Ransomware threats continue to dominate headlines — and for good reason.

The good news is that you can strengthen your organization’s resiliency and security posture and stay one step ahead of ransomware with proactive data security best practices.

After all, the steps you take today to protect and defend against threats can determine how quickly your organization can resume normal business operations if you get hit with ransomware. For comprehensive coverage of cyber threats, you must proactively invest in preventative security measures to keep data safe and recoverable from attacks.

Follow these five best practices to implement a solid ransomware readiness strategy.

Have a Multilayered Security Plan

With ransomware threats becoming increasingly sophisticated, a multilayered approach to securing your data dramatically helps reduce your organization’s risk. Commvault believes a multilayered security framework that can protect, detect and recover is the best approach to protecting and recovering from ransomware attacks. While the average is 21 days of downtime, we have seen organizations resume operations as quickly as two days when leveraging a multilayered security approach.

Learn about Commvault’s multilayered approach to protect, detect, and recover from cyber threats. Learn more >

Control Who Has Access

Effective data protection starts with a strong foundation. Hardened security protocols, such as multifactor authentication, advanced data encryption, and zero-trust user access controls prevent unwarranted access to systems and data. With Commvault, you can identify risk exposure and coverage status from a single management console across your entire environment.

Watch this video to see how Commvault provides data security controls. 

Isolate and Air Gap

Data isolation using air gap techniques can reduce the exposure of backup data to malware and other vulnerabilities. Commvault suggests implementing a 3-2-1 back strategy for greater ransomware protection: 3 copies of your data, on 2 different media types, with 1 copy offsite. Utilize your cloud first initiatives for not just primary data but to secure your backups as well. Commvault provides a modernized approach to air gapping that is not only simple but also provides the maximum level of security needed to protect against lateral moving threats.

Segment Your Networks

If a cyberattack is successful, don’t give outside threats unlimited access to your entire network. Divide your network into smaller segments to prevent lateral movement and compromise of your business-critical data. Commvault augments your security strategy by providing the flexibility to quickly add cloud storage using Metallic® Recovery Reserve™. Using Metallic® Recovery Reserve™, you can easily implement an offsite cloud storage location, providing a virtual air-gapped, immutable copy of your data to satisfy the 3-2-1 backup storage rule and safeguard your data from cyberattacks.

Improve Security Posture

You need the ability to catch threats before they impact your business. Commvault provides centralized visibility and management through a single, unified platform with security dashboards and alerts to quickly identify risk exposure, detect suspicious activity, and resume business operations. The Commvault Security Health Assessment Dashboard offers a single place for IT Admins to bolster security posture quickly, identify risks in real-time, take corrective action, and rapidly recover data.

Commvault ransomware protection solutions are built on responsiveness, innovation, and rapid execution to help you stay one step ahead of ransomware. With Commvault, you have the most robust data management features at your fingertips to ensure your data remains secure and resilient, keeping your business ransomware ready.

Want to gain more insight into securing your enterprise data to avoid becoming headline news? Read how five organizations were attacked, how they recovered, and their lessons learned. Read Now >

Take our free ransomware risk assessment to learn how prepared you are. 

Ransomware breaches have increased by 13% – more than the last five years combined.¹ Sixty percent of InfoSec leaders agree that ransomware threats should be prioritized to the same level as terrorism.² A cybersecurity attack will impact your organization. It all comes down to how well you have prepared for your cyber recovery.

• Are your organization and employees prepared for a cyberattack?
• Do your teams know their roles, and will they work together?
• Who has the authority/decision-making power to make time-sensitive decisions such as shutting down servers or networks?
• As an executive, are your business leaders in sync, and how will you keep them informed?

Zero Loss Strategy

Consider if a ransomware attack hit you today. Would you have a job or company tomorrow? You need a solution that expands beyond zero trust principles to better plan, manage and reduce the impact of a ransomware attack—introducing  Zero Loss Strategy, built on Zero Trust Principles and implemented through a multilayered security framework for consistent and automated data protection and recovery. With Commvault, protect what matters most through the broadest workload coverage for greater data protection and rapid recovery across cloud and storage platforms all through a unified customer experience helping you to remain vigilant against cyber threats. Zero Loss Strategy delivers:

End-to-end data visibility

Catch threats before they fully impact your data. With a single management platform, identify business-critical and sensitive data, reduce your attack surface, and minimize risk exposure.

Broadest workload protection

Protect what matters most. Commvault covers the broadest of workloads, from traditional on-premises to hybrid cloud and SaaS applications; we also support native cloud integration, so as your organization and data grow, we can easily help you scale.

Faster business response

Speed and accuracy are essential to responding to a ransomware attack. Consolidating your data protection to a single dashboard, the Commvault Command Center™ gives your organization greater production and efficiency.

Zero Trust Principles

Trust but verify. Organizations need to follow zero trust principles to ensure cyber threats do not have unlimited access within their networks. It is core to every organization’s proper cyber hygiene.

A Zero Loss Strategy is built on Zero Trust Principles and implemented through a multi-layered security framework. Commvault uses these as the foundation for a Zero Loss Strategy. We provide multiple layers of authentication controls to stop malicious actors, insider threats, and even unintentional accidents from deleting backup data.

Commvault Multilayered Security Protection

Many experts recommend having a layered anti-malware and ransomware strategy. Commvault has built these security capabilities into our data protection software and policies without the incremental management overhead. Commvault data protection and management platform include five security layers:

• Identify and mitigate risks to backup data within a single interface
• Protect by applying security controls based on industry-leading standards
• Monitor for ransomware, insider threats, and other threats
• Respond and take action on threats and continuously validate backup data
• Recover data quickly across multiple on-premises, cloud, and hybrid environments

Implement an Action Plan

To help you better protect and manage your data, maintain healthy business operations, and manage risk, you need an approach that brings together your data management teams, security teams, and stakeholders. You need a strategy to help you be better prepared and have the ability to recover quickly if a cyberattack does occur.

• Create an incident response plan and test, test, test
• Ensure you have the right staff, vendors, process and technology in place
• Follow the NIST multilayered security framework: identify, protect, monitor, respond and recover to cover security gaps that may exist in your infrastructure
• Follow Zero Trust Principles to verify those users already in your perimeter
• Use a centralized management system, not multiple product points, for easy visibility across your data
• Eliminate gaps in your environment through air gap, honeypots and isolate networks

Ensure your data protection provider can easily scale with your evolving needs and that you have flexible restore options to rapidly recover.  You want a comprehensive approach, not a complex one. Learn more about a Zero Loss Strategy and ransomware protection and recovery.

References

1. InfoSecuity, Benjamin David, Ransomware Attacks Increasing at “Alarmin” Rate, May 2022 – 2. TechRadarPro, Anthony Spadafora, IT Workers Believe Ransomware is as Serious as Terrorism, January 2022.

Cloud transformation is a huge part of digital transformation.  As the cloud revolution moves into its third decade, it’s clear that there’s tremendous value in adopting cloud, with McKinsey estimating more than $1 trillion just for Fortune 500 companies.  Interestingly, nearly all of that value comes from business innovation and optimization rather than IT cost reduction.

So how can organizations capture the potential benefits?

In this video you’ll learn the Do’s and Don’ts of what you need in your data protection environment to successfully achieve a cloud transformation that will make a positive impact for your business.

To further assist you with implementing a successful cloud strategy – please see below a handy checklist. 

Find out more about cloud transformation with Commvault here https://www.commvault.com/digital-transformation-changes-everything-when-it-comes-to-data.

With new threats emerging daily and increasing in complexity and sophistication too, cyber security has become a critical focus for all organisations – with every single company, irrespective of its size and location, at risk of a cyber-attack. As a result, most have started opting for cyber insurance to cover the losses that such attacks may incur, sometimes together with a specific ransomware warranty, catalysed by this type of threat accounting for some 75% of cyber insurance claims (AM Best 2021). Outside of ransomware, cyber insurance can cover areas including extortion demands and remediation efforts.

But this is a market under strain, with the ratio of losses to premiums earned at 73% in 2021 according to Fitch Ratings and difficulty in diversifying the risk as cyber-attacks have no boundaries. Further, the absence of historical data complicates the capacity for the type of risk forecasting that the insurance industry typically employs to set pricing rates. In combination, this is ultimately threatening the profitability of the industry and thereby the protection it affords – and fuelling rising premium prices for customers too.

Headline grabbing ransomware warranties are also an area that further investigation and small print reading is required.   What may look an attractive proposition (and often a no brainer) in many cases will never pay out and could lead to dangerous complacency.

Additionally, clauses around cybersecurity insurance are increasingly tightening, as highlighted by the recent announcement by Lloyds of London on coverage limitation, for example its insurance products will no longer cover the fallout of cyber-attacks exchanged between nation-states. Many insurers are also imposing stricter safeguarding requirements, which although helping to support increased levels of cyber security defences, this can also leave some organisations and especially SMB’s exposed, as they are less able to meet the new minimum threshold limits.

This makes knowing exactly what is covered in any policy you have today, or are contemplating purchasing in the future, a business and technology imperative. Companies should know that cyber insurance policies and ransomware protection warranties do not cover every aspect of attacks and in most cases, there will be varying triggers, limits, conditions and coverages for different types of claims which can lead to denial or a reduced claim, creating an expectation and actualisation gap. Education and awareness here is key – you must be fully aware of what is not covered by your cyber insurance today, to avoid any surprises later.  Roy May does a great job of covering exactly this point.

Let’s explore some of the key issues in turn to support exactly that.

• Third-Party Mistakes: Cyber insurance companies do not cover you if a cyber-attack takes place on any third-party system causing damage to your primary business. This third-party software or services can be your web hosting, email, cloud services, customer service management or any other significant online business relationship.
• Losses Incurred During ‘Waiting Period’: The insurance world often has a time-based deductible referred to as a “waiting period.” Only the losses that incur after the completion of the waiting duration are covered by insurance. This waiting period is usually around 10 to 12 hours. It means that if your network undergoes a cyberattack during the waiting period, you will not be able to claim money from your insurance.
• Loss During Downtime: Losses incurred during the business interruption event are not covered by major policies. The downtime can cause harm to your business in many ways leading to loss of productivity and customers trust, loyalty and ultimately their business. No matter how much sales loss this downtime costs you, it will not be covered.
• Reputation Damage: This is one of the most significant risks a company faces if a cyber-attack or data breach happens. Indeed, 1 in 3 customers are willing to leave a brand they love after just one bad experience, rising to over 90% after 2 or 3 poor experience interactions. (ADD CITE). Any attacks during special events like Cyber Mondays can do even more harm to the organization. As it is difficult to quantify such loss, cyber insurance companies do not cover them in their policy.
• Bodily Injury or Property Damage: Cyber-attacks have tangible consequences. As the world moves towards IoT (Internet of everything), the connections between objects are increasing, and there are chances that it may lead to bodily injury or property damage. It can sound unusual but many production firms are nowadays running entirely on computers.

Everything right from collecting raw materials to shipping the final products happens through automated systems. In the scenario of a cyberattack taking place during any part of this process, it would lead to a catastrophe. If any company ends up in any such situation, cyber insurance will likely not cover the (extent of) the need.

• New Hardware: Usually cyber insurance policy will not cover any property damage like hardware replacement and other equipment caused due to a cyber-attack. It becomes problematic when the hardware is corrupted to such an extent that it is impossible to fix it. The best way in such cases is to replace the hardware with something new, but the organization itself will have to pay for this.
• Software Upgrades: The latest versions of the software are traditionally not covered by cyber insurance policies. In case of a cyber-attack, major cyber insurances will only help you restore the software to where it was before the attack took place.
• Lost Equipment: Most cyber insurance policies do not cover any cybercrime that originated from a lost portable device like a company laptop or tablet. Few insurance policies include only encrypted devices in their policy, so all the devices used in the organization must have appropriate security patches.
• Card Issuer Fines and Penalties: A key concern when dealing with a data breach is related to the penalties and potential fines imposed against a company by card issuers like MasterCard, Visa, etc, or indeed imposed against company directors under GDPR and similar regulations. These fines or penalties can reach a substantial amount of up to six figures. A few insurance companies exclude covering these types of fines which could lead to severe financial loss.
• Specialised Attacks: Many insurance policies cover only the attacks that are committed by cybercriminals that seek personal profits, or collective profits when bad actors collaborate together for shared gain. They deny the coverage if the attack is carried out with a motive of terrorism or by a nation-state actor for political ends, an area where research shows increasing scale and volume of attacks to evade detection (Microsoft 2021)

Final Thoughts – So, Is Cyber Insurance Worth It?

The resiliency of a business is tied to its cyber resilience, making a sustained and organisation wide focus on cybersecurity critical, right across technology, process, culture and skills. As part of this, cyber insurance plays a role in protection by necessitating advances in security by design within increasingly stringent terms – and by supporting organisational recovery in the event of a breach when all such obligations were fulfilled. But not all cyber insurance policies are made equal, with material differences in coverage and conditions. So you must fully understand both your requirements and your obligations before making a final decision.   

Start-ups and SMB’s having small portfolios or minimal digital assets might not be able to justify the expense of cybersecurity insurance, with a better return on investment likely achieved by focusing on security defence, for example Zero Trust practices and employee training and awareness. For large enterprises managing a significant volume of sensitive financial information or PII for their customers, then investment in a reputed cyber insurance policy can be well justified – but only as part of a holistic cybersecurity strategy. No policy will prevent nor spontaneously solve issues related to security but rather, they can form the final piece in a proactive defence program that focuses on both early identification of risks, and expedient recovery when (not if) an attack of some form inevitably occurs.

About the Author

Dr. Sally Eaves is the Chair for Global Cyber Trust at leading Think Tank GFCYBER and Digital Decentralization, Democracy and Security Advisor for the Centre for a New American Security (CNAS) reporting to the United States Government. A highly experienced Chief Technology Officer by background, Professor in Advanced Technologies, and a Global Strategic Advisor on Digital Transformation, Sally specialises in the application of emergent technologies, notably AI, Security, 5G, Cloud and IoT disciplines, for Business and IT transformation, alongside enabling Social Impact at scale.

An international Keynote Speaker and Author, Sally was the inaugural recipient of the Frontier Technology and Social Impact award, presented at the United Nations, and has been described as the “torchbearer for ethical tech”, founding Aspirational Futures to enhance inclusion, diversity, equity and belonging in the technology space and beyond.