Cyber insurance model is broken, consider banning ransomware payments, says think tank

Cyber insurance isn't exactly driving organisations to improve their infosec practices, a think-tank has warned – and some insurers are thinking of giving up thanks to the impact of ransomware.

"To date, the shortcomings of cyber insurance mean that its impact is ultimately more limited than policymakers and businesses might hope," concluded the Royal United Services Institute's (RUSI) latest report, Cyber Insurance and the Cyber Security Challenge.

The wide-ranging report looked in detail at what impact the cyber insurance industry has had on the online security practices of the wider world. Unfortunately, RUSI's researchers found that insurers tend to sell cyber policies with minimal due diligence – and when the claims start rolling in, insurance company managers start looking at ways to escape an unprofitable line of business.

"I think, based on what we've found, cyber insurance is not that silver bullet that maybe people were hoping or thought it was," report co-author Jason Nurse, a senior Lecturer in cyber security at the University of Kent told The Register.

In a world beset by all-but-untouchable ransomware gangs, cyber insurance has two selling points as far as politicians and political policymakers are concerned: insurance could help limit the financial damage to organisations hit by ransomware, while due diligence by insurers and their brokers could help force relative slackers to adopt better security hygiene.

Nurse said cyber insurers vary quite widely in their pre-policy due diligence, with different firms asking for different proofs of security:

• International law enforcement op nukes Russian-language DoubleVPN service allegedly favoured by cybercriminals
• UK arm of international charity the Salvation Army hit by ransomware attack
• Fashion titan French Connection says 'FCUK' as REvil-linked ransomware makes off with data
• Sure looks like someone's pirating the REvil ransomware, tweaking the binary in a hex editor for their own crimes

The British government's view is that cyber insurance that pays ransoms to criminals is, as the National Cyber Security Centre put it last year, a matter for individual board members. Although The Register asked whether it would condemn the use of cyber insurance to pay ransoms, the GCHQ offshoot wouldn't be drawn.

RUSI's position on buying off criminals is unequivocal, with Nurse and co-authors Jamie MacColl and James Sullivan saying in their report that the UK's National Security Secretariat "should conduct an urgent policy review into the feasibility and suitability of banning ransom payments." It also recommended that cyber insurance policies should include mandatory notification clauses that activate "before a ransom is paid."

Why isn't cyber insurance working as a lever for driving up security standards?

According to Nurse, it's the age-old problem of a skills shortage – but on the insurance side of the fence.

"When it comes to internal assessments, and there's a very dynamic understanding of what's happening inside the organisation – that's not where many insurers are currently placed," he said.

"And I think even based on our own work, we found that in situations where brokers are not as upskilled as they could be, they can actually damage the relationship between companies and cyber insurers. Because, you know, when a broker goes to an organisation and tries to sell them insurance, the organisation potentially knows more than the broker about cyber security."

This problem has existed for a while, with insurers at France's Forum internationale de cybersecurite moaning early last year that their industry hadn't taken cybersecurity insurance seriously enough. During a discussion set in the context of squirmy insurance companies turning into their own stereotypes, trying to evade payouts at all cost, industry talking heads acknowledged that cyber insurers and brokers weren't fully equipped for the task of selling the product or assessing risk.

With an increasingly interventionist British government looking to pass laws tightly controlling cybersecurity behaviours, insurers and insured alike might want to smarten up their act – before the clunking fist of the state does it for them.

Source: The register