Modern Insurance Magazine Issue 65

INTERVIEWS
CYBER PROTECTION
with Jim Steven,
CULTUREExperian UK
Modern Insurance Magazine
recently sat down with Jim
Steven, Head of Crisis and
Data Breach Response Services
at Experian UK, to discuss
adequate safeguards against
cyberthreat in business. How
should firms take logical steps
to mitigate cyber risk, and how
can they formulate or test their
data breach response plans in
the event of a serious attack?
Jim, why are ransomware attacks
Q increasing in frequency? And from your
experience, what general attitudes have you
seen towards this particular brand of
cyber-attack?
Ultimately, ransomware attacks are
A increasing because criminals have found
this to be a successful and lucrative commercial
venture. People pay, and because people pay
it becomes a very attractive model for criminal
gangs. If you actually look at what ransomware
does, it’s the deployment of one piece of
malware that generates an upfront payment in
a great deal of cases. Until people stop paying
out in the event of a ransomware attack, we’ll
see this activity continue to operate.
There’s got to be an understanding of the fact
that this type of activity isn’t going away.
There are a number of governments that say
business owners shouldn’t pay in the event
of a ransomware attack, but if you’re the
CEO of a £5million business and you suffer a
ransomware attack which promises to resolve
itself if you pay the ransom, you’re likely to
succumb to it. If you don’t pay, the alternative
could result in reputational damage, through
the press or through your share price. Your
investors might lose faith, your customers
might lose faith, you might lose revenue as a
consequence. If people are going to continue
to pay the ransom, and if CEOs and Boards of
Executives think that’s a viable choice and a
cost of doing business, there’s always going to
be a market.
We’re seeing this play out in cyber
insurance policies across the industry.
Bigger organisations are only insuring part
of their loss in the event of a ransomware
attack; there’s a lot of captives running at
the moment, and a lot of self-insurance.
There’s such a high deductible on so many
cyber policies, there’s already an attitude
within firms and organisations that alludes
to being prepared to pay out. Quite rightly,
organisations are looking at their own security
and data governance in order to mitigate
the risk of cyber-attacks. But there’s such
a breadth of low hanging fruit in terms of
how you can access a firm’s online systems,
particularly when there’s a third party
involved which might not have the same
levels of security. You can still fall foul to the
consequences of a ransomware attack even if
you’ve taken all of the necessary precautions,
and you may still be faced with the decision to
pay or not to pay.
As threats to data security grow in this
Q way, how can firms and organisations
take logical steps to mitigate the risk
further?
Whilst everyone focuses on better security,
A simple cultural changes can really reduce
the risk. Most organisations understand that
they’ve got to have some kind of security in
place, or at least some kind of layered approach
to protecting their data, but this doesn’t mean
“
In the last three or four years, firms have also
been offering cyber education to their workforce
en masse, mainly through introducing password
managers and simulated, fake phishing emails.
“
14 | MODERN INSURANCE