Insights On Cybersecurity Insurance Every Business Should Know And Apply

Cybersecurity insurance can be a wise investment for businesses of any size seeking to protect against the financial consequences of a cyberattack or data breach.

Despite the complexities and costs of acquiring cyber insurance, it is still one of the best investments for mitigating the financial impact of a cyber incident – especially for small- and medium-sized businesses, which may not have the resources to cover the costs of a major cyberattack. Cyber insurance can also provide coverage for business interruption, a major concern for companies that rely on technology to conduct their operations.  

Be aware though that pricier premiums for cybersecurity insurance is an unfortunate consequence of the rising number of costly data breaches, ransomware, and other security attacks. Cyber insurance premiums increased by an average of 28% in the first quarter of 2022 compared with the fourth quarter of 2021, according to the Council for Insurance Agents and Brokers. According to Check Point Research, there was a 38% increase in global attacks in 2022 compared with 2021, accompanied by rising costs for insurers defending and settling cyber claims. IBM's "Cost of a Data Breach Report 2023" (registration required) showed 83% of organizations experienced more than one data breach, while the average cost of a data breach reached $9.44 million in the United States and $4.25 million globally. Also, governments around the world are enacting stricter regulations to protect personal information and sensitive data, resulting in higher limits of liability, a broader definition of loss (reputation recovery, financial recovery, more detailed reporting requirements, etc.), and regular audits and assessments to ensure companies are adhering to enhanced privacy measures.

With stricter requirements, companies will need to be proactive in assessing their insurance needs, weighing the costs and benefits, and working with insurers to ensure they have the right coverage in place.  

Whether cyber insurance is necessary for your business depends on several factors, including the size of your business, the types of data you collect and store, and the potential impact of a data breach or cyberattack. If your business stores sensitive customer information, handles financial transactions, or relies on technology for daily operations, it’s particularly vulnerable to cyber threats. In such cases, cyber insurance can provide critical protection against financial losses, reputational damage, and legal liability in the event of a breach. Large enterprises, and even small businesses, can benefit from cyber insurance, as the cost of a breach could be substantial and possibly devastating for a business, regardless of its size. By purchasing cyber insurance, you can transfer some financial risk associated with cyberattacks to the insurance company.

Cyber insurance is an insurance policy that provides financial protection against losses resulting from cyberattacks, data breaches, and other cyber-related incidents. It may cover costs related to lost income, legal fees, data recovery fees, and the cost of hiring a public relations firm to help with damage control to a company’s brand. Cyber insurance policies typically include coverage for both first party (direct) losses (such as lost revenue or data recovery costs) and third-party losses (such as legal costs and settlement payments). However, insurance companies have now realized that the prevalence of ransomware, and its focus on backup systems, has significantly increased their liability. For this reason, the ability to gain cyber insurance, or maintain it, has changed. 

Of particular note is the reality that Insurance companies have become increasingly careful about underwriting cyber-insurance policies, making it harder for organizations to purchase policies at an affordable price point with the coverage level needed. It's not difficult to figure out why insurers are hesitant — cyberattacks continue to increase while losses may exceed what the insurance market is able to absorb. For example, higher loss ratios for cyber insurance in 2020 and 2021 resulted in higher premiums in 2022 to manage that risk.  Going forward from 2023 and beyond this pattern will likely continue.

It's not surprising that insurers themselves are now proponents of more effective cyber-risk management for policy holders. Expect to see underwriters do the following:

• Deny coverage if you don't have bare-minimum controls in place. This may include raising the bar for minimum controls. For example, traditional multifactor authentication (MFA) may not be accepted as a strong enough control due to man-in-the-middle (MitM) attacks.
• Tie premiums to the maturity of your security controls.
• Include additional conditions and limitations on policies based on the security posture of policyholders and the controls in place when an incident occurs.

While many organizations see cyber insurance as a vital tool for managing cyber-risk, insurers are putting stricter coverage policies in place and increasingly denying claims. As organizations face heightened scrutiny and undergo tighter underwriting processes, it's important to be able to show that your organization is worthy of cyber-insurance coverage.

So just what should organizations implement in order to satisfy the changing requirements of cyber-insurance underwriters. A good place to start is with these 10 controls to manage cyber-risk:

1. Use invisible/phishing-resistant MFA and move to a passwordless solution.
2. Segment and segregate networks.
3. Adopt a robust data backup strategy.
4. Disable administrative privileges on endpoints.
5. Conduct regular employee security awareness training.
6. Deploy endpoint detection and response (EDR) and anti-malware solutions.
7. Implement Sender Policy Framework (SPF) to prevent email spoofing and phishing attempts.
8. Create a security operation center (SOC) that operates 24/7.
9. Deploy a security information event management (SIEM) platform to enable threat detection, incident response, and compliance management.
10. Implement robust security measures for service accounts within Active Directory (AD) environments.

These 10 controls are a great starting point. But keep in mind it's likely there are many more factors underwriters will evaluate as they review new policy applications (AND renewals). It's a safe bet that underwriters will get more sophisticated about their requirements for identity protection, authentication mechanisms, access controls, and identity management processes to minimize the likelihood and potential impact of a data breach. 

Also, many cyber-insurance policies require organizations to comply with specific regulations related to data protection and privacy where they apply (think HIPAA, FISMA, and GLBA as examples). Demonstrating compliance with these regulations increases your likelihood of qualifying for coverage, possibly leading to more favorable policy terms as well. Compliance can also demonstrate your commitment to securing identities and personal information, which can positively influence insurance underwriting decisions, coverage terms, and premiums.

For starters, as an organization considering cybersecurity insurance it's important that you have a conversation focusing on these two simple questions:

1.  Are you applying for a new policy, or do you have an existing policy coming up for renewal?

2.  What are the requirements you're being asked to fulfill by the insurance provider for a new policy? If renewing, is the insurance provider asking you to fulfill more requirements in order to renew your policy and what are they?

This conversation will lead you to discovery of what actions need to be taken and formulation of a plan to address them.

Here’s a case study of what happened recently when one company followed this approach ... with a little help along the way: 

Situation: The company's policy was coming up for renewal in a few months and their provider required them to fulfill 12 attestations to renew and keep their policy down.

Challenge: The company called all the top service providers for backups, security awareness training, multi-factor authentication (MFA), endpoint detection and response (EDR), and more. They received quotes totaling $50,000 in monthly reoccurring fees across 12 different providers.

Solution: Instead of going to multiple providers directly, the company was able to fulfill all of those requirements with just a few best-of-breed providers by using the FREE design and sourcing assistance from FreedomFire Communications, bringing the total fees down to approximately $15,000 per month. That’s $420,000 in annual savings that the company was able to realize with the FREE help from FreedomFire Communications.

There’s no arguing cyber insurance is a necessary part of doing business in the world we live in today. The good news is that companies are taking note of the costly implication of cyber incidents and beefing up their security budgets. However, companies can (and should) still be fiscally smart about their cybersecurity spending.  To do so it is strongly encouraged to take advantage of the FREE services available through FreedomFire Communications including supplier recommendations, as well as detailed action plans in order of priority – making it easy to guide your organization through a scalable roadmap without overwhelming them.

By taking the actions discussed here, and having a comprehensive cybersecurity strategy in place that includes a strong cybersecurity insurance policy, you can better protect your business against cyberattacks and ensure that you’re prepared in the event of a breach.

A 360 Degree View Of Cybersecurity (INFOGRAPHIC)

 To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) ... simply ask us at FREE Network Security Sourcing And Design Support. It's as easy as 1, 2, 3.

Applying Zero Trust Architecture In Today's Environment (INFOGRAPHIC)

 


To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security. It's as easy as 1, 2, 3.

Cybersecurity Small Business Guide

 
To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security. It's as easy as 1, 2, 3.

8 Ways To Mitigate Your Risk Of Cybersecurity Incidents (INFOGRAPHIC)

 

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security Resources And Sourcing. It's as easy as 1, 2, 3.

Every Business Should Follow These 10 Steps To Cybersecurity (INFOGRAPHIC)

 

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security Resources And Sourcing. It's as easy as 1, 2, 3.

How To Build A Cybersecurity Program From Scratch

 

First we need to understand -- What is a Security Program?

A security program is a set of actions and documents which outline what and how the organization is securing sensitive information. The end goal of a security program is to establish clear and concise metrics and goals which will allow your organization to adapt to new threats and identify weaknesses, in the ever-changing environments.

MY RECOMMENDED APPROACH

THE FIRST STEP

The first step of a security program is to define the program itself in what is called a security plan. The security plan is simply the identification of what is going to be secured, responsibilities, and direction. We’re going to be speaking with stakeholders (leadership, data owners, users, etc.) to identify what sensitive information exists and where.

When speaking of responsibilities, we’re not speaking of who is responsible for securing what data but, rather **who is responsible to establish, test, and maintain the program. ** There needs to be leadership buy-in for the security program to be successful as the inevitable change that will occur is rarely comfortable.

**The ship is doomed to failure is there is not an end goal in mind. **“Total security by December” is not an end goal. Direction is more the ‘how’ than the ‘what’. How is your plan going to be tested, implemented, designed? What are you going to compare your security against? What are the goals of implementing the security program? These are questions that should be answered by the security plan.

THE SECOND STEP

Next, we have the documentation that defines how we take the security plan from a concept to action. This step includes items such as: policies, which define what should be done; procedures, which define how what should be done is done; and checklists, which ensure that what should be done is done correctly. This will honestly take the most time as it will require a change in corporate, user, and system behavior.

THE FOURTH STEP

Finally, we establish 'Metrics' to test that what we have in place is effective in its effort to secure the environment. This is where a penetration test comes into play.

THE THIRD STEP

However, a penetration test by itself isn’t giving you the whole story as we saw above. What should be implemented before a penetration test, and quite frankly before the entire process is started, is the 'Security Assessment.'

This process will provide feedback on:

� How effective your training program is,

� What holes you have in your administration processes,

� How enacted policies may not cover potential use cases

� and, many more areas for improvement.

Taken together with a comprehensive suite of assessments, a penetration test will provide a complementary data set informing you of how well you are securing your organization’s data.

___________________________________

Whether you’re looking to build a cybersecurity program from the ground up, or simply looking to strengthen your existing processes, you would be better off, if you follow these steps:

1. Build information security teams

Creating a security program plan isn’t a one person job. It takes an entire team of people working together. In this case you’ll need two teams:

• The executive team – The senior-level execs in the business responsible for setting the mission, objectives, and goals for the program. They are tasked with building the policy and pushing it throughout the organization.

• The security team – The IT professionals responsible for managing daily IT security operations, threat and vulnerability assessment, and IT controls.

2. Develop The Security Plan (explained above).

3. Take inventory of your information assets

Your teams will conduct a total inventory of hardware, applications, databases, networks and systems. After that is done, every IT asset must be given an owner and custodian who’s responsible for the asset and its data.

4. Determine your regulatory compliance and standards

Your organization may be legally required to follow one or more cybersecurity compliance practices. This could be anything from HIPAA, HITECH, or PCI. Once the executive team has determined which regulatory standards you have to follow, you can get to work.

5. Identify threats, vulnerabilities, and RISKS

What are the threats to your information assets? It’s vital that every significant threat is identified, categorized, and ranked by priority. Similarly, vulnerabilities—flaws in the system—also must be listed and ranked. Finally, risks that could jeopardize the organization’s ability to operate because of threats and vulnerabilities have to be considered.

6. Mitigate risks

The goal of this stage is to either minimize or eliminate a risk, starting with those that pose the gravest danger to your organization and are the most likely to occur. Regardless of likelihood or threat, some risks may be harder to address than others.

7. Build an incident management and disaster recovery plan

Incidents could encompass a wide range of circumstances that cause the loss, interruption, or deletion of assets or data. A smart incident plan details every possibility. It then outlines the steps needed to minimize the damages and get your operations back up and running in as little time as possible.

8. Add security controls

As discussed above, there are hundreds of security controls that you can put in place in order to reduce or eliminate the various risks you face. This touches a wide range of topics, including access controls, hardware and software safeguards, security policies, operational procedures, and personnel training.

9. Train your employees

Once you’ve built your information security program plan, you’ll have to enforce it. The safeguards don’t mean a thing if the employees aren’t following your best practices. All it takes is one weak link to threaten your entire organization, so this step can’t be taken lightly.

10. Periodically conduct audits

The only way to know the efficacy of your plan is to test it frequently. Internal audits or external audits are among the best ways that you can ensure that the policies and procedures in place are working, comply with regulations, and are being updated regularly.

_________________________________

Cybersecurity is not a once-a-year project; it’s a daily process. As the technology landscape continues to evolve, making sure your organization is protected against the latest threats is important.

Please let me know of what you think about this in the comment section. You can also share with all if the information shared here helps you in some manner.

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security Resources And Sourcing. It's as easy as 1, 2, 3.

What Are The Different Kinds Of Cybersecurity Threats? (INFOGRAPHIC)

 

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security Resources And Sourcing. It's as easy as 1, 2, 3.

ABCs Of Information Security Awareness (INFOGRAPHIC)

 

This infographic on the ABCs of information security is from my friend Paula Piccard.

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security. It's as easy as 1, 2, 3.

Different Kinds Of Cybersecurity Threats (INFOGRAPHIC)

 

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security. It's as easy as 1, 2, 3.

Beware These 10 Blind Spots In Your Cybersecurity Posture (INFOGRAPHIC)

 

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security. It's as easy as 1, 2, 3.

The Basics For How To Make Your Network Secure (INFOGRAPHIC)

 

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security. It's as easy as 1, 2, 3.

Cybersecurity Architecture Based On A Defense-in-Depth Design (VIDEO)

 

This video offers a quick explanation of the 10 layers of Cybersecurity Architecture based on a Defense in Depth Design.

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security. It's as easy as 1, 2, 3.

What Are The 10 Elements Of Business Cybersecurity? (INFOGRAPHIC)

 

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security Resources And Sourcing. It's as easy as 1, 2, 3.

Is Cybersecurity On Your Agenda?

 

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments, and awareness training and employee education programs) .... plus comparisons of 100s of best-in-class network security / cybersecurity providers and what they have to offer ... simply ask us at Network Security Resources And Sourcing. It's as easy as 1, 2, 3.

 How each cybersecurity CEO responds to the challenges of keeping employees safe, customers secure, and product release cycles on schedule while still achieving customer success – all virtually – provide valuable insights into leading a company during difficult times.

12 Cybersecurity CEOs On What Each Learned Leading During The Pandemic

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments) .... plus comparisons of best-in-class network security / management providers and what they have to offer .... simply ask us at the following link (FREE). It’s as easy as 1, 2, 3.

Cybersecurity Strategies And Resources

10 Steps To Cybersecurity

 

This guidance is designed to help organizations protect themselves in cyberspace. It breaks down the task of defending your networks, systems and information into its essential components, providing advice on how to achieve the best possible security in each of these areas.

10 Steps To Cybersecurity

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements ….including security posture and risk assessments (https://youtu.be/n2zZjsQVZIs) ....plus comparisons of best-in-class network security / management providers and what they have to offer, simply ask us at the following link (FREE). It’s as easy as 1, 2, 3.

Cybersecurity Strategies And Resources

How Every Business Can Best Protect Themselves From Malicious Cyberattacks

 

Cybersecurity has never been more critical to businesses of all sizes. From the Fortune 500 to SMB, for any business to survive, they need some level of protection from malicious Cyberattacks.

Cyberattacks on businesses are constantly evolving which only brings more danger to consumers and employees, this is why Cybersecurity is so important. Cybersecurity services are provided by suppliers to protect, detect, and remediate business from malicious attacks. We have partnered with some of the top Cybersecurity suppliers in the world that offer everything from evaluations, network monitoring, data and device protection, remediation, and compliance.

To learn more about all the options available to you for meeting your organization’s data protection and network security requirements (including security posture and risk assessments) .... plus comparisons of best-in-class network security / management providers and what they have to offer ... simply ask us at the following link (FREE). It’s as easy as 1, 2, 3.

Cybersecurity Strategy And Resources