Are Cyberattacks set to be uninsurable? MARIO GRECO answers.
The trend among cyber insurers is definitely trending in this direction. Higher cost for insurance, only partial coverage of the costs and higher requirements of security controls in the target environments.
It’s understandable since some insurance companies are losing money on cyber.
However, in the long run we can’t let criminal ransom gangs take it this far. We can’t leave the organizations without this important tool to ensure sustainable operations after a cyber attack.
There are some things that needs to be done in order to “fix” this.
Every organization who wants a cyber insurance in the future needs to act!
1. Stop Paying Ransom!
Several incident responders actually recommend paying ransome! Some even make money from negotiating ransom and facilitating payment!
Use incident responders that are capable or recovering systems and data without nurturing organized crime.
Taking the money out of the equation is crucial!
2. Implement Detect & Recovery That Works!
The majority of full scale ransom attack could have been prevented if a working capability to detect and respond to breach would have been implemented. (I have several posts about this)
3. Protect Assets!
In most cases the threat actors will steal data and/encrypt systems. The problem is that most companies security programs are not optimized to protect against these scenarios.
For example backup solutions are implemented to restore data. When all systems are encrypted you need to recover entire systems including applications, integration, configurations, etc. When data is stolen and the actors threaten to publish the data online, the backup solution is useless as a mitigation.
A) Important data must me very hard to steal. Implement the necessary controls.
B) It should be possible to recover entire IT-systems, especially every systems responsible, directly or indirectly for critical or important business functions.
C) It should be extremely hard to compromise an entire IT-environment. Implement the necessary controls. (Including detect & respond)
4. Bring The Criminals To Justice!
The justice systems need to increase the capabilities to investigate and identify the criminals responsible for the attacks. Increased efficiency and collaboration is needed. This can only be done by collaboration between law enforcement/governments and private cyber security specialists.
Even if some criminals are protected by their government like for example Russia, there are tools that can be used if we identify the individuals and hold them responsible. We can enforce sanctions on them, limit their right to travel to western countries and If they do, we can bring them to justice.
The work has to be done. The society depends on is. If a house burns down to the ground, the insurance is the most important lifeline. For companies in the future, the cyber insurance is similar.
