats. The research presents the Ransomware Feature Selection Algorithm (RFSA) based on Gini Impurity and Mutual Information (MI) to effectively select crucial ransomware features. Evaluation metrics such as precision, recall, accuracy, and F1 score highlight the effectiveness of the RFSA. The analysis reveals that approximately 68% of ransomware incidents involve BTC transactions ranging from 1.46 to 2.56, with an average of 2.01 BTC transactions per attack. Moreover, ransomware causes financial damages ranging from 4.38 to 172.36 USD, with an average damage of 88.37 USD. The RFSA identifies 17 ransomware types and their associated malware to shed light on their characteristics. The study investigates the pricing of ransomware and reveals that TowerWeb is associated with the highest fee, amounting to 135.26 BTC, while CryptoLocker has the lowest fee, recorded at 10.51 BTC. Additionally, the impact of ransomware duration on financial gains and network flow is investigated, disclosing a correlation between extended duration and higher financial gains. The research achieves outstanding performance metrics, including an MI score of 95%, accuracy of 93%, recall of 92%, and precision of 89%. These results showcase the superiority of the proposed approach over existing studies, emphasizing the dynamic and adaptable nature of ransomware demands. The findings suggest that there is no fixed amount for specific cyberattacks. This underscores the importance of adapting to the evolving landscape of ransomware threats.

show abstract

Section: MImentioning

confidence: 91%

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

Section: MImentioning

confidence: 99%

See 2 more Smart Citations

RFSA: A Ransomware Feature Selection Algorithm for Multivariate Analysis of Malware Behavior in Cryptocurrency

Nkongolo Wa Nkongolo

2024

IJCDS

View full text Add to dashboard Cite

show abstract

“…While most businesses fall under small and medium enterprises (Osborn, 2015), many SMEs face constraints regarding cybersecurity resources and tools, often failing to implement proactive security measures (Bekkers et al, 2023). Consequently, this vulnerability makes SMEs attractive targets for hackers (Hayes & Bodhani, 2013).…”

Section: Cybersecurity In Small and Medium Enterprises/public Sectormentioning

confidence: 99%

Vaccination Model: self-protective behavior in the face of Ransomware Attack in SMEs

Rechavi,

Berenblum

2024

Preprint

View full text Add to dashboard Cite

In today's business environment, the reliance of business processes on information technology (IT) has never been stronger, making the maintenance and security of IT systems crucial for organizations. Ransomware attacks present a significant cybersecurity risk, yet many existing solutions primarily focus on technology, overlooking the critical role of human behavior in system security. To address this gap, we experimented to assess the impact of controlled exposure to ransomware attacks on users' protection motivation and behavior. Unlike traditional security training, our approach actively engaged users in real-life scenarios and hands-on security events. The results demonstrated that controlled exposure to ransomware significantly heightened users' vigilance and improved their ability to recognize and respond to phishing campaigns. These findings indicate that hands-on exposure experiences enhance learning and boost protection motivation, sustaining positive effects on cybersecurity behavior. Our study underscores the importance of addressing the human factor in cybersecurity and introduces a promising approach to fortifying resilience against cyber threats. The vaccination model exemplifies a practical and effective strategy for improving cybersecurity readiness within authentic organizational environments by shaping users' mindsets and actions through real threat demonstrations.

show abstract

The Social and Technological Incentives for Cybercriminals to Engage in Ransomware Activities

Wang,

Roscoe,

Arief

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Ransomware attacks and the use of the dark web forums are two serious contemporary cyber-problems. These two areas have been investigated separately in the past, but there is currently a gap in our understanding with regard to the interactions between them -i.e., dark web forums that can potentially lead to ransomware activities. The rise of Ransomware-as-a-Service (RaaS) exacerbates these problems even further. The aim of this paper is therefore to investigate the social and technological discourse within the dark web forums that may foster or initiate some of the users' pathway towards ransomware-related criminal activities. To this aim, we carried out data collection (crawling) of pertinent posts from the "Dread" dark web forum, based on sixteen keywords commonly associated with ransomware. Our data collection and manual screening processes resulted in the identification of 1,279 posts related to ransomware, with the posting dates between 25 March 2018 and 30 September 2022. Our dataset confirms that ransomware-related posts exist on the Dread dark web forum. We found that these posts can generally be grouped into eight categories: Hacker, Potential Hacker, RaaS Provider, Education, Information, News, Debate and Other. Furthermore, the contents of these posts shed some light on the social and technological incentives that may encourage some actors to get involved in ransomware crimes. In conclusion, such posts pose a threat to cyber security, because they might provide a pathway for wannabe ransomware operators to get in on the act. The findings from our research can serve as a starting point for devising practical countermeasures, for instance by considering how such posts should be handled in the future, or how some follow-up intervention actions can be prepared in anticipation of certain actors getting involved in ransomware as a result of reading posts in such forums.

show abstract

Protecting your business against ransomware attacks? Explaining the motivations of entrepreneurs to take future protective measures against cybercrimes using an extended protection motivation theory model

Cited by 24 publications

References 41 publications

RFSA: A Ransomware Feature Selection Algorithm for Multivariate Analysis of Malware Behavior in Cryptocurrency

RFSA: A Ransomware Feature Selection Algorithm for Multivariate Analysis of Malware Behavior in Cryptocurrency

Vaccination Model: self-protective behavior in the face of Ransomware Attack in SMEs

The Social and Technological Incentives for Cybercriminals to Engage in Ransomware Activities

Contact Info

Product

Resources

About