A framework for cyber-risk insurance against ransomware: A mixed-method approach

Hackers follow a standard cyber kill chain process and install ransomware payloads using phishing emails on firms belonging to critical industry, resulting in huge losses in revenue, reputation, and customer churn. This study uses a mixed-method explanatory approach to mitigate ransomware attacks. We present the quantitative Ransomware Risk Management Model (R2M2) based on protection motivation theory (PMT). The Ransomware Risk Assessment module based on the threat appraisal component of PMT and the National Institute of Standards and Technology (NIST) guidelines can help the chief information security officer (CISO) to assess the risk using predictive analytics techniques. The Ransomware Risk Quantification module uses collective risk modeling to compute the severity of a ransomware attack on an organization. The Ransomware Risk Mitigation module helps the CISO to minimize the probability and impact of a ransomware attack on their organization by (i) investing in perimeter security technologies and training to ensure prepare, deter, detect, restrain, recover, and review mitigation strategies, (ii) adopting the National Institue of Standards and Technology (NIST) Cybersecurity Framework to ensure business resilience, and (iii) mitigating the residual risk by investing in cyber-risk insurance. We validated the proposed method using a qualitative study by interviewing participants form firms affected by ransomware, managed security service providers, security consultants, and cyber-risk insurers.

Automated summary

Hackers use phishing emails to install ransomware on critical industry firms, causing significant losses in revenue, reputation, and customer churn. This study proposes a mixed-method explanatory approach to mitigate ransomware attacks and introduces the Ransomware Risk Management Model (R2M2) based on protection motivation theory (PMT). The model helps the CISO assess and quantify the risk of a ransomware attack using predictive analytics techniques and collective risk modeling. Additionally, it provides strategies to minimize the probability and impact of an attack through investments in security technologies, training, cybersecurity frameworks, and cyber-risk insurance.