25% Of Largest U.S. Energy Companies Highly Susceptible to a Ransomware Attack, New Black Kite Research Finds
BOSTON – Oct 4, 2021
One-quarter of the 150 largest energy companies in the U.S. are highly susceptible to a ransomware attack, new research from Black Kite revealed today. Leaked credentials on the dark web, out-of-date systems, and misconfigured email systems are putting the U.S. energy sector at risk.
The oil sector is at the highest risk, with 28% highly susceptible to incur a ransomware attack compared to 25% of natural gas companies and 17% of the electric sector. Black Kite’s Ransomware Susceptibility Index® (RSI™) allows a process of inspecting, transforming, and modeling data collected from a variety of OSINT sources (internet-wide scanners, hacker forums, the deep/dark web and more). Using data and machine learning, the correlation between control items is identified to provide a ransomware susceptibility rating on a scale from 0.0 (less susceptible) to 1.0 (more susceptible)*.
The 150 largest energy companies (market cap) had an average RSI™ rating of 0.42. Increased ransomware risk is attributable to several factors, including leaked credentials within the past 90 days, out-of-date systems, and lax email security. More than 75% of the energy sector has at least one leaked credential on the dark web, 49% has a critical vulnerability due to out-of-date systems, and 74% have not deployed email security configurations to prevent spoofing and phishing attacks.
“At face value, the energy sector has a decent overall security posture. However, when you look under the hood there are areas of concern that make our nation’s energy infrastructure susceptible to crippling ransomware attacks,” said Paul Paget, CEO of Black Kite. “It is critical that energy providers continuously monitor their systems and partners and view risk from the hacker’s perspective.”
* A low RSI™ score does not necessarily mean a company is immune to a ransomware attack. Cybercriminals, especially state-backed actors, may use zero-day vulnerabilities and craft sophisticated attacks, which a security automation tool may not detect or predict.
About Black Kite
One in four organizations suffered from a cyber attack in the last year, resulting in production, reputation and financial losses. The real problem is adversaries attack companies via third parties, island-hopping their way into target organizations. Black Kite is redefining third-party risk management (TPRM) with the world’s first global third-party cyber risk monitoring platform, built from a hacker’s perspective. With 250+ customers across the globe and counting, we’re committed to improving the health and safety of the entire planet’s cyber ecosystem with the industry’s most accurate and comprehensive cyber intelligence.
While other security ratings service (SRS) providers try to narrow the scope, Black Kite provides the only standards-based cyber risk assessments that analyze your supply chain’s cybersecurity posture from three critical dimensions: technical, financial, and compliance.
Contact
For more information, contact Adam Benson at [email protected] or 202.999.9104.