Just to be clear as we get started, i.t.NOW does NOT sell cyber security insurance. We just help make sure our clients have the right security solutions in place to protect their business. We also help our clients with IT strategy, and recently how to prepare for your next cyber security insurance renewal has come up quite often in those discussions.
The reason it’s been a point of discussion is that many of our clients that have had cyber security insurance have been asked to fill out extensive security assessments as part of their renewal process. Usually, we’ve already put the solutions in place that they need, and so it’s just a question of documenting those for the insurance company.
We have had some insurance carriers ask for specific solutions they didn’t already have in place that we needed to implement. In general insurance companies have been asking for more and more security to lower the risk on these types of policies. This is usually a win for both parties. The lower your risk profile the lower your premium is, and sometimes the costs offset and allow you to have better security and be covered.
While all insurance carriers are different, here are a few things that almost all carries are asking for to help your company be prepared and get the best coverage and rates.
Multifactor Authentication
This is base line security for any business. MFA helps protect your data by requiring users to verify their identity with a password and a second factor such as a code in their authentication app, or biometrics.
“Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.” – Alex Weinert, VP Director of Identity Security at Microsoft.
This is not to say that MFA is uncrackable, or that it can’t be bypassed. It surely can. Its just much more difficult. Most hackers won’t bother, and MFA is a deterrent because they simply move on to an easier target in most cases.
It’s especially important to have MFA enabled on your email. Almost all email platforms have MFA as a built-in feature that you can turn on for free. It simply needs to be turned on and configured properly. MFA should be enabled on all your applications that house sensitive data as well. Without it, most insurance companies will deny you, or ding you on your premiums.
Security Awareness Training
Threats abound in 2024, and educating our users is more important than ever. Security awareness training helps to close the knowledge gap and upskill your employees. If they know how to spot a threat and what to do, it lowers your risk as an organization significantly.
Most of these training programs can send test phishing emails. This allows you to see who your “clickers” are within your organization. After a base line test, you can run them through some training. Then send another test. Hopefully you’ll see your list of clickers shrink, and if there are folks that still aren’t getting it you can require them to take additional training.
This is a common requirement for insurance companies to issue a cyber security policy. Whether your carrier requires it or not, it’s a good solution to have in place to protect your business.
Endpoint Detection and Response
EDR is the latest and greatest in antivirus software. However, that title may undersell what it does a little bit. If AV is akin to having a lock on your front door, EDR is like a full home security system with cameras in every room and sensors on every door and window. Not only does it allow you to detect an intruder, but it allows you to know everything they did while inside. The best EDR solutions also have a security operations center attached to them where humans are monitoring critical security events and can help alert you.
The best EDR products can segregate a computer from the rest of the network if an infection is detected. This can be a lifesaver if you’re dealing with ransomware or another attack that spreads over the network.
EDR is a very common requirement of insurance carriers when you apply for cyber security insurance. It’s also part of what we would consider base line security for businesses and offers a great layer of protection at the endpoint.
Separate Backups
Another item that every business should consider is their backup plan. If you have servers on premises, are they being backed up locally? If they are on the local network, are they segregated in a way that if you were to have a ransomware or other attack, they would be encrypted along with your primary production hardware? Are their offsite backups as well?
We recommend that you always have a local and offsite copy of your backups. We also recommend that your local backups be segregated on the network so they wouldn’t be affected by an attack.
This is something more insurance carriers are asking about, but not required by as many as the other solutions mentioned. It is best practices for IT and should be considered by all businesses.
Conclusion
It’s important that you talk strategy with your IT team and get prepared for your next insurance renewal. This will make the process easier and will help you identify any gaps in your current cyber security solutions. As always i.t.NOW is happy to advise if this is something that is on your plate currently. Don’t hesitate to reach out.
