The IT Nerd

This past Friday, Anne Neuberger, the U.S. deputy national security adviser for cyber and emerging technologies, wrote an opinion piece for the Financial Times warning that ransomware was “wreaking havoc around the world,” and insurance companies must stop issuing policies that incentivize extortion payments in ransomware attacks.

The initial call for the practice to end was made at the end of the 4th annual International Counter Ransomware Initiative summit in the US last week, where the 68 members discussed tackling the problem.

“Some insurance company policies — for example covering reimbursement of ransomware payments — incentivize payment of ransoms that fuel cyber crime ecosystems. This is a troubling practice that must end,” Neuberger wrote.

The insurance industry could play a “constructive role” by “requiring and verifying implementation of effective cyber security measures as a condition of underwriting its policies, akin to the way fire alarm systems are required for home insurance,” Neuberger continued. 

Attempts to engage with the insurance industry have not yet delivered any promises or formal agreements.

Earlier this year, the UK’s NCSC announced that it would agree on guidance that expressed a joint view of how businesses should handle ransomware attacks. Furthermore, during the CRI summit, just 39 members and 8 insurance industry bodies from around the world endorsed a similar guidance encouraging “organizations to carefully consider their options instead of rushing to make payments.”

Despite the availability of other guidance on best practices in ransomware responses, attacks targeting victims in the UK and the US have roughly doubled over the past two years.

Steve Hahn, EVP Sales US, BullWall:

  “The global ransomware market has seen a 200% increase in successful cyber attacks in the last two years. They know global ransomware payments exceeded a billion dollars for the first time last year. This increase in money for the criminals gives them all the incentive they need to continue innovating their attack techniques. It’s clear many companies are seeing these events as inevitable, which is true, but relying on insurance to pay their way out of it. Unfortunately, even if they pay the ransom, their infrastructure was down for days or weeks and they are unlikely to recover more than 78% of their data even if they pay the ransom. 

United Healthcare paid at least $22 million in ransom payments, but that didn’t stop billions of dollars of downstream economic loss, including multiple healthcare companies that were forced out of business because of this event. Paying the ransom increases activity, increases funding, and throws gasoline on what is already a raging fire. Yes, these events are inevitable, but companies must focus on containing these events quickly, segmenting their environments, limiting the blast radius, and focusing on how to recover quickly from immutable backups. These strategies will ensure a quick recovery from the inevitable without lining the bloated coffers of the criminal underground.”

Ted Miracco, CEO, Approov:

  “Paying ransoms only fuels the ransomware economy, emboldening attackers, and encouraging future attacks. Businesses must focus on bolstering their fundamental cybersecurity practices— not adding more insurance coverage, as insurance is a reactive measure and often only provides temporary relief, while the underlying vulnerabilities remain unaddressed. Insurers should play a constructive role by mandating stricter cybersecurity practices as a prerequisite for coverage, much like requiring fire alarms in homes. This would help elevate overall security standards and reduce the attractiveness of ransomware as a profitable venture.”

I’ve said it before and I will say it again. These sorts of attacks are out of control. Everyone needs to do better when it comes to responding to attacks. And that includes not paying the ransom. Ever.

This week, cybersecurity experts from almost 70 countries are attending the fourth annual International Counter Ransomware Initiative meeting at the White House, and yesterday, the UK and Singapore released a voluntary guidance document designed to help victims respond to ransomware attacks and minimize the impact.

Under the new voluntary ransomware guidance, victims are encouraged to:

1. Report attacks on a more timely basis to law enforcement agencies
2. Record incident response decisions and data captured for post-incident reviews
3. Involve more advisers such as cyber insurance carriers and other outside firms that can assist 
4. Consider if the decision to pay the ransom “is likely to change the outcome”
5. Review local regulatory requirements for compliance

“External experts such as insurers, national technical authorities, law enforcement or cyber incident response companies familiar with ransomware incidents can improve the quality of decision-making,” according to the new guidance. 

During the event, the participants tackled several initiatives including:

• The completion of a project on secure software and labeling principles
• The launch of a member portal by Australia for information sharing 
• A new U.S. government fund to strengthen members’ cybersecurity capabilities

Morten Gammelgaard, EMEA, co-founder, BullWall had this comment:

  “The International Counter Ransomware Initiative is important, and the steps taken are crucial for improving the worlds collective response against ransomware. The new initiatives coming from the meet, together with new regulatory requirement for better Ransomware resilience will help to drive the fight against Ransomware.

  “However, Ransomware continues to successfully bring down organizations at pace. The world is experiencing a level of disruption and business risk from Ransomware never seen before, and the overall loss from ransomware is at an all-time high for the last 4 years. Some companies fare better than others when attacked and are therefore able to recover faster with less cost. Often, these are the companies that invest in being resilient. Ransomware resilience is directly related to:

1. The strength of the backup systems and are they available after the attack. Often the organizations that fare well have multiple different options in use such as Cloud back up and Tape backup.
2. How many files are encrypted during the attack. The less files encrypted the quicker the restoration and recovery time, which means, if the attack can be contained quickly, a organization can recover quickly 

   “Too few organizations test run restoring millions of files and therefore they don’t realize the time and costs associated with the process until it is too late. As a result, they often encounter very high recovery costs when attacked successfully. Companies must adopt an “Assume Breach” posture as all attack can no longer be prevented.

Here’s the thing. Making sure that your organization is in a place where you never have to pay the threat actor is not just good for you. It’s good for all of us as crime shouldn’t pay. I encourage organizations big and small to look at this document and follow it. And if that’s not enough, there’s a broader document which you can read here which gives additional guidance that is useful.