Slashdot Mirror
Ransomware Insurance Is Coming (onthewire.io)
Trailrunner7 quotes a report from On the Wire: As bad as the ransomware problem is right now -- and it's plenty bad -- we're likely only at the beginning of what could become a crisis, experts say. "Lots of people are being infected and lots of people are paying. The bottom line its it's getting worse and it's going to continue to do so," Jeremiah Grossman, chief of security strategy at SentinelOne, said during a talk on the ransomware epidemic at the RSA Conference here Monday. "Seven-figure ransoms have already been paid. When you're out of business, you'll pay whatever you have to in order to stay in business. You're dealing with an active, sentient adversary." The ransomware market seems to be headed in the same direction as real-world kidnapping, where high-profile targets take out insurance policies to pay ransoms. Grossman said it probably won't be long before the insurance companies latch onto the ransomware game, too. "The insurance companies are going to see a large profit potential in this. Kidnapping and ransom insurance is still very boutique. This economic model will probably apply equally well to ransomware," he said. According to The FindLaw Corporate Counsel Blog, "Ransomware attacks fall under your cyber insurance policy's 'cyber extortion' coverage and can generally be considered "first-party" or "third-party" coverage, according to Christine Marciano, president of Cyber Data Risk Managers. Third-party coverage would likely leave a company uninsured when they are the victims of a ransomware attack. Even if your insurance policy covers ransomware attacks made against your company, the deductible may be so high that the company will be stuck paying any ransomware demands out of pocket (should the company decide to pay to decrypt its data). And your coverage may be sub-limited to relatively small amounts, according Kevin Kalinich, the global cyber risk practice leader for Aon Risk Solutions. A $10 million policy may only provide $500,000 for cyber extortion claims, he explains."
BACKUP YOUR SHIT
As long as the insurance companies put in a mandatory security training course to qualify for this, I'm okay with it. Why do people still open unknown executables in emails?
Insurance companies are experts in mitigating and evaluating risk - It's literally their job.
In order to get insurance, insurance providers will require their customers to educate their staff and ensure they have a minimum baseline of security.
The very basic, most bare of security practices reduce ransomware's impact to an annoyance. Separation of privileges, backup, software updates, email attachment filtering - You know stuff you should be doing already.
What guarantees does anyone paying a ransom get that they will be able to unlock their data? If you are dealing with ransomware, you are dealing with crooks who don't have any morals whatsoever. Once they get payment, why wouldn't they just let you twist in the wind? Many kidnappings are the same. You pay the ransom and you still get a dead or missing relative.
And then next step is ransomware insurance fraud.
And unlike so many other forms of insurance fraud, this would be easy to do, near-impossible to prove, and without the nasty long-term repercussions that things like arson come with...
Think outside the... Hey, where'd the friggin' box go?
I know the best insurance is having competent IT pros that can make ransomware no more than a minor inconvenience, but I suspect there are many small/medium businesses that would find this a cheaper alternative than staffing such a department.
Idiot insurance
love is just extroverted narcissism
had an admin go rogue
If you know who the perp is, there's all kinds of options available.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
1. Back up your data
2. Install the ransomware yourself on the computers.
3. Cash in on insurance policy
4. Reinstall data from backups.
Seven puppies were harmed during the making of this post.
The problem with this is, while it may help out a clueless company in the short term, the incentive for the insurance company is to pay the ransom, because it rewards the evil-doers, which, in turn creates more need for the insurance.
That was the turning point of my life--I went from negative zero to positive zero.
Nobody likes paying for IT. Outside of nerds (the neckbeard kind, not the modern "nerd") people hate computers. They hate how they make them feel weak and dumb. They hate that they can't seen them working because so much goes on behind the scenes. And above all they hate that they put power in the hands of the sorta twerps they used to see bully (or bully themselves) in grade school.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
check the deep web for the app...
You're guaranteeing the bad guys a paycheck.
Have a friend who works for a mid-sized insurance firm that provides Cyber Insurance, it's actually exclusively what he does now. So what they do is get you to agree that you'll take all these preventative measures to avoid it (ie making backups) and when you get ransomwared they find some particular provision you violated to not pay your claim. Like any insurance of course.
> the incentive for the insurance company is to pay the ransom
What insurance companies actually do is set conditions that *reduce* risk for their customers, so They don't have to pay anyone. They also create organizations such as Underwriters Laboratories and the National Fire Protection Association (who write the fire code).
In this case, the insurance company will require that in order to get converage, you'll need to have *proper* backups, with a checklist of requirements for *proper* backup. Then they never have to pay out, and collect (small) premiums basically in exchange for forcing companies to test their backups quarterly.
I once worked for a company specializing in environmental cleanup. They were eventually bought out by a polluting civil engineering firm. They were essentially paid by the gov't to clean up their own messes.
(Granted, the rules were lax in their earlier years such that it this financial recursion probably wasn't planned; just a lucky accident.)
Table-ized A.I.
Besides, the threat of legal action makes getting your hostage data "freed" a waiting game. Who loses more in such a waiting game - the rogue programmer, possibly confined in a very boring place with a bunch of smelly people and bad food, or the enterprise paying rent, utilities and people to not do business as usual?
Some pretty important data you have there. It would be a pity if something were to happen to it. You can't be too careful these days. By the way, how are the wife and kids doing.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Use Linux and use separate partitions as follows: /boot ext2
/ ext4
Swap /home ext 4 encrypted
Then, install Clamav and Lynis to check for viruses (more like passing on prevention for Window$ than for actual Linux) and rootkits.
And if you find anything, you can reinstall Linux and leave the /home partition alone in most cases so you don't lose anything. Keep a list of installed packages and just drag and drop after apt-get install, yum, or zypper in the terminal.
There have been actual cases when people try to get access to computers by lying about detecting malware on their computer over the phone. The user says he uses Linux and not Windows. They hang up immediately. I wouldn't pass these "insurance" companies to be any different.
While I mislike running such software in what I still think of as kernelspace (ring-0, I think?), I recognize why this has to run there under Windows, unless you like answering UAC requests all day. I'm going to give it a shot - this time, on physical hardware in daily use instead of sandboxed in a carefully managed VM (having already confirmed in the VM that it doesn't do anything schiesty). I have no intention of endangering my system (for example, by intentionally permitting a ransomware attack on my machine). Since I've never fallen prey to any exploits I'm aware of, I doubt that I'll have anything to report on that score.
If it lives up to all you've claimed for it by itself, I'll be shocked. If it lives up to expectations, I'll be content. Suffice it to say I'll relate my experience with it here. I've seen what I consider a distinct improvement in your online comportment of late - let me go ahead and give your host lookup tool a shake. You'll hear back from me.
Testing . . .
I'm fairly certain insurance companies will require protection against that before they issue a policy.
I've been hoping we could get something like Underwriters Laboratories (UL) or the National Fire Protection Association (who authors the fire code) for security, and someone to get companies to follow the standards. Insurance companies created UL and NFPA and require corporate clients to mitigate risks that could result in a payout. I have hope they will be a very good thing for security. Insurance companies evaluate and manage risk for a living, and they are good at it.
Seems to be installed and running correctly. Not quite intuitive, I wouldn't recommend it for most end-users. Your explanation of how to install is clear enough but I think you're overestimating the average users' intelligence. That's okay, as anybody who can't figure it out probably wouldn't know how to apply any other security enhancements anyway.
Next test - VPN. I've occasionally had some DNS issues, especially when TOR'ing over a VPN in Windows. NP from my Linux desktop, but as I may have mentioned I gave it up last year, when I bought an Asus Chi-T300. Just plain too much easier to use Win10 then to get Fedora up and running right.
... only after having the company agree to a regular audit of its backup systems, and ensuring automated redundant backups of crucial data...
Now if something would happen to it...;) I have already insurance against malware, got a Mac, a GhostBSD and a Linux at home, and at work all my servers are Linux and FreeBSD, thank you.
(and keep the cryptographic keys, just in case backups fail)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
This isn't a new thing. It's been around for a while.
And it's not just about paying the ransom. The ransom is usually a very small amount of money in the whole scheme of things. It's about being able to conduct business like paying your vendors and employees while your system is down.
"A plan fiendishly clever in its intricacies"- Homer Simpson
I think you can expect that the insurance carrier will require certain measures to be in place, especially reliable and tested backups. They aren't going to insure you against ransomware per se, they will only cover any losses incurred while restoring, or something similar. And it will have to be direct, quantifiable losses, such as cost of recalling tapes from storage. If you somehow found a carrier willing to insure you against enormous undefined losses due to your own failures, you can bet the premiums will be far higher than the cost of the backups.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Yes, backup is good, but Ransomware should not be able to operate on a good Linux OS : so, how to foolproof one's Linux distro? /home partition?
NoScript is good for preventing webexploits, but if one wants to surf the Net, at least some javascript must be allowed: what happens if one of these supposedly benign script is in fact malicious?
They shouldn't be able to touch the root files IIUC, nor to install a ransomware, but what prevents them to encrypt the
I've heard of an escalation exploit in X, but don't know much more about it: is it something that one should fret about? Is there a way to protect one's system against it?
KillDisk apparently targets Linux now, but I couldn't find an explanation on HOW he manages to do that; the best I could find was an allusion to the fact that it cannot infect a Linux by itself but runs on already infected linuxes... Is that true?