Imagine this. You have spent the last quarter of a century building up your business. The blood, sweat, and tears of doing so have finally meant you can look forward to the fruits of your labor. Then you open an email from a customer alerting you to problems with your website. You go to the site and see an alarming message: your files are encrypted by ransomware, and you no longer have control of your business. This scenario happened to Fran Finnegan, the owner of a company that provides access to millions of documents filed with the Securities and Exchange Commission. His business website was infected with ransomware that ran amok and put his business at risk.
Attacks like this are all too common, but if your business had an attack of this nature could you weather it? Could having cyber insurance help? Can your organization meet the requirements of a cyber insurance policy?
Can cyber risk be offset through cyber insurance?
Ransomware and other malware wreak havoc on businesses the world over. Ransomware makes cybercriminals money. The result is that in 2020 ransomware attacks increased by 130%. While the cybercriminals make money, the businesses affected lose out big time. US businesses are under attack from ransomware criminals, firms handing over nearly $350 million worth of cryptocurrency in 2020. But the ransom is not the only cost to a business. A survey from Sophos found that even if the ransom is paid, only 8% of companies get all of the affected data back, with 29% of firms only recover about half of the affected data. This data exposure and loss of productivity impacts customers, compliance, and business operations.
Organizations can take measures to mitigate against ransomware and other cyber-threats. But cybercriminals continue to innovate, and in doing so, the threat level continues to rise. Just as we protect our business assets using general insurance, so too, a business can turn to cyber-insurance to protect against the worst-case scenario. But in the current climate of ransomware, is insurance the answer?
Cyber-insurance and ransomware
The current state of ransomware means that covering this cyber-threat is a major risk for insurers to take on. Consequently, some insurers are removing cover for ransomware. AXA is one such insurer. In May, AXA announced that it would stop ransomware-related cyber-insurance policies in France and would not be reimbursing customers for ransom payments. Insurer AIG recently said in an interview that “If [clients] have very, very low controls, then we may not write coverage at all.” A study into the costs of cyber-insurance claims, “Cyber Claims Insurance Report” found that in the first 6-months of 2020, ransomware attacks were the basis for 41% of the total number of cyber-insurance claims. Insurers must hedge their bets and ransomware is a poor bet.
Insurance that pays out against a ransom is also a double-edged sword. Known as the “Extortion Economy”, the mere fact that a company can claim on an insurance policy for payment of a ransom creates a climate that encourages further ransomware attacks. This fact may be driving the increase in the ransom amount, with the average ransom being over $170,000 and costs of an infection doubling over the last year. This situation is likely to impact cyber-insurance policy costs and coverage.
Insurers base their policy costs on probabilities. A concerted and coordinated effort to defeat ransomware is needed to prevent an attack from happening in the first place and to help reduce the costs of cyber insurance.
A techno-insurance partnership against ransomware
It is looking likely that cyber-insurance coverage for ransomware will be more costly and difficult to find. The U.S. insurers body, Council of Insurance Agents and Brokers, found that cyber policies saw an 18% increase in costs in 2020, and 73% of its members reported a decrease in appetite to underwrite cyber insurance policies.
But ransomware remains a serious issue for all organizations. An effort to put robust anti-ransomware measures in place will help to bolster the appetite of the cyber-insurance industry, protect an organization, and turn the tables on cybercriminals. A pincer movement is needed to stem the impact of ransomware.
Technological structures play a major part in building a sustainable response to ransomware and other malware. Technologies such as:
- Secure authentication (MFA)
- Intrusion Detection and Prevention
- Endpoint Detection Response (EDR)
- Encryption and data leak prevention (DLP)
- Business Continuity & Incident Response Planning
…work to build a layered approach to security.
By having these technologies in place, ransomware infection is less likely to occur and, in turn, premiums for cyber-insurance policies will be less costly. Having appropriate security measures in place shows a company’s commitment to reducing cyber-risk. Whilst nothing is 100% guaranteed, having these technologies in place will show commitment to protecting your organization and give cyber-insurers a reason to continue to underwrite reasonably priced policies.
Wendego IT Solutions role in delivering ransomware protection
Anti-malware technologies are included with your current Managed Service Plan. By using our state of the art anti-ransomware measures, an organization benefits from skilled security professionals who can get the most out of the available solutions. Wendego also provide a cost-effective way of deploying enterprise-grade technologies. We work closely with our clients to understand their network and work culture and to offer a continuous assessment of its security posture. This allows us to optimize available technologies and make sure that an organization can meet any cyber-insurance policy requirements. It is likely that cyber-insurance policies, going forward, will have increasingly strict requirements that, if met, can help lower policy costs; adhering to these policy specifications is a must to make a successful claim. Ransomware criminals are likely to continue their attacks against organizations from the very largest to the SMB. A coordinated approach to security, deploying the best available security solutions, and having cyber-insurance as a worst-case fallback, means an organization can mitigate the impact of ransomware and other malware on their business operations.
For more information about our current Cybersecurity measures or for assistance acquiring your own Cyber insurance. Please contact us at info@wendego.com or dial (858) 346-1567 x1.
