Despite the U.K. government’s position that organizations should not make ransomware payments, the Association of British Insurers (ABI) includes payments in first-party cyber-insurance policies.
When faced with a completely encrypted network environment, organizations need to quickly determine what their potential solutions are. And it’s pretty simple: either (quickly) recover the affected systems, applications, and data – or pay the ransom (and do some cleanup post-mortem).
Most everyone knows if you pay the ransom, it only adds fuel to the cybercriminal’s fire, with more ransomware attacks on the horizon. But some organizations rely on their cyber-insurance policy to cover the cost of paying the ransom.
The ABI was under some criticism because of their stance to cover ransoms, but ABI stands by their inclusion of ransom payments as part of their cyber-insurance policies. And before you shake your head, there are a few things to consider that come well-before paying of a ransom:
- Most cyber-insurance policies require quite a bit of proof that the insured organization has adequate protections in place to stop most attacks.
- Insurers often either have on staff or partner with ransomware response vendors to attempt to remediate the impacts of an attack.
- Paying the ransom remains a last resort – even for those organizations that have a policy in place.
- As long as it's legal, there are incentives to pay – the cost of remediation can be multiples of simply paying the ransom.
Whether you pay the ransom or are able to recover your way out of a ransomware attack, the best position is to avoid one entirely. Closing all RDP traffic (regardless of port used) is the first step. The second is to educate users with Security Awareness Training to they can spot phishing attacks designed to trick them into installing the ransomware on their endpoint.
Here's how it works:
