5 ms·

> A representative of the REvil ransomware gang said in a March interview that the group specifically targets victims known to have cyber-insurance, because the

• raverbashing 5y ago
  Not surprising. Having insurance just means you're a more attractive target now.
  • oneplane 5y ago
    And if the interviews on infosec podcasts are any indication, insurance also means complacency on a management level because "we have insurance", and the insurers don't require you to actually make your security better. So being cyber-insured: - likely to have money to pay the ransom - probably not really implementing strong security policies - management more important than reality, so engineering buy-in unlikely which also means backups and redundancies unlikely to be effective at the target This makes you wonder who ends up paying for all of this (with time, energy, money, mental health).
    • malka 5y ago
      > This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). > the insurers don't require you to actually make your security better Dumb insurers it seems. Money going from dumb actor to smarter actors. This is capitalism.
    • mschuster91 5y ago
      > This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). The employees who are force-fed "security" crapware that some clueless CTO or other high level manager got sold at a golfing course (or got bribed to do such as Netskope did, see https://news.ycombinator.com/item?id=27047474 https://news.ycombinator.com/item?id=27047474), evaluated it on the specsheet as "fulfills the requirement of the insurance" and passed the can of turds down the line, for one.
    • vkou 5y ago
      > This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). With money? The cost gets passed on to the customers. In a few decades, the invisible hand of the market might push those customers to firms taking this issue seriously... But I think that to be quite unlikely.
    • curryst 5y ago
      I think there's a net benefit to both sides here. The insurers probably charge a lot, in part because the risk is so hard to estimate and changes constantly with changes as well as new CVEs. I doubt they're losing money. The insured company gets benefits in terms of opex instead of capex, but more importantly, gets the expertise of the insurer in dealing with the situation. In that interview, the hacker also talks about liking working with insurance companies because they understand how this situation works. They don't try to negotiate down to 10%; there's an understood negotiation window. They know how to get the bitcoins and send them, and probably know how to do bookkeeping for all of that. I think it's closer to ransom insurance. The insurance company paying the ransom is a benefit, but not the primary reason to pay them. You pay them because they know what to do in that situation, and paying for ransom insurance looks slightly less ridiculous than paying a retainer to a Hostage Rescue Team. Most of the ransoms for hacks I've seen seemed well within the ability of the victim to pay. It's more about the negotiator that comes along with it, the bookkeeping, ensuring you get proof, ensuring they actually follow through, etc, etc.
      • oneplane 5y ago
        That's a perspective I probably heard before but completely forgot about. Nice summary! I suppose having an efficient resolution to any 'problem' would be a net benefit for all parties involved, even if we would think all sorts of negative thoughts about it from a technical perspective. The same goes for botched negotiations or indeed people who don't even know how to deal with cryptocurrency. It does make me wonder when thinking about hostage negotiations if that parallel insurance concept has different requirements on the company in question. Say you ship expensive employees to a facility in a country where they are likely to be captured for ransom, you'd expect some training for the employees to deal with 'being held hostage', or 'reducing the likelyhood of being taken'. If that is the case, something similar would be sensible in the ransomware scenario, right?
  • curiousgal 5y ago
    A modern manifestation of moral hazard lol
  • at-fates-hands 5y ago
    How would one go about finding out if a company has cyber insurance?
    • klyrs 5y ago
      Phish the insurance company for a list of customers?
      • g_p 5y ago
        https://www.scmagazine.com/home/security-news/ransomware/policyholders-may-be-the-primary-target-in-hack-of-cyber-insurance-provider-cna/ https://www.scmagazine.com/home/security-news/ransomware/pol... By targeting the insurers themselves (their cyber isn't magically better....), and getting a customer list.
  • SpinsInCircles 5y ago
    I wonder if it would make sense that the insurance policy offers a bounty on the hackers after the ransom has been paid. It makes your clients less attractive to attack and might in the long term lower your underwriting costs.
  • deleted 5y ago
    [deleted]
  • g_p 5y ago
    And insurers themselves are good targets, as they give you a validation list of covered businesses to go after, as they're likely to pay out...