Ride the Lightning

Five Cybersecurity Measures That Might Please Your Cyberinsurance Company

September 29, 2022

On September 23, IT Brew reported that cybersecurity insurance questionnaires used to be brief.

Do you have AV? Do you have a firewall?

Just a few years ago, answering “yes” to those two questions meant you’d probably get cyberinsurance coverage, said Jason Rebholz, CISO at Corvus Insurance.

But now, with the costly stakes of ransomware and business email compromise (BEC), insurers need extra information. The longer questionnaires indicate that insurers want a deeper understanding of an organization’s defenses against attacks.

“If you’re in the higher end of the SMB market, certainly in the midmarket and in the larger organizations, you’re looking at a minimum of 25 to 50 detailed questions,” Rebholz told IT Brew.

Questions like, “How are your data backups protected and configured?” might be on the list, for example, along with “What vendor are you using for endpoint detection and response (EDR)?”

“When you look at the largest costs for cyber insurance carriers in terms of security incidents: It’s ransomware and it’s business email compromise,” said Rebholz.

 While insurers may differ on the important factors, here are 5 recommendations from Rebholz:

Data backup: The question isn’t do you have backups, but how are you securing them? “Are you using immutable backups where they can’t be modified? When you can protect those backups, you’re much less likely to have to pay a ransom,” Rebholz told IT Brew.

MFA: To defend against attackers still targeting weakly guarded email accounts, insurers want to see multifactor authentication, including for remote-access scenarios.

EDR: Insurers also look for the “latest and the greatest” endpoint technology to detect, prevent, contain, and analyze malware, said Rebholz.

Email security: Secure email gateways and email-security products help to flag phishing attacks that steal credentials. “From our analysis alone, if you are not using a secure email gateway or some sort of email security solution, you’re twice as likely to have a BEC incident,” said Rebholz.

Out-of-band authentication for wire transfers: Two-factor verification that occurs through a separate communication channel along with the typical ID and password is recommended.

It is long past time to budget for the items above, so it’s time to get cracking. And maybe the IRS Section 179 deduction will increase your chances for making a successful argument to management.

Hat tip to Dave Ries.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225, Fairfax, VA 22030
Email:   Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson