Ransomware Insurance Is Coming (onthewire.io) 86
Trailrunner7 quotes a report from On the Wire: As bad as the ransomware problem is right now -- and it's plenty bad -- we're likely only at the beginning of what could become a crisis, experts say. "Lots of people are being infected and lots of people are paying. The bottom line its it's getting worse and it's going to continue to do so," Jeremiah Grossman, chief of security strategy at SentinelOne, said during a talk on the ransomware epidemic at the RSA Conference here Monday. "Seven-figure ransoms have already been paid. When you're out of business, you'll pay whatever you have to in order to stay in business. You're dealing with an active, sentient adversary." The ransomware market seems to be headed in the same direction as real-world kidnapping, where high-profile targets take out insurance policies to pay ransoms. Grossman said it probably won't be long before the insurance companies latch onto the ransomware game, too. "The insurance companies are going to see a large profit potential in this. Kidnapping and ransom insurance is still very boutique. This economic model will probably apply equally well to ransomware," he said. According to The FindLaw Corporate Counsel Blog, "Ransomware attacks fall under your cyber insurance policy's 'cyber extortion' coverage and can generally be considered "first-party" or "third-party" coverage, according to Christine Marciano, president of Cyber Data Risk Managers. Third-party coverage would likely leave a company uninsured when they are the victims of a ransomware attack. Even if your insurance policy covers ransomware attacks made against your company, the deductible may be so high that the company will be stuck paying any ransomware demands out of pocket (should the company decide to pay to decrypt its data). And your coverage may be sub-limited to relatively small amounts, according Kevin Kalinich, the global cyber risk practice leader for Aon Risk Solutions. A $10 million policy may only provide $500,000 for cyber extortion claims, he explains."
Re: (Score:3)
Re: (Score:2)
Re: Ransomware Insurance Is Coming... (Score:1)
Re: (Score:1)
I once worked for a company specializing in environmental cleanup. They were eventually bought out by a polluting civil engineering firm. They were essentially paid by the gov't to clean up their own messes.
(Granted, the rules were lax in their earlier years such that it this financial recursion probably wasn't planned; just a lucky accident.)
Fool-proof insurance policy (Score:5, Informative)
BACKUP YOUR SHIT
Re: (Score:3)
You'd think that good backups would be better insurance, but far too many firms simply don't have good backups. Or worse, they think they have backups and they've never really tested the restore process and wait for an emergency to find out it doesn't actually work...
Re: (Score:3)
Or the backups are good and tested, but are on-line disk backups and also get encrypted...
Re:Fool-proof insurance policy (Score:4, Insightful)
In my professional opinion, that would not qualify as a good backup.
Insurance companies will have that on their checkl (Score:2)
I'm fairly certain insurance companies will require protection against that before they issue a policy.
I've been hoping we could get something like Underwriters Laboratories (UL) or the National Fire Protection Association (who authors the fire code) for security, and someone to get companies to follow the standards. Insurance companies created UL and NFPA and require corporate clients to mitigate risks that could result in a payout. I have hope they will be a very good thing for security. Insurance compa
Re: (Score:2)
Re: (Score:2)
When you decide to get an insurance, you can decide to get a backup. the problem firms are those, who don't think about the problem at all.
Re: (Score:3)
"Nothing can be made fool-proof, because fools are so ingenious."
Re: (Score:3)
"Nothing can be made fool-proof, because fools are so ubiquitous."
Re: (Score:1)
If those backups are accessible on same network and no copies offsite, the ransomware will eat those up too
Re: (Score:2)
Re: Fool-proof insurance policy (Score:1)
Re: (Score:1)
And
1. Test backups regularly
2. Put the most recent copy in at least two geographically diverse locations (as insurance against regional disasters).
3. Store the archive versions in at least two different locations, perhaps rotating the target if there's not enough space.
4. If it's encrypted (probably a good idea), also make sure the encryption key is stored in multiple spots.
Example schedule with 3 locations:
LOCATION 1:
- Last night's
- 1 week ago
- 4 weeks ago
- 7 weeks ago
- 10 weeks ago
- etc...
Re: (Score:2)
That's a good plan, unfortunately in many cases getting companies or even government to pay for it is next to impossible. I know of local and parts of provincial governments here in Canada that use 7-day round-robin backups, and there is no off-site backups at all. And it's because they believe it's a "waste of money" and any type of loss of the data is impossible.
Re: (Score:2)
BACKUP YOUR SHIT
It is worth considering that for a large company, perhaps with several thousand workstations, it may be more cost efficient to pay the ransom and get their systems back online within a day rather than overworking their IT staff in the hopes of getting their machines back after a week. Even if the company has full data backups, they may not have the staffing required to wipe and reinstall every computer in a reasonable amount of time.
Re: (Score:2)
Even if the company has full data backups, they may not have the staffing required to wipe and reinstall every computer in a reasonable amount of time.
How hard is it to plop in boot media and run a script? You have all the rest automated, so all it takes is a few lines of shell, right?
Even special snowflake machines should back up to the common place, so they're not that different.
And if you're instead using some commercial "solution", well, then you're already used to pay the inadequacy tax.
Security crash course (Score:1)
As long as the insurance companies put in a mandatory security training course to qualify for this, I'm okay with it. Why do people still open unknown executables in emails?
Re: (Score:2)
because wtf is an "executable", fuck off with your computer shit.
Re: Security crash course (Score:1)
Re: (Score:2)
whoosh.
Re: (Score:1, Flamebait)
Re: (Score:3)
Re: (Score:2)
Not a bad idea at all (Score:1)
Insurance companies are experts in mitigating and evaluating risk - It's literally their job.
In order to get insurance, insurance providers will require their customers to educate their staff and ensure they have a minimum baseline of security.
The very basic, most bare of security practices reduce ransomware's impact to an annoyance. Separation of privileges, backup, software updates, email attachment filtering - You know stuff you should be doing already.
Re: (Score:2)
>ensure they have a minimum baseline of security.
NO, that's victim blaming, people can do jack all, or even worse than nothing, and should still be morally indemnified. And financially. Because they have zero culpability.
Do payments work? (Score:2)
Re:Do payments work? (Score:5, Insightful)
If word gets out that paying doesn't help, then people will stop paying.
These are trustworthy criminals that have a reputation to lose.
Re: (Score:2)
It's like royalties from little-known songs that someone wrote a decade ago. If some trickle in, it's "oh that's nice" money. There's no incentive for the songwriter to maintain or improve that old product. It doesn't encourag
Re: (Score:3, Insightful)
What guarantees does anyone paying a ransom get that they will be able to unlock their data?
None. But ransomeware is generally not a one-off thing, the people who make and distribute it are career criminals. It's in their best interest to restore your data. If a particular brand of ransomware builds a reputation for being dishonest, then nobody's going to pay the unlock fee.
Re: (Score:2)
I think insurance companies for this kind of thing are just a colossally bad idea. Now it positively screams "lucrative!" to the ransomers, as victims will be far more willing to "pay" since it's covered by insurance. The amount of ransom demanded will increase as well.
Instead they should be concerning themselves with better security, training, and backups. That wouldn't have to cost any more than the insurance premium.
It will probably be successful (Score:2)
Large businesses too (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Think Big (Score:2)
What could possibly go wrong (Score:4, Insightful)
1. Back up your data
2. Install the ransomware yourself on the computers.
3. Cash in on insurance policy
4. Reinstall data from backups.
Re:What could possibly go wrong (Score:4, Insightful)
Re: (Score:3)
But how will those "digital forensics engineers" tell an idiot user clicking on an attachment from this being done intentionally by someone with enough brains to log in as the former?
I guess the insurance company will just randomly deny payments with a bullshit excuse, like they usually do.
Re: (Score:2)
Exactly, many companies get several ransomware viruses by email a day. All one needs to do for insurance fraud is to "accidentally" open one.
Chances are the policy requires you to take reasonable steps to protect yourself, similar to how you need to lock your doors and windows for house insurance to cover loss due to theft. So you might have to pick the worst AV going, just to make sure.
And keep the keys (Score:2)
(and keep the cryptographic keys, just in case backups fail)
Interesting idea but ultimately harmful (Score:2)
insurance company requires backups (Score:5, Interesting)
> the incentive for the insurance company is to pay the ransom
What insurance companies actually do is set conditions that *reduce* risk for their customers, so They don't have to pay anyone. They also create organizations such as Underwriters Laboratories and the National Fire Protection Association (who write the fire code).
In this case, the insurance company will require that in order to get converage, you'll need to have *proper* backups, with a checklist of requirements for *proper* backup. Then they never have to pay out, and collect (small) premiums basically in exchange for forcing companies to test their backups quarterly.
Re: (Score:2)
Insurance will make the problem worse (Score:3)
Abort (Score:3)
I can hear it now.... (Score:2)
Food for thought (Score:1)
I would sell this insurance ... (Score:2)
... only after having the company agree to a regular audit of its backup systems, and ensuring automated redundant backups of crucial data...
You have got such a nice computer there... (Score:2)
It's not coming, been here for years (Score:2)
This isn't a new thing. It's been around for a while.
And it's not just about paying the ransom. The ransom is usually a very small amount of money in the whole scheme of things. It's about being able to conduct business like paying your vendors and employees while your system is down.
How does insurance work? (Score:2)
Linux ? (Score:1)
NoScript is good for preventing webexploits, but if one wants to surf the Net, at least some javascript must be allowed: what happens if one of these supposedly benign script is in fact malicious?
They shouldn't be able to touch the root files IIUC, nor to install a ransomware, but what prevents them to encrypt the
I've heard of an escalation exploit in X, but do