Propel provides innovative insurance solutions to thousands of companies across the country. We make it our business to know your world inside and out.
Claims & Risk Management, Cyber Security, Insights
Cyber Liability Risk Management 101
With the number of commercial Cyber Liability claims starting to outpace auto and property claims, you may be wondering if your business needs Cyber coverage. Just one breach can hugely impact your company’s finances, reputation, and operations. Cyber Insurance policies can offer financial relief relating to pre- and post-breach response activities such as breach prevention, assessing the impact of events, and improving cybersecurity preparedness post-breach. However, there are some strategies you can implement on your own to strengthen your defense and response to a cyber attack:
- Documenting system or device types, operating systems and software that your company uses. To take it one step further, you can document what ports (physical docking points where other devices connect) and service systems you use for business functions. Monitoring these as a baseline can help determine where irregular activity outside of the organization may come from and provide insight into network vulnerabilities that a cyber attacker may try to exploit. This is especially important for businesses that have remote workers.
- Utilizing multi factor authentication (MFA) is another way to add a layer of security to your company’s network, making it harder for cyber criminals to access your systems. Credentials like user IDs and passwords are often the weakest link in your cybersecurity.
- Implementing security awareness training is very effective. You can work with your cyber insurer to send out regular cyber security training emails and videos, as well as send out test phishing emails and encourage your employees to try to detect them. This helps to engage your workforce in participating in the detection of network abnormalities.
- Backing up your data is crucial since data on your network can include Personally Identifiable Information (PII), Payment Card Information (PCI), and Protected Health Information (PHI). Experts highly encourage following the “3-2-1 rule”. Keep 3 copies of any important file: 1 primary and 2 backups. Keep the files on 2 different media types to protect against different hazards. Store 1 copy offsite. Following this will give you an advantage over a cyber criminal in the event of an attack.
- Using an endpoint detection software is an important supplement to antivirus software. Endpoint security systems protect the network and cloud from cybersecurity threats that may enter through desktops, laptops, and mobile devices.
- Developing a system for monitoring and documenting your company’s normal business operations and processes creates visibility when it comes to detecting programs or processes that fall outside the norm. You can purchase software to monitor this for you. Microsoft Windows Applocker is an example of a detection software that will send an alert if an attacker tries to install an app outside the known baseline.
- Similarly, it is important to develop a baseline for outbound and inbound network connections. Since ransomware moves quickly through the company’s network and often authenticates many systems in a short amount of time, this kind of activity should raise a red flag and trigger firewall and security information event management software responses.
By implementing these best practices and strategies, you can dramatically reduce your exposure to ransomware and other cyberattacks. These practices can seem overwhelming, so keep in mind that your broker and carrier can help you with resources to facilitate the implementation of the above best practices. Cyber policies can also offer many additional responses in the case of a cyber attack such as security card data remediation and notification expense, network and information security liability, regulatory defense expenses, crisis management event expenses, and computer program and electronic data restoration expenses.
