Cyber Security Cooperative Research Centre (CSCRC) chief executive Rachael Falk and director of corporate affairs and policy Anne-Louise Brown have said that cyber insurance should not cover ransom or extortion payments.
In a policy paper focusing on how cyber insurance can hinder or help cyber security in Australia, authors Falk and Brown found that some cyber insurance policies explicitly offer coverage for extortion and ransom payments.
“This is problematic, serving to feed the criminal enterprise of ransomware gangs, especially those that prey on insured organisations,” they said – noting an incident overseas involving ransomware criminals who accessed systems to look for insurance certificates, then demanded ransom payment of the specific amount covered by the insurer.
Other ransomware criminals have also hinted at targeting insurers, with a representative from ransomware gang REvil telling a reporter that it aims to “hack the insurers first to get their customer base and work in a targeted way from there. And after you go through the list, hit the insurer themselves.”
The authors argued that cyber insurance should not be seen as an organisation cyber security strategy, nor should insurers be permitted to pay extortion payments – a trend that has not only fuelled the ransomware trade but also placed extraordinary pressure on the viability of the cyber insurance industry itself.
Therefore, the authors recommended:
