The conditioning of the reimbursement of a ransom on the filing of a complaint has obviously not convinced French computer security professionals. The measure, provided for by an article of the orientation and programming bill of the Ministry of the Interior, which will be studied in public session in the Senate from October 11, is rejected by the members of the Club of Security Experts information and digital technology (CESIN).
In an internal survey unveiled on September 26, the association indicates that 82% of the 249 respondents, mainly employees of medium-sized and large companies, are against this new regulatory provision. They are only about 9% to be in favor, for as many undecided.
Increased risks?
As CESIN points out, computer security professionals fear the impact of this reform. Thus, the association is concerned about “the pressure that insurers could exert on their customers to pay the ransom if it turns out to be lower than the costs of remediation”. Likewise, it points to the increased risks for companies that would be cataloged as a good payer by cybercriminals. Finally, she fears a development of “unscrupulous intermediaries to negotiate with criminals”.
Accused of encouraging a vicious circle, the reform planned by the government must clarify the legal framework for cyber risk insurance. Insurers were already offering guarantees relating to the payment of a ransom. But they had called for a reform explicitly specifying things, a request following in particular the concerns of the cyberprocureure of Paris, Johanna Brousse, and the director general of Anssi, Guillaume Poupard.
Increase in cyber insurance rates
But not sure, however, that this is enough to give the hoped-for boost to the cyber insurance market. “Given the inflation of insurance premiums and the reduction in coverage, the trend is towards questioning, even disengagement with regard to the insurance system”, remarks the CESIN. If 69% of its members have taken out cyber insurance, they also deplore “a very sharp rise in prices, for a drop in coverage and levels of requirement, almost unattainable”.