Impress Your Cyber Insurance Underwriters With These Essential Tips

Cyber insurance is a safety net which protects businesses from the potentially catastrophic costs of ransomware, data breaches and other digital threats. Which is true - as long as an organisation manages to satisfy the increasingly rigorous security controls to meet the coverage qualification criteria.   

By Joseph Carson

In the face of accelerating insider cyber crime, a rise in ransomware attacks and other threats, some insurers are increasing their premiums. Others are simply exiting the market altogether. As a result, cyber insurance is becoming more expensive and harder to obtain.

Organisations can no longer contact an insurer, arrange coverage and relax, safe in the knowledge that a big pay out will allow them to mop up the financial damage of a cyber attack, should one occur. In order to simply qualify for protection, businesses must be able to demonstrate their cyber resilience and prove they have deployed appropriate protection.

We argue that the best place to start is by securing a well-known defensive weak point: privileged access which has administrator-level powers. 

Check Your Privileged Access

If an attacker manages to crack into a privileged user account, they gain the literal keys to the kingdom, and it could be game over for defenders. This is one reason why businesses should ensure key corporate assets are only accessible to authorised users.

Privileged Access Management (PAM) is one of the best solutions to protect and manage access. Yet as well as improving an organisation’s security posture, a PAM solution also demonstrates that a business has reduced the risks and is better prepared to face the latest threats. We are not alone in making this claim, because underwriters are also now questioning clients as to whether they have deployed secure access systems before signing off insurance policies. PAM should therefore be a foundational part of any organisations’ cybersecurity posture.

Insurers evaluate cyber risk using a variety of models and metrics. AIG, for instance, makes its evaluation metrics available to the public. Others, including Zurich use frameworks from the National Institute of Standards and Technology (NIST) to carry out a cyber risk assessment report. The methods of assessing risk will vary among providers, but they are all looking for the same fundamentals: strong, proactive cybersecurity defences that respond to the latest threats. Secure access is an important part of risk reduction insurers are looking for when making decisions. 

The authoritative Verizon Data Breach Investigations Report 2021 found that 61% of breaches involved credentials, with stolen credentials used in 25% of breaches. It is so easy to buy or steal passwords that organisations must be realistic about the limited protection they offer. PAM is a more robust way of securing access, protecting privileged accounts from unauthorised access, and limiting the potential damage of an incident. 

Managing Privileged Access

A PAM solution can monitor all administrator accounts usage to discover unusual behaviour. This could be as simple as detecting a logon at 3am on a Saturday morning, which could reveal that a business either has some seriously hard-working employees or that a threat actor is trying to access its network. 

Red flags can also be raised if a privileged account starts accessing large amounts of sensitive information or when a high number of privileged user accounts are accessed at the same time. If a manager’s account suddenly starts exfiltrating data and uploading it to a mysterious, unknown website, they have either been compromised or conducting actions that put the organisations at increased risks.. Spotting this behaviour and shutting it down quickly limits the damage.

PAM tools reduce risk and liability, protecting against external threats as well as internal, insider risks. Multi-factor authentication (MFA) is another vital part of the puzzle, protecting privileged accounts from unauthorised access. Insurers will look favourably on businesses which have deployed this technology and can therefore prove they protect privileged accounts as well as monitor their usage for anomalies. 

When looking for a PAM solution, decision makers should be sure to check it offers automation which manages authentication, authorisation and monitoring. It should also focus on orchestration, serving as a kind of conductor that enables the security team to launch and fine-tune a multifaceted defence that enables seamless, secure access when needed on demand – or prevents it where necessary. 

Installing PAM is not just a useful first step to securing insurance. It will allow organisations to meet their insurers’ changing requirements. In an age where cyber insurance is becoming harder to obtain and more expensive, it pays to have an answer to underwriters’ questions before they ask them.

Businesses that have deployed PAM will have a powerful argument in their favour and give them a serious advantage when securing or renewing a cyber insurance policy. 

Joseph Carson is Chief Security Scientist at Delinea

You Might Also Read:

Negotiating Ransom: To Pay Or Not?:

 

« Finland Hit By Cyber Attacks
Cyber Criminals Volunteer For War In Ukraine »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

MetaCompliance

MetaCompliance

MetaCompliance is a cyber security and compliance organisation that helps transform your company culture and safeguard your data and values.

Hitachi ID Systems

Hitachi ID Systems

Hitachi ID Systems offers comprehensive identity management and access governance, privileged access management and password management solutions.

Mitol PerfectBackup

Mitol PerfectBackup

Mitol PerfectBackup provide Enterprise Online Backup, Disaster Recovery and Cloud Computing Services.

Telia Cygate

Telia Cygate

Cygate are specialists in information security, data networks, and data centre and cloud technologies.

Total Defense

Total Defense

Total Defense solutions include anti-malware, anti-virus, intrusion prevention & mobile security.

A-LIGN

A-LIGN

A-LIGN is a technology-enabled security and compliance partner trusted by more than 2,500 global organizations to mitigate cybersecurity risks.

aDolus Technology

aDolus Technology

aDolus delivers a robust solution for safeguarding against counterfeit or malicious software and firmware in mission-critical systems.

Netlawgic Legal Services

Netlawgic Legal Services

Netlawgic is exclusively focused on delivering cyber law solutions to the industry. We provide our clients with specialized attention and problem solving in all aspects of cyber law.

Qualcomm Technologies

Qualcomm Technologies

Qualcomm invents breakthrough technologies that transform how the world connects, computes and communicates.

IT-Seal

IT-Seal

IT-Seal GmbH specializes in sustainable security culture and awareness training.

iManage

iManage

iManage's intelligent, cloud-enabled, secure knowledge work platform enables organizations to uncover and activate the knowledge that exists inside their business.

Third Point Ventures

Third Point Ventures

Third Point brings deep technical expertise, a strong network of relationships, and decades of investing experience to add value to our partners throughout their journey from idea to IPO and beyond.

ATSG

ATSG

ATSG is a global leader in transformational technology solutions for today’s digital enterprise. Cybersecurity ranging from Advisory & Assessment to Fully Managed Detection and Response Services.

Axiotrop

Axiotrop

AXIOTROP is a Cybersecurity firm offering leading services in assessment, remediation, and validation to protect the confidentiality, integrity, and availability of regulated information.

EyBrids

EyBrids

As a forward-thinking cybersecurity consulting firm, we believe that robust security is the foundation for innovation and growth in today’s digital landscape.

COcyber

COcyber

COcyber aims to enhance collaboration between the cybersecurity civilian and defence spheres. It is a two-year project funded by the European Union and it kicked off in July 2024.