Why DFIR Is Needed in Partnership With Cyber Insurance

Ransomware is the primary threat concern in cybersecurity. Ransomware is a simple, accessible cybercrime enterprise for bad actors to launch and operate, and it’s highly adaptive. For example, the bad actors behind ransomware variants, such as ClOp and LockBit, show lucrative sophistication in how they ratchet up extortion while offering to “settle the matter” of ransom payment in terms and tone usually seen in business negotiations. In 2022, the FBI’s Internet Crime Complaint Center (IC3), which collects reports of internet crime and assists victims in freezing money involved in cybercrime, reported a total of 2,385 ransomware victims.¹ The large number of reports primarily came from the healthcare, critical manufacturing, and government facilities industries.

Adding to the stress of ransomware’s business impact is its attackers’ inherently lingering, real-time nature. Unlike attacks that steal or expose sensitive data before vanishing and leaving those files intact, ransomware attacks thrust organizations into a stressful race against the clock. Administrators and incident responders must rapidly determine how many affected systems are ransomed, what type of malicious program is being used to hold files hostage, and if a company’s backup and recovery capabilities are able to quietly restore files and operations. DFIR underpins everything in a ransomware attack.

Business email compromise (BEC) ranks second as a threat concern, close behind ransomware. In a BEC attack, bad actors often send emails impersonating a legitimate source, such as a CEO, requesting information that ultimately leads to the bad actor conducting fraudulent money transfers. BEC attacks rely heavily on social engineering scams and phishing emails to trick unsuspecting employees. In 2022, the IC3 received a total of 21,832 BEC complaints, amounting to adjusted losses over $2.7 million.¹

When DFIR professionals respond to cybersecurity incidents such as ransomware or BEC, they shape the outcome by determining what happened, assessing the extent of damage, triaging what is known, and setting the pace for recovery.

A DFIR provider partners with clients to swiftly contain incidents and conclusively restore systems after an attack. These experts will be familiar with your organization and have an understanding of your network in the case of a cyber incident.

DFIR services exist to prevent a hall of mirrors from needlessly impeding response actions, execution of incident response plans, and support of crucial processes that affect insurance claims and other dependencies. Whether at the first subtle signs of suspicious network activity or during the rapid physical disruption of commerce, transportation, and healthcare, DFIR teams deploy at a moment’s notice to intercept attacks, save precious electronic evidence, perform damage control, and determine what is necessary for secure restoration. Importantly, the teams may have to do these steps simultaneously or in a very specific order to best serve a victim whose industry has norms on calling in law enforcement, notifying regulators, proving compliance to insurance, or sharing intelligence with peers.

It is no surprise that DFIR roles and relationships determine cyber insurance’s current stakes and foreseeable future. After all, forensics accounted for 53% of the average total crisis services costs of a cyber incident during the period from 2017-21, according to the NetDiligence 2022 Cyber Claims Study.² If a policyholder does not have sufficient DFIR experts and resources in place before an incident happens, it can easily end up paying more for remediation in the end — without the advantages these experts could have delivered along the way.

Between incidents, and particularly when insurance policies are being acquired and updated, Pondurance combines veteran DFIR insights with advisers’ eyes to proactively examine the postures and preparedness of clients.

Knowing your insurance policy coverage and limits before a cyber incident happens is crucial. Uncertainty can cost a great deal in response time and financial losses. While digital risks apply to nearly every facet of business today, insurance sold to cover common business risk does not always cover the cyber equivalents.

It is common for an organization to call in our team for urgent incident response. But because there may be confusion about coverage, the organization may not know until halfway through the engagement if its policy actually contains applicable cyber coverage. This is a classic example of why it is important for every organization’s cross-functional crisis response team with members representing the C-suite, operations, risk, legal, IT, and other departments to have a clear understanding of current insurance coverage before an incident occurs.

Cyber insurance is among the most important technology, legal, risk, and reputational decisions a cross-functional team of
senior leaders can make. Above all, leaders need advocates and partners making sure they have proper coverage in place and
are ready to respond at the first sign of trouble. Pondurance is that advocate and strategist for a wide set of clients in many
different industries but specializing in healthcare, manufacturing, education, retail, and government.

Whether you plan to acquire cyber insurance in the coming months, are looking for advice on competing policies, or are due for
renewing coverage, contact us to arrange a conversation about your objectives. Our team has the experience, data, and skills
necessary to maximize cyber insurance’s advantages.