Managing Cyber Risk: A Roundtable Webinar With Travelers Insurance and CSP

Cybersecurity is a comprehensive undertaking in the modern business world – it doesn’t just come down to strong passwords or an up to date antivirus solution. Are you covered on all fronts?

Cyber threats pose a serious risk to today’s businesses, with hackers growing more sophisticated and more dangerous all the time. The only way to effectively protect your business against these threats is to stay up to date on the latest cybersecurity best practices.

To stay one step ahead of hackers, you and your employees must be educated about the different kinds of cyber threats, how to recognize them, and what to do to block them. It’s due to a lack of awareness that the threat landscape has reached the magnitude it is today:

• On average, there are 926, 528 records lost in a data breach.
• 3 billion lost worldwide due to business email compromise
• 85% of surveyed executives have reported experiencing a cyber attack or breach

The Malware Threat

Malware remains among the top cyber threats that businesses face today. As malware becomes more prevalent and evolves, it’s more important than ever for businesses of all sizes to be aware of what threats are out there, and which specific threats they need to be the most concerned about.

Attack Vector: This is a method by which hackers gain unauthorized access to a device or a network for nefarious purposes. Attack vectors help hackers exploit the vulnerabilities in your system or network, including your employees.

Ransomware: This is a malware program that infects, locks, or takes control of a system and then demands a ransom to reverse it. The hacker encrypts your data and scrambles it so you can’t access it. Ransomware attacks and infects your computer with the intention to extort money from you. It’s installed via a malicious email attachment, an infected software download, and/or when you visit a malicious website or link.

Worm: This is a type of malicious software (malware) that worms its way through your network. It infects your computer and replicates across other computers, leaving copies of itself in the memory of each it infects. Worms often originate from e-mail attachments that appear to be from trusted senders. Then they spread to your contacts via your e-mail account and address book.

Dangerous Emails

Most modern cybercrime tactics are based on technical vulnerabilities. Hackers force their way into a system by taking advantage of out of date software, unencrypted data, or an inadequate firewall. Naturally, if you know your security software is patched and updated, and you know you have a reliable firewall and antivirus solution, then you must be safe, right? Unfortunately, an increasingly common cybercrime tactic today doesn’t rely on technical vulnerabilities at all. It relies on you and your employees.

Email is the easiest method of delivery in the kill chain. Hackers who use this approach cast a very wide net. Humans are involved in almost all malicious email initiations. Learning to identify fraudulent email is essential for every employee, technical or not.

• Be Suspicious of Unsolicited Messages.
  If an unknown person claims to be from a legitimate organization, you should verify their identity before answering the email.
• Always Verify Email Requests
  If one of your employees receives a suspicious email, he or she should try to verify it by directly contacting the company from where the email was sent.
• Don’t Provide Personal or Corporate Information
  Never reveal personal or financial information in an email, and don’t follow links sent in emails.
• Don’t Send Sensitive Information Over the Internet
  In general, this information should not be sent via email or over the Internet.
• Pay Attention to URLs
  Malicious websites may look identical to legitimate ones, but the URL may include a slight variation in spelling or use a different domain. This could signal a phishing attempt.

In early 2016, the FBI began warning businesses about a substantial increase in what they call business email compromise, a cybercrime method in which the criminal impersonates a C-level executive over email to trick the recipient into divulging crucial information or processing a massive e-transfer of company money.

Phishing

Today, 90% of all data breaches are the result of a phishing attack. A recent study by Google revealed that phishing attacks are the main cause of compromised online accounts. The study was conducted over a one-year period from March 2016 to March 2017. During this time, 1.9 billion user accounts were exposed due to phishing and data breaches.

What is phishing?

Phishing is a fraudulent act in which a scammer steals private and sensitive information such as credit card numbers, account usernames, and passwords. The criminal uses a complex set of social engineering and computer programming strategies to lure email recipients and Web visitors into believing that a spoofed website is legitimate. The phishing victim later realizes that their personal identity and other confidential data was stolen.

Spear Phishing is a variation on phishing where hackers send emails to specific, high-value targets, like CEOs. The spear-phishing email appears to come from a trusted source but in reality, helps hackers obtain classified information.

The Growing Threat of Ransomware

In a ransomware attack, a hacker gains access to an organization’s computer systems. Typically, an unsuspecting employee clicks on an emailed attachment that appears to be a bill or other official document. In actuality, the attachment installs a malicious software program (malware) onto the computer system. Once embedded, the malware allows a hacker access to critical systems, often giving complete remote control data and access.

From WannaCry to Cerber to Locky to CryptXXX, successful ransomware campaigns are only becoming more prevalent. When developing your ransomware defense, keep these recommendations in mind:

• Make a considerable investment in a comprehensive backup data recovery solution so that you can restore your data at a moment’s notice when necessary.
• Test your backup and cybersecurity measures thoroughly and regularly; create dummy files and then delete them to see how fast they can be restored, or schedule a day to literally unplug your critical systems to find out how long it takes to get online again.
• Be sure to make the most of the available resources (both provided online and through expert IT consultants) to ensure that you’re not overlooking vulnerabilities in your IT security methodology.

Don’t Forget About The Law

Unfortunately, a cyber breach at your business doesn’t just mean data loss – it can also result in legal consequences, depending on the type of data you deal with. State and federal laws often require breached companies to notify involved parties, which means if you get breached, you’ll be legally required to notify your customers.

If the breach is due to negligence on your part, you could face massive fines, especially if you’re a part of specific industries, such as the healthcare industry. That’s why you have to do your homework. In order to avoid the penalties of non-compliance, as well as protect your clients’ finances from cybercriminals, you have to be confident that you’re in line with HIPAA, NIST, PCI DSS, and more.

Cyber Insurance

Cybersecurity policies are gaining popularity with businesses of all types, with premiums in this fast-growing market expected to hit $5 billion by 2020. The idea is that as with any other type of insurance policy, businesses can purchase protection in the event a data breach or ransomware infection hits, allowing them to file a claim to recoup the resulting costs and damages.

However, cyber insurance has something else in common with other types of insurance – specifically health insurance. As these types of mass attacks become more common, some insurers have started to view the risks of offering ransomware insurance in the same way some health insurers are wary of pre-existing conditions. Having to pay out tens of thousands of cyber insurance claims all at once after getting hit by malware could be more than an insurer can cover.

Different policies will have different specifics in regards to what is covered, and what is not. There are three main issues you should be aware of before you buy a cyber insurance policy, or when you’re reviewing your existing policy:

• Does the policy consider a known vulnerability that you have not patched a pre-existing condition?
• Should an un-patched system be covered under a clause for errors and omissions?
• Is human error, such as an employee falling for a phishing attack, covered?

These are the questions you need answers to – be sure to do your homework and work with your IT provider so that you are covered.

For more information about hackers, today’s threats, and cybersecurity for your business, contact the experts from CSP, Inc. at (919) 424-2000  or info@cspinc.com.