Organisational and individual behavioural susceptibility and protection approach for ransomware attacks

Ransomware attacks have become complex due to the ability of networked-systems constantly used as attack-vectors for propagating the ransomware payload to victims. The threat is socially engineered, making it difficult for victims to protect their data. Confidential information resources and assets are lost and rarely recovered in an attack resulting in financial losses amounting to millions of dollars. Ongoing research is exploring avenues to solve this problem including cybersecurity awareness and training from a singularised perspective, not pluralistic, to educate users of the consequences of their actions. The purpose of this study is to gain perceptions of several industries to develop insights on how to protect organisations from becoming victims of socially engineered ransomware attacks. Using a qualitative approach, critical themes on behavioural susceptibility to socially engineered ransomware were obtained, as well as the demand for applying behavioural theories and technical controls to develop effective training and education initiatives for resisting these attacks.