10 ms·
Experts suggest AXA’s plan to shun ransomware payouts will set a precedent
- 1cvmask 6y agoAnd what about breaches where they have not implemented MFA?
- gruez 6y ago>A spokesperson for AXA XL [...] said the announcement doesn’t apply [...] to ransomware-related incident cleanup costs. So rather than paying the ransom, they'll hire a "ransomware cleanup" consultancy which cleans up the ransomware by paying the ransom (under the table and with plausible deniability, of course).
- waihtis 6y agoNot necessarily. A ransomware attack is just a subclass of your generic security breach, so the usual response & remediation activities apply. I would actually think covertly paying ransom costs being a highly unlikely activity.
- paxys 6y agoDo you have any proof of that (or even cases where that has happened before), or are you just making it up?
- nefitty 6y agoProven Data and Monstercloud in the US were found to have been doing that. https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/ https://features.propublica.org/ransomware/ransomware-attack...
- takeda 6y agoProof already was provided, but even without it's just common sense. If ransomware was implemented correctly (like using asymmetric cryptography for encryption). There's hardly anything you can do if you don't have backups.
- bluGill 6y agoI'm sure companies will backups could use qualified IT help if they suddenly need to restore all their computers from backups quickly. Even if the backups all work, there is a lot of effort to restore them.
- redisman 6y agoWhat else could these companies realistically do? All I can think of is restore from backups or break the encryption. First sounds like a job for IT and second impossible unless it’s been done completely incompetently
- oefrha 6y agoI read that certain ransomware distributors have been found to operate their own cleanup/“negotiation” service. Can’t be bothered to find a reference now, but this type of behavior is perfectly logical, and has been going on since forever in many traditional shady enterprises.
- deleted 6y ago[deleted]
- jeltz 6y agoSure, some will probably do that but then they will have committed insurance fraud.
- waihtis 6y agoThis is the right course of action. Always think about how your actions incentivize future behaviour. The only right course of action is to halt the flow of revenue to the attackers in order to disincentivize future attacks. This will not solve the problem of ransomware alone, but is a step in the right direction.
- jve 6y agoPut yourself in the shoes of business. Well, like the oil company now in USA. Lets say you haven't learn the lesson of backup importance. Your business has stopped. Your ONLY way to recover and restore revenue stream is to get the data. You are aware that paying ransom may or may NOT work. Now, what do you do? The suggestions (cut the attackers revenue stream) may sound very right, correct and whatnot. But think of the side that is held as hostage.
- hawk_ 6y agoBusinesses can't expect claims for theft insurance to be honored if they didn't take reasonable measures (install security cameras, alarms etc... and lock the valuables). How is this different?
- jve 6y agoAgree. Not arguing about not having insurance. Just saying that paying the ransom may be the only way out of trouble.
- mjevans 6y agoYou can't trust a compromised system. It has to be purged and rebuilt from the ground up. I really miss the days of write-enable jumpers for BIOSes...
- nobodyandproud 6y agoDid the business follow best security practices? Did it do its due diligence to harden against attacks? Why should insurers pay, when businesses have no incentive to do this?
- jasonhansel 6y ago> A representative of the REvil ransomware gang said in a March interview that the group specifically targets victims known to have cyber-insurance, because they’re “one of the tastiest morsels” who can more easily afford to pay. Wow.
- raverbashing 6y agoNot surprising. Having insurance just means you're a more attractive target now.
- oneplane 6y agoAnd if the interviews on infosec podcasts are any indication, insurance also means complacency on a management level because "we have insurance", and the insurers don't require you to actually make your security better. So being cyber-insured: - likely to have money to pay the ransom - probably not really implementing strong security policies - management more important than reality, so engineering buy-in unlikely which also means backups and redundancies unlikely to be effective at the target This makes you wonder who ends up paying for all of this (with time, energy, money, mental health).
- malka 6y ago> This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). > the insurers don't require you to actually make your security better Dumb insurers it seems. Money going from dumb actor to smarter actors. This is capitalism.
- mschuster91 6y ago> This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). The employees who are force-fed "security" crapware that some clueless CTO or other high level manager got sold at a golfing course (or got bribed to do such as Netskope did, see https://news.ycombinator.com/item?id=27047474 https://news.ycombinator.com/item?id=27047474), evaluated it on the specsheet as "fulfills the requirement of the insurance" and passed the can of turds down the line, for one.
- drunkenmagician 6y agoCall me cynical, but anytime an insurance company decides its in everyone's 'best interest', and by everyone I mean the policy holders, I cannot help but translate to mean - 'Its costing us more money that we expected, so we don't want to cover this'
- paxys 6y agoWell insurance companies account for this by raising premiums. In fact it sounds counterintuitive but something which happens often is more profitable for insurance companies because otherwise few people bother to take out policies for it. In this specific case, I imagine the reason for the announcement wasn't moral or financial – the company likely decided it did not want the legal liability of potentially funding international terrorism.
- hef19898 6y agoCase in point companies unwillingness to buy pandemic insurance before Covid hit. Maybe lucky for insurers, and obviously they refused to sell after.
- bassdropvroom 6y agoNot cynical at all. Insurance business is mostly predatory. If it doesn't make them money, they're not gonna cover it. Regardless, in this specific instance I'm all for it. This will hopefully wake enterprises up so that they invest in good IT practices, which will have lasting effect on other parts of IT within firms.
- jl6 6y agoThis isn’t predatory at all. This is a company creating a risk pool that is cheaper for organizations that believe they can self-manage ransomware risks. The ethical behaviour of an insurance company is completely orthogonal to what risks they choose to cover.
- mongol 6y agoPredatory in the same sense that most businesses are predatory. I.e exist to make a profit.
- Aissen 6y agoNote that this change in policy is probably ahead of a potential legislation by the government. Some industries do not like being regulated, and insurers are painfully aware of the impact of legislation. So this is more of a reaction than an initiative, but still kudos to them; it won't solve anything in the short term, but if it makes businesses invest more in clean security pratices, why not.
- RalfWausE 6y ago<not entirely serious> I think the best way to convice cybercriminals not to ransom companies would it, to just drop a small tactical nuke on the site of the criminals if they are ever discovered... that may not stop ALL, but the risk for any aspiring new cybercriminal would go steep uphill. </not entirely serious> I think the best way to stop this "business" would be to make it as costly as possible for the "bad boys"... the course of AXA may be hard on some of their customers, but in the end it may be better for the net-society at whole.
- steerablesafe 6y agoIf an insurance pays off ransomware attackers then it seems like an viable target for insurance fraud.
- Aeolun 6y agoCan’t we just disallow email messages from anyone that is not either in the organisation or messaged by a user before? No more ransomware, or at least not as easily.
- DavidPeiffer 6y agoThere are often classes of employees where external email is completely unnecessary. I know of one financial institution who has implemented this. It wouldn't work well for many employees though. For example, try signing up for a legitimate service and guessing what email address the confirmation link will be sent from.
- nefitty 6y agoIn a strict security environment, shouldn’t the employee request permission or, at the very least, give IT a heads up that they’re going to sign up for an external service? IT would vet the service and then apply the domains to the whitelist. I know how bad it sucks to have to ask permission for every little thing, but if the alternative means risking ransomware attacks, then the case should be laid out transparently to everyone in the org so they understand why the rule is in place.
- paxys 6y agoCutting off all communication with the outside world doesn't sounds like a good way to run a company..
- IG_Semmelweiss 6y agoI don't see this being true as hackers targetting. Cyber insurance is not generally public information. Moreover, there are different flavors of cyber insurance. Some of which cover ransom pay and some do not. Having knowledge at such a thing means only 1 thing: Someone in the hacker group has access to insider information. Only select people have access to such policies. Call me a skeptic but i would assume 1 of 100 such hacks don't actually know the cyber coverage that the target has. The ratio of 1:100 may be larger if you expanded the question to Hackers knowing which companies have Cyber coverage... but not which flavor. I still think this is a limited number anyway. AXA here is just taking the easy route out. A lot of unsuspecting customers (startups) will buy this and get surprised 10 years from now, because their CEO did not bother to read the fine print of a 30 page document. Lots of lawsuits in the horizon. Insurance is literally protecting yourself from long tail events. This is such a thing.
- arbuge 6y ago> Cyber insurance is not generally public information. It might not be required to be, but it might still be disclosed anyway for various reasons in public market filings, on investor calls, employees talking in social media, and so forth.
- abakker 6y agoI find it difficult to believe that CEOs and their advisors would not read insurance contracts. This may seem true, but any business with a corporate council and a team contemplating buying insurance is likely to take care to ensure that they contract for, and purchase, the product they intend to purchase.
- wjnc 6y agoWell, from the industry, re-insurance contracts aren't hard to read, but they are written in legal prose that's quite far from your average readers day to day reading. Let's say that in 50 pages of boiler plate only twenty items mark the exact risks covered. That's why most firms use brokers to translate the T&C to PowerPoint. Obviously important contracts get read and negotiated by teams. And then ten years and a few renewals pass, people move on and suddenly you've got a coverage on a historic part of your portfolio that nobody groks. We're all human.
- RcouF1uZ4gsC 6y ago"Millions for defense, but not a damned penny for tribute." - Charles Cotesworth Pinckney when asked for tribute by the Barbary Pirates Maybe we need to start treating ransonware attacks more like this. Spend money on hardening targets. Also pursue an policy of economic sanctions against countries that tolerate these types of activities in their borders. Maybe we need to make it possible to quarantine countries from the rest of the Internet who abuse the commons.
- TheEzEzz 6y agoCould we make paying a ransom in these settings illegal? That would guarantee that ransomware was no longer economically tenable.