Modern businesses face an irreducibly complex threat landscape — and not necessarily because cybercriminals have grown more sophisticated or clever. While it’s certainly true that cybercrime has evolved in some troubling ways, for the most part, criminals tend towards the same tactics they always have. The problem is threefold. 

• A larger threat surface, owing to the proliferation of the Internet of Things, distributed work, and digital transformation. 
• A cybercrime “boom,” complete with criminal enterprises selling to other criminals (ie. ransomware-as-a-service and DDoS-as-a-service.) 
• A sharp increase in the volume and frequency of cyberattacks targeting businesses.

Amidst all this chaos, the most important thing to remember is that no matter what security measures your business takes, no matter how ironclad your security training or how comprehensive your access controls, not every attack can be prevented. In some cases, all you can really do is minimize the damage a hack can cause. Cyber insurance plays an important role in that. 

What Is Cyber Insurance? 

Known also as cyber liability insurance or cybersecurity insurance, cyber insurance effectively exists to protect your business in the event that it’s the victim of a cyberattack. In the same way that real-world disaster insurance might cover losses incurred as a result of inclement weather, cyber liability insurance helps shield an organization from some of the fiscal damage resulting from a data breach. 

Generally speaking, any business with sensitive digital assets would do well to purchase cyber liability insurance. If there’s one thing recent events have driven home, it’s that no organization is immune to attack. There is no such thing as being too small or insignificant a target, just as there’s no such thing as being too secure for hackers to bother.

An Unexpected Risk of Being Insured

As it turns out cyber insurance may carry an unexpected element of risk. Namely, some criminals now appear to be specifically targeting organizations that have purchased cyber insurance. In an episode of the podcast All Things Considered, IT professional James Turgal had this to say on the matter: 

“Some hackers scour IT systems to learn about the kind of insurance a company has…They will actually put up a piece of that cyber insurance policy to show you that, one, they’ve infiltrated your system and they have exfiltrated data but also to let you know they know about the cyber insurance.” 

Gura went on to note that another security consultant mentioned how, in some cases, hackers will ask for a ransom based on a business’s insurance policy — based on what the insurer says they’ll cover. 

Safeguarding Yourself Against Ransomware

It’s clever, certainly. And a little disconcerting, as well. The good news, however, is that defending against ransomware attacks of this nature is little different from protecting against any other. 

• Maintain multiple air-gapped backups. 
• Keep all software up to date. 
• Ensure you have a clear, active picture of what’s happening on your network. 
• Maintain a regularly-updated crisis response plan. 
• Know where your most crucial assets are, and take measures to protect them. 
• Train your employees in mindfulness, so they know how to recognize phishing scams and other common forms of attack.