Impress Your Cyber Insurance Underwriters With These Essential Tips

Cyber insurance is a safety net which protects businesses from the potentially catastrophic costs of ransomware, data breaches and other digital threats. Which is true - as long as an organisation manages to satisfy the increasingly rigorous security controls to meet the coverage qualification criteria.   

By Joseph Carson

In the face of accelerating insider cyber crime, a rise in ransomware attacks and other threats, some insurers are increasing their premiums. Others are simply exiting the market altogether. As a result, cyber insurance is becoming more expensive and harder to obtain.

Organisations can no longer contact an insurer, arrange coverage and relax, safe in the knowledge that a big pay out will allow them to mop up the financial damage of a cyber attack, should one occur. In order to simply qualify for protection, businesses must be able to demonstrate their cyber resilience and prove they have deployed appropriate protection.

We argue that the best place to start is by securing a well-known defensive weak point: privileged access which has administrator-level powers. 

Check Your Privileged Access

If an attacker manages to crack into a privileged user account, they gain the literal keys to the kingdom, and it could be game over for defenders. This is one reason why businesses should ensure key corporate assets are only accessible to authorised users.

Privileged Access Management (PAM) is one of the best solutions to protect and manage access. Yet as well as improving an organisation’s security posture, a PAM solution also demonstrates that a business has reduced the risks and is better prepared to face the latest threats. We are not alone in making this claim, because underwriters are also now questioning clients as to whether they have deployed secure access systems before signing off insurance policies. PAM should therefore be a foundational part of any organisations’ cybersecurity posture.

Insurers evaluate cyber risk using a variety of models and metrics. AIG, for instance, makes its evaluation metrics available to the public. Others, including Zurich use frameworks from the National Institute of Standards and Technology (NIST) to carry out a cyber risk assessment report. The methods of assessing risk will vary among providers, but they are all looking for the same fundamentals: strong, proactive cybersecurity defences that respond to the latest threats. Secure access is an important part of risk reduction insurers are looking for when making decisions. 

The authoritative Verizon Data Breach Investigations Report 2021 found that 61% of breaches involved credentials, with stolen credentials used in 25% of breaches. It is so easy to buy or steal passwords that organisations must be realistic about the limited protection they offer. PAM is a more robust way of securing access, protecting privileged accounts from unauthorised access, and limiting the potential damage of an incident. 

Managing Privileged Access

A PAM solution can monitor all administrator accounts usage to discover unusual behaviour. This could be as simple as detecting a logon at 3am on a Saturday morning, which could reveal that a business either has some seriously hard-working employees or that a threat actor is trying to access its network. 

Red flags can also be raised if a privileged account starts accessing large amounts of sensitive information or when a high number of privileged user accounts are accessed at the same time. If a manager’s account suddenly starts exfiltrating data and uploading it to a mysterious, unknown website, they have either been compromised or conducting actions that put the organisations at increased risks.. Spotting this behaviour and shutting it down quickly limits the damage.

PAM tools reduce risk and liability, protecting against external threats as well as internal, insider risks. Multi-factor authentication (MFA) is another vital part of the puzzle, protecting privileged accounts from unauthorised access. Insurers will look favourably on businesses which have deployed this technology and can therefore prove they protect privileged accounts as well as monitor their usage for anomalies. 

When looking for a PAM solution, decision makers should be sure to check it offers automation which manages authentication, authorisation and monitoring. It should also focus on orchestration, serving as a kind of conductor that enables the security team to launch and fine-tune a multifaceted defence that enables seamless, secure access when needed on demand – or prevents it where necessary. 

Installing PAM is not just a useful first step to securing insurance. It will allow organisations to meet their insurers’ changing requirements. In an age where cyber insurance is becoming harder to obtain and more expensive, it pays to have an answer to underwriters’ questions before they ask them.

Businesses that have deployed PAM will have a powerful argument in their favour and give them a serious advantage when securing or renewing a cyber insurance policy. 

Joseph Carson is Chief Security Scientist at Delinea

You Might Also Read:

Negotiating Ransom: To Pay Or Not?:

 

« Finland Hit By Cyber Attacks
Cyber Criminals Volunteer For War In Ukraine »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Synology

Synology

Synology provides high-performance, reliable, and secure Network Attached Storage (NAS) products.

Bloombase

Bloombase

Bloombase is the leading innovator in Next-Generation Data Security solutions for Global 2000-scale organizations

Tinfoil Security

Tinfoil Security

Tinfoil is a simple, developer friendly service that lets you scan your website for vulnerabilities and fix them quickly and easily.

PCI Pal

PCI Pal

PCI Pal’s secure cloud payment solutions are certified to the highest level of security by the leading card companies.

Guidewire

Guidewire

Guidewire Cyence™ Risk Analytics is a cloud-native economic cyber risk modeling solution built to help the insurance industry quantify cyber risk exposures.

OmniNet

OmniNet

OmniNet delivers the next generation of cybersecurity and is the only provider in the market to move the edge of small businesses to a virtual, omnipresent perimeter.

Riverside Research

Riverside Research

Riverside Research is a not-for-profit organization chartered to advance scientific research in areas including Trusted & Resilient Systems.

Invensity

Invensity

INVENSITY is an interdisciplinary technology and innovation consulting company. Centres of excellence include Cyber Security and Data Privacy.

SYSGO

SYSGO

SYSGO is the leading European provider of real-time operating systems for critical embedded applications in the Internet of Things (IoT).

Maven Technologies

Maven Technologies

Maven Technologies specialize in secure data destruction, electronics recycling, asset management, and highly detailed reporting.

Beyond Identity

Beyond Identity

Beyond Identity employs an elegantly simple concept, the personal certificate authority and self signed certificates, to replace passwords.

Illuma Labs

Illuma Labs

Illuma Labs delivers real-time voice authentication and fraud prevention solutions.

Secura B.V.

Secura B.V.

Secura is an independent specialized cybersecurity expert, providing insights to protect valuable assets and data.

Toothpic

Toothpic

ToothPic has invented, designed, developed and patented a solution to enable companies to turn every smartphone into a secure key for a user-friendly online authentication.

Hubify

Hubify

Hubify is an experienced, service-driven technology company specialising in business connectivity across mobile, data, voice, cloud, & cyber security solutions.

Herzing College

Herzing College

Herzing College Ottawa offers an accelerated 12-month Cybersecurity Specialist training program. This program is developed by industry experts and based on leading IT security certifications.