The majority of global businesses believe supply chain attacks can become a major threat within the next three years, with 45% experiencing at least one such attack in the last 12 months. This figure is higher, at 48%, in the Asia-Pacific region, where organisations also are reporting more ransomware attacks and paying out higher ransoms than their global counterparts. 

Worldwide, 84% of enterprises expressed concerns third-party attacks could become a major cyber threat over the next three years, according to a report commissioned by CrowdStrike. However, just 36% had vetted all their software suppliers for security purposes in the past year, including 40% in Asia-Pacific.

Conducted by market researcher Vanson Bourne, the study surveyed 2,200 senior IT security executives and decision makers across 12 global markets between September and November this year. These included four in Asia-Pacific, where 300 respondents were from India, 200 each from Japan and Australia, and 100 from Singapore.  

See also

Constant review of third-party security critical as ransomware threat climbs

Lulled into complacency, businesses face risks of supply chain attacks even after they have done their due diligence in assessing their third-party suppliers' security posture before establishing a partnership.

At 87%, more in Asia-Pacific than the global average expressed concerns supply chain attacks were becoming a major cyber threat, the study revealed. 

Amongst the 48% in the region that reported at least one such attack in the past year, 36% were from Singapore where 57% could not ascertain that they had vetted all their software suppliers for security purposes.

Some 69% in Asia-Pacific also encountered at least one ransomware attack in the past 12 months, higher than the global average of 66%. This figure was 64% in Singapore.

APAC clock highest ransom payout

Asia-Pacific also clocked the highest average ransomware payment of$2.35 million per attack, compared to$1.55 million in the US and$1.34 million in EMEA. The global average ransomware payout climbed 63% this year to$1.79 million, up from$1.1 million last year, according to the report, which noted that attackers demanded an average$6 million in ransom payment. 

Worldwide, 96% of respondents that paid the initial ransom had to pay additional extortion fees of$792,493 on average. The report noted that 57% of companies that suffered a ransomware attack acknowledged they did not had a defence strategy in place to coordinate a response. This figure was 53% in Asia-Pacific.

Singapore respondents that chose to fork out a ransom demand paid the lowest average at$1.46 million in the region, compared to India at$2.92 million, Japan at$2.25 million, and Australia$1.53 million.

Some 93% of Singapore organisations that paid a ransom forked out additional extortion fees averaging$619,231 per attack, which again was the lowest in the region where their Indian counterparts paid an average of about$1.15 million in additional extortion fees per attack, while those in Japan paid$950,000, and Australia clocked at$785,345 per attack.

Singapore took 119 hours to detect a cybersecurity incident, quicker than the average 205 hours in Asia-Pacific, but required a longer 15 hours to investigate and triage, compared to the regional average of 14 hours. 

Organisations in Singapore also took an average 30 hours to contain and remediate security incidents, almost double the Asia-Pacific average of 19 hours. Some 60% in the city-state cited remote work as the source of an intrusion, while 75% in Asia-Pacific and 69% worldwide said likewise. 

Globally, organisations took an average 146 hours to detect a cybersecurity incident, up from 117 hours last year, and needed 11 hours to triage and understand an incident. They required 16 hours on average to contain and remediate a security incident. 

Amidst the rise in frequency of security incidents, the report noted that 63% were "losing trust" in legacy software vendors including previously trusted providers such as Microsoft. In Asia-Pacific, this figure clocked at 66%. 

CrowdStrike CTO Michael Sentonas said: "Adversaries continue to exploit organisations around the world and circumvent outdated technologies. Today's threat environment is costing businesses around the world millions of dollars and causing additional fallout. The evolving remote workplace is surely accentuating challenges for businesses as legacy software like Microsoft struggles to keep up in today's accelerated digital world.

"This presents a clear clarion call that businesses need to change the way they operate and evaluate more stringently the suppliers they work with," Sentonas said. 

RELATED COVERAGE

• Half of APAC firms bypass processes to accommodate remote work
• Regulations against ransomware payment not ideal solution
  
• Most firms face second ransomware attack after paying off first
  
• Singapore sees spikes in ransomware, botnet attacks
• Zero trust, basic cyber hygiene best defence against third-party attacks
• Growing reliance on third-party suppliers signals increasing security risks