Call us now:
Here in lies a problem for the insured, insurer and governments, being caught in the ransomware doom loop, or as one calls it damned if you do damned if you don’t loop. 99% of companies by number are SMEs, they are the companies least likely to spend on cybersecurity; least likely to afford the headcount to manage cybersecurity; least likely to afford cyber insurance and they are the suppliers to the remaining 1% of larger companies. They are also the most likely to go under in the event of a cyber attack. They are the least likely to be able to afford to pay a ransomware.
Cyber insurance is the most prominent risk transfer tool for SMEs to manage cyber risk and cyber insurance has provided a safety blanket. Banning the payment of ransomware by cyber insurers pushes the responsibility back on to SMEs to manage cyber risk, something that they are not prepared for.
There’s little doubt that the payment of ransomware needs to be addressed, but one has to consider the alternatives to paying a ransomware. Alternatives that requires companies to manage cyber risk themselves and not rely on insurance. Cyber risk management is moving Left of the incident, through cyber regulation. Regulation that forces the management of cyber risk on to the financial statements of covered entities, requiring covered firms demonstrate cybersecurity risk management. Not until companies carry more of cyber risk will banning ransomware payments be a realistic option. That requires governments to take a more active meaningful role in cybersecurity.
Lets not forget that cyber and ransomware attacks are a very profitable business, with low barriers to entry and high rewards.
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberlegal
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7251848628225339392