We have seen repeated news on new versions of ransomware, most recently one called WannaCrypt (also referred to as 'WannaCry') that has been making the rounds since this past Friday, impacting computers worldwide. This worm, code named EternalBlue, is a remote code execution attack taking advantage of a vulnerability in Windows.
As of the time of this posting, there are U.S.-based ransomware attacks from WannaCrypt, though the incidents are relatively low as compared to worldwide. THUS FAR.
The bottom line at this point is that all entities are strongly encouraged to update your operating systems. Microsoft had issued a patch on March 14 to cover this attack for systems such as Windows XP and Windows 7.
While this particular attack did not target Windows 10 users, each of us needs to stay focused on a Cyber Hygiene program.
Another point of encouragement is to upgrade older systems to newer, e.g. moving from Windows XP to Windows 10. Older systems are more vulnerable than newer systems, and administrators who are trying to save on costs by not moving to newer systems will usually run greater risks of compromise.
Internal Protection Steps
Every organization should take the following steps to ensure their organization is adequately protected.
- Ensure Microsoft Operating Systems are up-to-date
- Stop using older version of Windows OS and servers
- Make sure any anti-virus software you have installed is up-to-date
- Train employees not to open or click on unknown emails and links
- Remind employees often about ransomware attacks
Educate Your Clients
In the same way, agents should educate your clients about the risks they face due to cyber-attacks like WannaCrypt. Cyber liability insurance is an important tool you can provide to your clients that will help them recover in the event of a cyber-attack. Agents & Brokers owe it to your clients to continually remind them of the increased risk they face due to cyber-security issues. Here are some suggestions:
- Make sure you understand the coverages available in a cyber liability product (or endorsement to an existing policy). Not all policies provide coverage for a ransomware type attack.
- Include a cyber liability quote (or indication) on every proposal for every size business.
- Everyone in the office cannot be a cyber liability expert. Designate one individual to be the point person for the organization.
- Mandate that clients sign a waiver if they choose not to purchase the coverage.
Here are links to articles on the WannaCrypt ransomware:
What is WannaCrypt & What is it Doing?
YouTube Video Describing the WannaCrypt Attack
Microsoft's Response to WannaCrypt
ACT will continue to focus on education and prevention resources in this area.
