Cybersec chiefs team up with insurers to say 'no' to ransomware bullies

The latest effort to reduce the number of ransom payments sent to cybercriminals in the UK involves the country's National Cyber Security Centre (NCSC) locking arms with insurance associations. Announced today by NCSC CEO Felicity Oswald at the annual CYBERUK conference, a new guidance book aims to prevent organizations from …

[Strong as Taishan Mountains]

The phenomena doesn't stop until insurers are banned from paying.

[Yorick Hunt]

"The phenomena doesn't stop until insurers are banned from paying offering ransom insurance."

Insurance companies are only too happy to not pay - it's the taking of premiums they won't be happy about being curtailed.

If they're merely prevented from paying out, the clueless customers will continue to pay their premiums and not bother with network security because in their minds they'll be covered. By banning the service altogether, customers will (one would hope) realise that they actually need to secure their networks, because "mummy won't come in to make it all go away."

[druck]

The phenomena doesn't stop until insurers crytpo are is banned from to prevent paying.

FTFY

[Kev99]

I wonder how many companies have off site backups of their data? Where I used to work, we not only made three backups every night, but also had a contract for a disaster recovery site to be set up within 24 hours.

[katrinab]

Probably most, but how many have on-site backups?

But the problem is that the backups tend to also be encrypted by the time the ransomware reveals itself.

[sitta_europea]

"... the problem is that the backups tend to also be encrypted by the time the ransomware reveals itself."

If whatever they're calling a backup got encrypted at around the same time that the original did, then that wasn't what I'd call a backup. Think of whatever it is as potentially a convenience, but it's really nothing more than that.

What I'd call a backup will withstand a tactical nuclear weapon.

It's offline. It's remote. And there are three of them, in widely separated geographical locations.

My rule of thumb is a mile, but for my own use it's at least three miles. Far enough away to withstand the nuke, but close enough that I can go fetch it on my bicycle next morning.

In forty years of making daily backups I've had to resort to recovering from one of them just a few times -- like last year, when in a commendable first after getting back from a skiing holiday my business partner forgot to do February before she did March -- although I've never actually had to get on the bike to fetch one of the remote backups. :)

[Reiki Shangle]

Barn door policies

I guess I sit in the company of only a few, to harbour the view that there must be a hell of a lot of horse roaming outside those damn barns, and it must be a profitable business for someone or some group solely for the lack of concern or understanding of risk, and budgets that are rarely concerned with risk because it often evades having a specific value.

But what do I know. (Opens browser to check if insurance company will offer discounts based on my security systems and processes, backups, and staff training.)