Don’t depend on a cyber insurance policy to cover your losses after a ransomware attack.
Hackers have discovered that there’s fast, easy money in holding enterprise systems hostage, especially in industries that process and store highly sensitive data, such as education and healthcare. The U.S. Department of Justice recently reported that ransomware attacks quadrupled between 2015 and 2016, to an astounding 4,000 attacks a day. Most businesses hit with ransomware are knocked offline for at least a week, and it’s estimated that the ransomware epidemic cost organizations over $1 billion last year alone. With those sobering statistics in mind, more organizations are considering purchasing cyber insurance to protect themselves. But while cyber insurance can help to some extent, it is no substitute for comprehensive information security.
Cyber Insurance Coverage Can Be Expensive, Skimpy, and Uncertain
Cyber insurance is a brave, uncertain new world for both insurers and policyholders. Because widespread internet access is relatively new in the grand scheme of things, and the threat landscape changes daily, insurers don’t have access to the historical data they need to build accurate predictive models, nor do they have the technical expertise to anticipate future threats. Meanwhile, a lack of standardization means that organizations cannot make “apples to apples” comparisons when evaluating coverage options – if the organization even knows how much coverage it needs in the first place, a tall order in a world where businesses are only now coming to terms with cyber threats and their individual risk environments. The result is a confusing marketplace filled with high cost, “skinny” policies. It’s understandable why fewer than one-third of U.S. businesses have purchased coverage, including only 40% of Fortune 500 companies.
All Insurance Policies Have Exclusions
Like all other types of insurance, there are certain things cyber insurance won’t cover. For example, cyber insurance does not cover ransomware attacks that are connected to malicious insiders, such as a disgruntled former or current employee, or even an angry vendor. Additionally, if a policy does not specifically include “extortion coverage,” ransomware won’t be covered at all. Even worse, if a business publicly discloses that it has purchased extortion coverage – such as in a press release or in an SOC report – the policy is rendered invalid.
The legalities of cyber insurance are evolving as quickly as the threat environment; what is and isn’t covered can be difficult to determine, and policyholders may find themselves having to take their insurers to court to get their claims paid.
How Long Can You Afford to Be Locked Out of Your Systems?
Remember that insurance does not prevent catastrophes; it helps you clean up after a catastrophe has occurred. Even the most robust cyber insurance policy cannot protect against the biggest problem ransomware causes: Being locked out of your systems and data for days, weeks, perhaps even months. In a healthcare environment, the inability of front-line employees to access electronic medical records could result in disability or even death. While organizations in other industries may not face literal life-and-death situations, the damage from having to cease operations until the computers are back online could be crippling, especially to startups and other small businesses.
The Best Defense is a Good Offense
If you are thinking of purchasing a cyber insurance policy, don’t attempt to go it alone. Seek professional help from a reputable cyber security firm that can help you evaluate your risk environment, determine how much coverage you need, and choose the most suitable policy for your organization’s needs.
However, cyber insurance coverage is not a replacement for comprehensive, proactive cyber security. The best way to defend your organization against a ransomware attack is to make sure one never happens in the first place.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.