There is no question that ransomware attacks are becoming increasingly prevalent. In fact, some have proposed that 2017 is the Year of Ransomware. The WannaCry attack led to the infection of more than 230,000 computers and more recently, the Petya outbreak on June 27, 2017 led to a second global spread of ransomware. While traditional methods of data protection are essential, they are not sufficient.
Traditional data protection strategies have centered around the three foundational components of IT: people, process and technology. Data protection with people begins with education and a continuous focus on making employees aware of the most recent threats in the industry. While this is critical, it is impossible to achieve full organizational protection in this way. It only takes one weak link, or one unknown threat, before the data is compromised. Focusing on process is also essential. As many have pointed out, recent ransomware attacks would have been mitigated if patches had been applied on a timely basis. And finally, traditional data protection employs technology for network and endpoint protection such as firewalls and anti-virus. All these protections are essential and should not be ignored. Clearly however, they are not sufficient as evidenced by the explosive growth of cyber insurance.
Cyber insurance is not entirely new, but it has been growing (unsurprisingly) at a similar pace with malware and ransomware. In 2015, PwC set the cyber insurance market at $2.5B with a projected market size of $7.5B in 2020. Allied Market Research has cyber insurance premiums hitting $14B by 2022 — an impressive 28% compound annual growth rate. No matter how significant the cyber insurance market growth, recent incidents have proven that the adverse effect of malware on government agencies, and businesses have made this a board-level topic with a demand for better protection. Costs of ransomware are not just connected with the ransom demand itself, but tangible internal costs such as incident response, forensics, call center increases, legal engagement and public relations. External costs and insurance coverage are associated with the liability of failing to keep the data secure.
However, there is another fundamental insurance component that many have ignored — data backup with air-gapped protection. In fact, the very first recommendation, ‘Ransomware Prevention and Response for CEOs’ that is provided by the US FBI is to ensure that critical data is backed up and stored offline, and that restoration of this data is regularly validated. Here at Veeam, we agree with this principle. In fact, backup and validation of data restore is the cyber insurance that provides the most immediate and tangible benefit to the enterprise when compromised. Our customers have recognized the value of this insurance and we now have 250,000 customers (and growing) that are leveraging these capabilities.
With proper technology and process in place, RTOs can be minimized for critical systems, with the added benefit of leveraging the data to set up virtual labs where forensics can be applied to the incident. This insurance not only provides Availability for the business, but confidence for the board that they are better prepared.
A second, real and tangible benefit is that employing a viable Availability solution can reduce the cyber insurance premiums that are paid by the enterprise. While annual costs for cyber insurance ranges from $1,000s to $100,000+ depending on the revenues, industry and company size, one of the factors that determines the premiums are the existing protections that are implemented. Leveraging solutions such as Veeam can potentially reduce the costs (and premiums) associated with first-party coverage.
While we see no abatement in the immediate future for malware and ransomware, Veeam can help your organization implement data insurance through backups with offline storage and regular validation of restore. This data protection is essential to not only provide the executive team and board with confidence that they are better prepared for this new business environment, but it also provides confidence for the industry and your end users that their digital life is protected and always available.
Having a data protection insurance policy — inclusive of a cyber insurance plan and an Availability solution in place — is smart business when planning for the future.