With new threats emerging daily and increasing in complexity and sophistication too, cyber security has become a critical focus for all organisations – with every single company, irrespective of its size and location, at risk of a cyber-attack. As a result, most have started opting for cyber insurance to cover the losses that such attacks may incur, sometimes together with a specific ransomware warranty, catalysed by this type of threat accounting for some 75% of cyber insurance claims (AM Best 2021). Outside of ransomware, cyber insurance can cover areas including extortion demands and remediation efforts.

But this is a market under strain, with the ratio of losses to premiums earned at 73% in 2021 according to Fitch Ratings and difficulty in diversifying the risk as cyber-attacks have no boundaries. Further, the absence of historical data complicates the capacity for the type of risk forecasting that the insurance industry typically employs to set pricing rates. In combination, this is ultimately threatening the profitability of the industry and thereby the protection it affords – and fuelling rising premium prices for customers too.

Headline grabbing ransomware warranties are also an area that further investigation and small print reading is required.   What may look an attractive proposition (and often a no brainer) in many cases will never pay out and could lead to dangerous complacency.

Additionally, clauses around cybersecurity insurance are increasingly tightening, as highlighted by the recent announcement by Lloyds of London on coverage limitation, for example its insurance products will no longer cover the fallout of cyber-attacks exchanged between nation-states. Many insurers are also imposing stricter safeguarding requirements, which although helping to support increased levels of cyber security defences, this can also leave some organisations and especially SMB’s exposed, as they are less able to meet the new minimum threshold limits.

This makes knowing exactly what is covered in any policy you have today, or are contemplating purchasing in the future, a business and technology imperative. Companies should know that cyber insurance policies and ransomware protection warranties do not cover every aspect of attacks and in most cases, there will be varying triggers, limits, conditions and coverages for different types of claims which can lead to denial or a reduced claim, creating an expectation and actualisation gap. Education and awareness here is key – you must be fully aware of what is not covered by your cyber insurance today, to avoid any surprises later.  Roy May does a great job of covering exactly this point.

Let’s explore some of the key issues in turn to support exactly that.

• Third-Party Mistakes: Cyber insurance companies do not cover you if a cyber-attack takes place on any third-party system causing damage to your primary business. This third-party software or services can be your web hosting, email, cloud services, customer service management or any other significant online business relationship.
• Losses Incurred During ‘Waiting Period’: The insurance world often has a time-based deductible referred to as a “waiting period.” Only the losses that incur after the completion of the waiting duration are covered by insurance. This waiting period is usually around 10 to 12 hours. It means that if your network undergoes a cyberattack during the waiting period, you will not be able to claim money from your insurance.
• Loss During Downtime: Losses incurred during the business interruption event are not covered by major policies. The downtime can cause harm to your business in many ways leading to loss of productivity and customers trust, loyalty and ultimately their business. No matter how much sales loss this downtime costs you, it will not be covered.
• Reputation Damage: This is one of the most significant risks a company faces if a cyber-attack or data breach happens. Indeed, 1 in 3 customers are willing to leave a brand they love after just one bad experience, rising to over 90% after 2 or 3 poor experience interactions. (ADD CITE). Any attacks during special events like Cyber Mondays can do even more harm to the organization. As it is difficult to quantify such loss, cyber insurance companies do not cover them in their policy.
• Bodily Injury or Property Damage: Cyber-attacks have tangible consequences. As the world moves towards IoT (Internet of everything), the connections between objects are increasing, and there are chances that it may lead to bodily injury or property damage. It can sound unusual but many production firms are nowadays running entirely on computers.

Everything right from collecting raw materials to shipping the final products happens through automated systems. In the scenario of a cyberattack taking place during any part of this process, it would lead to a catastrophe. If any company ends up in any such situation, cyber insurance will likely not cover the (extent of) the need.

• New Hardware: Usually cyber insurance policy will not cover any property damage like hardware replacement and other equipment caused due to a cyber-attack. It becomes problematic when the hardware is corrupted to such an extent that it is impossible to fix it. The best way in such cases is to replace the hardware with something new, but the organization itself will have to pay for this.
• Software Upgrades: The latest versions of the software are traditionally not covered by cyber insurance policies. In case of a cyber-attack, major cyber insurances will only help you restore the software to where it was before the attack took place.
• Lost Equipment: Most cyber insurance policies do not cover any cybercrime that originated from a lost portable device like a company laptop or tablet. Few insurance policies include only encrypted devices in their policy, so all the devices used in the organization must have appropriate security patches.
• Card Issuer Fines and Penalties: A key concern when dealing with a data breach is related to the penalties and potential fines imposed against a company by card issuers like MasterCard, Visa, etc, or indeed imposed against company directors under GDPR and similar regulations. These fines or penalties can reach a substantial amount of up to six figures. A few insurance companies exclude covering these types of fines which could lead to severe financial loss.
• Specialised Attacks: Many insurance policies cover only the attacks that are committed by cybercriminals that seek personal profits, or collective profits when bad actors collaborate together for shared gain. They deny the coverage if the attack is carried out with a motive of terrorism or by a nation-state actor for political ends, an area where research shows increasing scale and volume of attacks to evade detection (Microsoft 2021)

Final Thoughts – So, Is Cyber Insurance Worth It?

The resiliency of a business is tied to its cyber resilience, making a sustained and organisation wide focus on cybersecurity critical, right across technology, process, culture and skills. As part of this, cyber insurance plays a role in protection by necessitating advances in security by design within increasingly stringent terms – and by supporting organisational recovery in the event of a breach when all such obligations were fulfilled. But not all cyber insurance policies are made equal, with material differences in coverage and conditions. So you must fully understand both your requirements and your obligations before making a final decision.   

Start-ups and SMB’s having small portfolios or minimal digital assets might not be able to justify the expense of cybersecurity insurance, with a better return on investment likely achieved by focusing on security defence, for example Zero Trust practices and employee training and awareness. For large enterprises managing a significant volume of sensitive financial information or PII for their customers, then investment in a reputed cyber insurance policy can be well justified – but only as part of a holistic cybersecurity strategy. No policy will prevent nor spontaneously solve issues related to security but rather, they can form the final piece in a proactive defence program that focuses on both early identification of risks, and expedient recovery when (not if) an attack of some form inevitably occurs.

About the Author

Dr. Sally Eaves is the Chair for Global Cyber Trust at leading Think Tank GFCYBER and Digital Decentralization, Democracy and Security Advisor for the Centre for a New American Security (CNAS) reporting to the United States Government. A highly experienced Chief Technology Officer by background, Professor in Advanced Technologies, and a Global Strategic Advisor on Digital Transformation, Sally specialises in the application of emergent technologies, notably AI, Security, 5G, Cloud and IoT disciplines, for Business and IT transformation, alongside enabling Social Impact at scale.

An international Keynote Speaker and Author, Sally was the inaugural recipient of the Frontier Technology and Social Impact award, presented at the United Nations, and has been described as the “torchbearer for ethical tech”, founding Aspirational Futures to enhance inclusion, diversity, equity and belonging in the technology space and beyond.

What is ransomware? How to protect and recover from it.

Time accelerates in a ransomware attack

A ransomware attack is a classic example of a ticking clock. Your critical business data has suddenly been taken hostage. Hackers have used advanced encryption to render it inaccessible — and now they are demanding money to decrypt it. How will you respond? Can you ensure the safety of your data if you refuse to pay — or even if you do? While you consider your options, your organization remains paralyzed. Every passing minute increases the pressure to make the right choice.

This scenario has already struck companies of all sizes across industries worldwide. Yours could be next. Are you ready?

In this blog, we will examine: 

What is ransomware protection?

The cyber threat landscape, including ransomware, has transitioned to a case of “when,” not “if.” To ensure you can recover your data, you need the right solution with the best technology, the right people, and processes.

By 2031, it is anticipated that ransomware attacks against businesses will occur every 2 seconds, up from every 11 seconds in 2021.¹

Organizations require tools (such as anomaly detection, immutable backups, air gap, and multi-factor authentication (MFA) controls) to continually measure and protect their recovery readiness state. They do this to expose and remediate problems, validate their data and business applications’ recoverability, and improve their security to reduce their risk profile. In the event of a successful attack, fast restores are required to resume business operations quickly.

A recovery solution is only viable if it is resilient across various failure modes. One scenario may be a data recovery event to revert to the prior instances before the corruption. At the same time, another may require complete recovery of the business applications to a new location. Designing recoverability across environments and providing simplified automation to test and validate each scenario helps build the recovery readiness state. Knowing the mission-critical data and applications were already validated for recovery by an automated process completes the needed security, compliance, and comfort level. Learn more with this eBook: Ransomware 101.

What is a ransomware attack? 

Gartner defines ransomware as “cyber extortion that occurs when malicious software infiltrates computer systems and encrypts data, holding it hostage until the victim pays a ransom.”²   

There’s a reason ransomware makes the headlines. It’s the kind of attack that gets attention — it’s sudden, brutal, and leaves the victim feeling helpless. In recent years, the rapid rise of ransomware has cast a shadow of anxiety across organizations. Alarmed businesses, IT, and security leaders aren’t just being paranoid. In the third quarter of 2021, there was a 36.8% increase in ransomware attacks.³

What are the types of ransomware?

It is easy to assume that all ransomware is similar, and it is not uncommon to think that one size fits all in terms of prevention and preparation. However, because each ransomware type is usually developed to attack different, specific networks, they can be very dissimilar in how they work. It is essential to understand the different types currently being used (keeping in mind that it is also possible to combine multiple types of ransomware). Suppose your organization is attacked, and you do not have a plan to defend against the different types of ransomware. In that case, the likelihood is that the attack will significantly impact your company.

Here are six types of ransomware: 

• CryptoWall – is responsible for a high percentage of ransomware attacks. Typically, CryptoWall attacks its target through phishing emails. The WannaCry ransomware virus is a derivative of the Crypto family and was at the core of the largest cyberattacks ever perpetrated. Unfortunately, the creators of CryptoWall continue to release new versions designed to get around security protections.
• Locky – as the name implies, is what it does (locks you out of files and replaces the files with the extension .lockey). However, its name misses the most damaging part of this type of ransomware – its speed. Locky has the distinction of spreading to other files throughout the network faster than different ransomware strains.
• Crysis – takes data attacks to a new level – actually kidnapping your data and moving it to a new virtual location. The significance of this aspect of the attack is that it qualifies as a breach if your company works with personal data; organizations must contact anyone who may have information on your network to stay in compliance with local, state, and federal guidelines.
• Samsan – attacks unpatched WildFly application servers in the internet-facing portion of their network. Once inside the network, the ransomware looks for other systems to attack. 
• Cerber – attacks the database server processes to gain access instead of going straight after the files. Its creators sell the ransomware software to criminals for a portion of the ransom collected, i.e., Ransomware-as-a-Service.
• Maze – is a variant of ransomware representing the trend in what is called “leakware.”  After data is encrypted, bad actors threaten to leak ransomed private data on the dark web unless the ransom is paid.

Ransomware prevention and knowledge must stay at the forefront of organizations’ security efforts. Unfortunately, since hackers continuously become more sophisticated in encrypting data and developing new ransomware, you must continually monitor those developments.

Who are these bad actors? 

External malicious actors are, in simple terms, villains. They are hackers or other individuals seeking to infiltrate your organization for their nefarious purposes.

• Greed. Making money is a substantial motivating factor. For example, cryptojacking has become a popular method of stealing compute resources within an organization for mining cryptocurrency.
• Political. Malicious actors may be motivated by political reasons, including using ransomware to fund terrorism.  
• Competitive. Some bad actors may want to delete data, leak data, or disrupt business services.

Whatever their intention, they often use password spraying techniques to gain unauthorized access into an organization or system. Or they might try to exploit vulnerabilities, inject botnets, and rootkits to steal and delete data or disrupt an organization’s ability to function.

That is where ransomware comes in. In a typical attack, the hacker uses malicious software (malware) to encrypt your data, often delivered via an infected attachment or link in an email. As in a flesh-and-blood ransom situation, the hacker then demands payment — or you’ll never see your data again! Without an effective recovery strategy, you may think your only option is to pay the ransom and hope for the best.

How does ransomware spread?

Ransomware is often spread through email phishing messages that contain malicious links or through drive-by downloading. Drive-by downloading happens when a user unintentionally visits a contaminated site, and malware is downloaded onto the user’s computer or mobile device. A drive-by download usually exploits a browser, application, or operating system that is out of date or has a security flaw. Ransomware then uses these vulnerabilities to find other systems in which to spread.

10 tips to minimize ransomware exposure 

The goal is to reduce risks and minimize the effects of ransomware. Ransomware mitigation requires a combination of best practices and constant vigilance, along with a layered security approach. Steps to minimise ransomware include:

1. Plan, plan, and more planning for ransomware protection and recovery: plan for the worst and hope you never have to use it. It is paramount to have a multi-layer security strategy and remember that recovery readiness is critical. 
2. Employees are critical to a good defense; conduct employee security training: Educate employees on avoiding ransomware and detecting phishing campaigns, suspicious websites, and other scams. Despite their best intentions, employees are still a leading cause of malware.
3. Ensure patches are up-to-date and stay current: keep software, firmware, and applications up-to-date to reduce the risk of ransomware exploiting common vulnerabilities. 
4. Install anti-virus and anti-malware protection: use anti-virus software with active monitoring designed to thwart advanced malware attacks.
5. Implement multi-factor authentication: the process of authentication requires each user to have a unique set of criteria for gaining access. Enabling multi-factor authentication (MFA) methods makes it highly unlikely that a valid user account can be impersonated.
6. Segment your networks to prevent lateral movements: if a cyberattack is successful, don’t give them unlimited access within your network. Divide your network into smaller segments to prevent lateral movement and to contain the damage. 
7. Know your data to safeguard your data: identify business-critical data and sensitive data across your environment. Then determine if the data are exposed to vulnerabilities. Using data insights, you can efficiently remediate these risks by removing, moving, or securing this exposed data to reduce the chances of costly breaches and ransomware attacks.
8. Perform regular backups: employ a backup and recovery solution that offers a multi-layer framework for protecting, monitoring, and recovering from threats. The solution needs to support a 3-2-1 backup strategy for rapid recovery and secure cloud copies for added protection. 3-2-1 is 3 copies of your data, on 2 different media types, with a copy off-site and preferably air-gapped. 
9. Test, test, and test: once you have your plan in place, along with the procedures and technologies to execute it, make sure it’s going to work as needed. Perform frequent tests to verify that you can meet the SLAs you’ve defined for critical and high-priority data and applications.
10. Enable the Security Health Assessment Dashboard (if you are a Commvault customer): utilize the Security Health Assessment Dashboard to identify, assess, mitigate, and monitor security controls within the Commvault data protection environment.

Ransomware prevention does not have to be complex.  With the proper preparation starting with creating a plan, constant monitoring, and a robust backup and recovery solution, you can mitigate the risk of ransomware. 

How to get rid of ransomware?  

When ransomware does occur, the best approach is to have a validated copy of your backup data restored quickly to resume business operations. Organizations need a layered security approach encompassing multiple security tools, resources, controls, best practices, and strategies for a trusted and protected backup data copy. These security controls are applied within and around the data protection infrastructure to ensure the backup data is secured and recoverable. These steps provide the confidence that when an attack does occur, your backup data is protected and ready.

What are the risks of paying the ransom? 

Paying a ransom is a highly debated topic, and only you can decide what is best for your organization. Factors to consider:

• Many government security services recommend not paying, and in some countries, it may be illegal to pay the ransomware. For example, in the United States, the US Department of the Treasury has issued an advisory on the sanctions associated with making ransomware payments.⁴
• The kits for ransomware as a Service often fund organized crime.
• Will the bad actors provide the keys to get your files back? Will it leave malware behind to strike again? It is easy to assume that all ransomware is similar, and it is not uncommon to think that one size fits all in terms of prevention and preparation.
• If leak-ware is involved, General Data Protection Regulation (GDPR) considers it a data breach once discovered, and you have 72 hours to devise a plan and report it.
• Do you become a future target for your willingness to pay?

Remember, even if you pay the ransom, there is no guarantee that you will recover all of your data. 35% of data remains encrypted after the ransom was paid.⁵. And even with the encryption keys, it may take several days, weeks, and even months to restore it all. 

How Commvault fights ransomware

Commvault data protection and recovery can be a valuable part of your anti-ransomware strategy. Commvault multi-layered security is built on Zero Trust Principles and based on the National Institute of Standards and Technology (NIST) cybersecurity framework to protect data and recover quickly in the event of a ransomware attack. Commvault helps protect and isolate your data, provides proactive monitoring and alerts, and enables fast restores. Advanced technologies powered by artificial intelligence and machine learning, including honeypots, make it possible to detect and provide alerts on potential attacks as they happen so you can respond quickly. By keeping your backups out of danger and making it possible to restore them within your Service Level Agreements, you can minimize the impact of even a successful ransomware attack so you can get back to business right away (and avoid paying expensive ransoms).

Protecting and isolating your backup copies is critical to data integrity and security. Therefore, Commvault has taken an agnostic approach to immutability. With Commvault, you do not need special hardware or cloud storage accounts to lock backup data against ransomware threats. If you happen to have Write-Once, Read Many (WORM), object lock, or snapshot supported hardware (which Commvault fully supports), you can still use Commvault’s built-in locking capabilities to complement and layer on top of existing security controls. Having the ability to layer security controls across different infrastructure types sets Commvault immutable solution ahead of its competitors. Learn more about Commvault Cloud Cyber Resilience.

Commvault’s security protection layers

With every environment having a mix of different infrastructures, securing backup data against random unauthorized changes can seem challenging. Just like securing your house, you need to identify the risks and enable the protection and monitoring capabilities to match your needs.

Many experts recommend having a layered anti-malware and ransomware strategy. Commvault has built these security capabilities into our data protection software and policies without the incremental management overhead. Commvault data protection and management platform includes five security layers:

• Identify and mitigate risks to backup data within a single interface
• Protect by applying security controls based on industry-leading standards
• Monitor for ransomware, insider threats, and other threats
• Respond and take action on threats and continuously validate backup data
• Recover data quickly across multiple on-premises, cloud, and hybrid environments

Commvault multi-layered security consists of feature sets, guidelines, and best practices to manage cybersecurity risk and ensure readily available data. It is essential to understand that these capabilities are part of Commvault’s core platform experience, Commvault Complete™ Data Protection. There is no special licensing, additional costs, or required hardware or software. The layered security depth is enhanced through greater integration with Metallic™ and Commvault Grid for those customers seeking the simplicity of Backup as a Service or a data protection appliance, respectively.     

Opportunity and risk— that’s the reality for businesses today and the people responsible for the data. A single ransomware event can threaten the bottom line or define a career. So how do you prepare? By making sure you are recovery ready. Learn more at https://www.commvault.com/use-cases/ransomware-and-cyber-defense.

Footnotes

1 CYBERSECURITY VENTURES, Global Ransomware Damage Costs Predicted to Exceed $265 Billion by 2031, David, Braue, June 3, 2021.

2 Gartner, 6 Ways to Defend Against a Ransomware Attack, by Manasi Sakpal, November 16, 2020.

3 Digital Shadows_, Ransomware Q4 Overview, Ivan Righi, January 19, 2022.

4 Department of the Treasury, Advisory on Potential Sanctions Risk for Facilitating Ransomware Payments, October 1, 2020.https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20201001

5 SOPHOS, The State of Ransomware 2021, 4-19-21.

From hospitals, schools, state governments to Halloween candy, ransomware has disrupted our lives when we thought it couldn’t get worse. Organizations are driven to reevaluate their security posture and define processes and controls to ensure systems and data remain secure and resilient against ransomware. As environments expand to hybrid and integrate into the cloud, the attack vectors multiply. A systematic approach is the best way to reduce the complexity of protecting against ransomware, focusing on real-time data monitoring.

To help organizations minimize their security risk, Commvault offers the Security Health Assessment Dashboard to identify and mitigate risks within the Commvault data protection and management environment. The Security Health Assessment Dashboard is a single pane of glass built on industry-leading risk management frameworks and Zero Trust Principles. It helps organizations manage and secure their data by reducing the attack surface while strengthening their security posture. Most importantly, organizations can focus on correcting gaps to reduce their ransomware risk.

What is Commvault Security Health Assessment Dashboard?

Commvault Security Health Assessment Dashboard is available within the Commvault Command Center™ health report to all existing customers on Feature Release 11.20 and above. A cloud version is also available to organizations that track CommCell health in the Commvault cloud. As changes are made to security controls, they are reflected daily on the health report to provide continuous monitoring.

You can view the Command Center dashboard’s health report and find the Security Assessment tile, Figure 1. You can click on the Security Dashboard tile if you want more details.

Viewing and implementing security measures

The Security Health Assessment Dashboard allows organizations to Identify, Assess, Mitigate, and Monitor security controls within the Commvault data protection environment, Figure 2. By design, the dashboard will identify available controls in the Commvault CommCell and provide scoring and remarks to allow organizations to assess the risk properly and continuously monitor security posture. Not every control fits all organizations. For example, some organizations may use external identity providers with built-in multi-factor controls and password complexity logic. While others may rely on local Commvault accounts to segment access from their primary environment. Either way, the dashboard will provide insights to take the appropriate actions.

To mitigate risks, follow the action items for the specific control. Actions include targeted documentation, more in-depth reports, workflows, and software store applications and tools. Applying solutions is simplified and streamlined to minimize jumping between the interface windows.

Also, the Security Health Assessment Dashboard provides continuous awareness when any locks, alerts, and controls are not applied or disabled. This includes any new feature sets that become available in the future that Commvault may recommend.

For more details on using the report and taking action, refer to the Security Assessment Report in Commvault Books Online.

Improve your security posture today

Commvault Security Health Assessment Dashboard is the starting point for an improved security posture within the Commvault data protection and management environment. With its single pane of glass, the ability to automatically provide insights and best practices, and intuitive interactive actions – the dashboard helps take the complexity of implementing and managing security and simplifies it. To see the dashboard in action, view Commvault video “You are in control: Securing your data management environment with Commvault.