Cyber insurance model is broken, consider banning ransomware payments, think tank suggests