by Doug Kreitzberg | May 27, 2020 | Cyber Insurance, Cybersecurity, Data Breach, Risk Management
The fear of experiencing a cyberattack is rightfully keeping businesses owners up at night. Not only would a cyber attack give your security team a headache , but could have profound and irreversible financial implications for your businesses. In fact, according to a report by IBM and the Ponemon Institute, the average cost of a data breach in the U.S. is a over $8 million. And with 30% of companies expected to experience a breach within 24 months, it’s no surprise that business are seeking coverage. The problem, however, is that businesses and insurance companies alike are still grappling over exactly what is and is not covered when a cyber event occurs.
Some businesses are learning this the hard way
Recently, a phishing campaign successfully stole the credentials of an employee at a rent-servicing company that allows tenants to pay their rent online. The phishers used the employee’s credentials to take $10 million in rent money that the company owed to landlords. The company had a crime insurance policy that covered losses “resulting directly from the use of any computer to fraudulently cause a transfer,” but soon found out their claim was denied. Among the reasons the insurer gave for denying the claim was that, because the funds stolen were owed to landlords, the company did not technically suffer any first-party losses and there were not covered by the insurance policy.
In another case, the pharmaceutical company Merck found itself victim to a ransomware attack that shut down more than 30,000 of their computers and 7,500 servers. The attack took weeks to resolve and Merck is now claiming $1.3 billion in losses that they believe should be covered by their property policy. The problem, however, is that the attack on Merck was actually a by-product of a malware campaign that the Russian government was waging against Ukraine and happened to spread to companies in other countries. The insurer therefore denied the claim, stating their property coverage excludes any incidents considered an “act of war.”
Silence is Deadly
The Merck example above also illustrates the concept of “silent”, or “non-affirmative” cyber. Basically these are standard insurance lines, like property or crime, in which cyber acts have not been specifically included or excluded. Merck was filing the claims against the property policy because it sustained data loss, system loss and business interruption losses. Silent cyber is difficult for a carrier to respond to (which is why the carrier in this case is looking to the war and terrorism exclusion to deny coverage) and even more challenging to account for. That’s one reason both carriers and businesses are looking to standalone cyber insurance, which provides both the insured and carrier with a lot more clarity as to what is covered. (Although, carriers can deny coverage in situations where the attestations about the quality of security up front do not measure up at claim time.)
Predicting the Unpredictable
It’s commonly said that insurers will do anything to avoid paying out claims, but the issue with cyber insurance coverage goes much deeper. Instead, the problem centers around a number of uncertainties involved in categorizing and quantifying cyber risk that makes comprehensive policy writing a near impossible task. For one, cyber insurance is a new market dealing with a relatively new problem. There are therefore not as many data points for insurers to accurately quantify risk as there are for long-standing forms of insurance.
The real problem, however, is that cyber incidents are extremely difficult to predict and reliably account for. Whereas health and natural disaster policies, for example, are based on scientific modeling that allows for a certain degree of stability in risk factors, it is much harder for insurance companies to predict when, where, and how a cyber attack might happen. Even Warren Buffett told investors that anyone who says they have a firm grasp on cyber risk “is kidding themselves.”
Reading the Fine Print
It’s important to understand that, despite the relatively unpredictable nature of cyber incidents, there are plenty of steps businesses can and should take to understand and mitigate their risk profile. Organizations with robust risk management practices can significantly reduce their vulnerability and a strong security posture goes along way towards minimizing their risks and providing a strong defense when a claim strikes.
Unfortunately, this puts a lot of the responsibility on individual businesses when evaluating their cyber exposures and the insurance coverages which might be available to respond. A good insurance broker who has expertise in cyber is essential. Much like the threat landscape, cyber insurance coverage is constantly evolving, and it is to all parties, from businesses to carriers, to keep up.
by Doug Kreitzberg | May 20, 2020 | Cybersecurity, Data Breach, Human Factor
We’re number one! (Oh, that’s not a good thing?)
Yes, sometimes it’s better not to be recognized. Especially if it’s in the Verizon 2020 Data Breach Investigations Report which shows new and emerging trends of the cyber threat landscape. Anyone who is anyone in cyber wants to get their hands on it as soon as it’s published (and we are no exception). As has been for many years, one of the key reasons behind data breaches involves what we do (or don’t do). In fact, this year’s report shows that 3 out of the top 5 threat actions that lead to a breach involve human’s either making mistakes or being tricked. Below is a closer look at those 3 threat actions, and the human factors they rely on.
1. Phishing
In this year’s report, phishing attacks lead the cyber threat pack for successful breaches. It it also the most common form of social engineering used today, making up 80% of all cases. A phish attacker doesn’t need to rely on a lot of complicated technical know-how to steal information from their victims. Instead, phishing is a cyber threat that relies exclusively on manipulating people’s emotions and critical thinking skills to trick them into believing the email they are looking at is legitimate.
2. Misdelivery
One surprising aspect of the report is the rise of misdelivery as a cause of data breaches. This is a different kind of human factored cyber threat: the pure and simple error. And there is nothing very complicated about it: someone within the organization will accidentally send sensitive documents or emails to the wrong person. While this may seem like a small mistake, the impact can be great, especially for industries handling highly sensitive information, such as healthcare and financial services.
3. Misconfiguration
Misconfigurations as a cause of data breaches is also on the rise, up nearly 5% from the previous year. Misconfigurations cover everything security personnel not setting up cloud storage properly, undefined access restrictions, or even something as simple as a disabled firewall. While this form of cyber threat involves technological tools, the issues is first and foremost with the errors made by those within an organization. Simply put, if a device, network, or database is not properly configured, the chances of a data breach sky rocket.
So What’s to Stop Us?
By and large we all understand the dangers cyber threats pose to our organizations, and the amount of tools available to defend against these threats are ever-increasing And yet, while there is now more technology to stop the intruders, at the end of the day it still comes down to the decisions we make and the behaviors we have (and which are often used against us).
We know a few things: compliance “check the box” training doesn’t work (but you knew that already); “gotcha” training once you accidentally click on a simulated phish doesn’t work because punitive reinforcement rarely creates sustained behavior change; the IT department being the only group talking about security doesn’t work because that’s what they always talk about (if not blockchain).
Ugh. So what might work? If you want to have sustained cybersecurity behavior change, three things + one need to occur: 1) you need to be clear regarding the behaviors you want to see; 2) you need to make it easy for people to do; 3) you need people to feel successful doing it. And the “+ one” is that leadership needs to be doing and talking the same thing. In other words, the behaviors need to become part of the organizational culture and value structure.
If we design the behaviors we want and put them into practice, we can stop being number one. At least as far as Verizon is concerned.
by Doug Kreitzberg | Apr 30, 2020 | Coronavirus, Cybersecurity, Human Factor
Your organization’s cybersecurity team is on edge in the best of times. The bad guys are always out there and, like offensive lineman in American Football who are only noticed when they commit a penalty, cybersecurity personal are usually noticed only when something goes wrong. Now, as the game has changed, the quick transition to work from home, combined with the plethora of COVID-19 scams, phishing, and malware drowning the cybersecurity threat intel sources—not to mention the isolation—may leave your team at a chronically high stress level. And cybersecurity is far more than just your technical safeguards. At the end of the day, the stress your team feels could lead them to put their focus in the wrong place and let their guard down.
Here’s what you can do about it
- Incorporate cybersecurity as a part of your overall business strategy process – now is the time to recognize cybersecurity as a key part of the organization’s strategy and that enables you to drive your mission forward.
- Be a part of the cybersecurity planning process – be active, listen, and understand how your team is handling this.
- Leverage your bully pulpit – communicate to the staff about the key areas your cybersecurity team is focused on and the role they are playing to keep the organization secure while everyone is working from home.
- Check in – take the time to just check in and see how they are doing. A little goes a long way.
The truth is, when it comes to cybersecurity, your first and most effective line of defense is not your firewall or encryption protocol. It’s the people that form a team dedicated to protecting your organization. Working from home poses unique cybersecurity challenges, and it’s up to you to make sure your team is given the attention they need to do their job well.
by Doug Kreitzberg | Apr 21, 2020 | Cybersecurity, Human Factor, Risk Culture
Regardless of your business or your personal situation, it is hard to imagine that you have not been impacted by COVID. Among other things, it has exposed how vulnerable we are personally. How vulnerable our company is. How vulnerable our communities are.
And these vulnerabilities can create a sense of anxiety, which can build on itself, leaving feeling us helpless.
Perhaps the single most important thing we can do when we are vulnerable is to connect. To communicate. To reach out to others. If we do nothing but isolate, the vulnerabilities expose and consume us.
Cybersecurity professionals deal with vulnerabilities all the time. Often these individuals work as a group separately or perhaps communicating with other IT members. Unfortunately, apart from compliance audit reports or token security awareness programming, cybersecurity is rarely communicated and integrated into the overall culture of the business. How many times do security professionals say of corporate users and leadership, “They just don’t understand” and c-suite, marketing or other department users say with regards to cybersecurity, “They just don’t understand.” Imagine the understanding that could occur if everyone began to lean in and communicate about these issues as one team.
Just as during these times, a key way to address vulnerabilities in your systems is by connecting and communicating across channels. The more the IT and cybersecurity team is engaging with business leaders and staff and other stakeholders, the stronger the organizational culture will be to mitigate vulnerabilities and build resilience.
by Doug Kreitzberg | Apr 3, 2020 | Cybersecurity
A while back a motel chain used the catch-phrase “We’ll keep the lights on for you.” Unfortunately, many businesses do the same things when it comes to keeping the access to their systems available via what are called open ports. Too many “lights” expand the number of ways a hacker can get into your system. Even a light which should be on can be exposing a vulnerability.
Ports are the channels through which internet communications travel. Each IP address has up to 65,535 ports. And ports open up to a service (which runs a routine such as web browsers or file sharing or remote access). Obviously, we use the internet to communicate, so you need to have open ports. The problem is when you either have ports which are open for everyone when they should be restricted only to those who need them or when the services themselves are not kept up to date or are improperly configured.
During this time of crisis, bad guys are ramping up to find vulnerabilities because they feel everyone is distracted. Take the time to double check (or have your team double check) your ports, patch your systems and services as needed. Run a vulnerability scan and address any findings it discovers.
Sometimes, improving your cybersecurity can be as easy as flicking a switch.
by Doug Kreitzberg | Mar 20, 2020 | Cybersecurity
Recently, we’ve written a series of articles looking the at various ways the coronavirus intersects with cybersecurity concerns. And while we don’t want to downplay the importance of maintaining cybersecurity practices throughout the crisis, we could all use a little distraction from time to time. So, we decided to have some fun today. And what is more fun than hearing stories about hackers who completely and totally messed up? So, without further ado, we present three major hacker fails to keep your mind off the news for a few minutes.
Hacker Fail #1: The Spy Who Hacked Me (Then Posted it on YouTube)
This should go without saying, but if you’re going to install malware on hospital computers, you probably shouldn’t upload a video of yourself doing it. As it happens, that is exactly what Jesse William McGraw did. McGraw was a night security guard at Northern Central Medical Plaza in Dallas. One night he decided to film a video of himself pretending to be a spy who was infiltrating the premises (with James Bond music and all). Of course, as a security guard, he had access to the entire building and wasn’t actually doing anything illegal. That is, until he started installing malware on a dozen of the hospital’s computers.
Authorities quickly arrested McGraw and discovered he was actually the leader of a hacking group called the Electronik Tribulation Army. For his part, McGraw was sentenced to 9 years in prison and ordered to pay over $30,000 in restitution.
Hacker Fail #2: VPN FML
This story involves one of the most news-worthy cyber-attacks in the past few years: and hack and leak of emails from the Democratic National Committee. The documents were leaked online over the course of few months by a hacker calling himself Guccifer 2.0. While leaking the documents, Guccifer portrayed himself as a lone hacker conducted the attack for the fun of it.
Of course, we know now that this hack was instead conducted by the Russian government, specifically the GRU, Russia’s intelligence agency. As it turned out, tracing the hack back to the GRU didn’t take much work because Guccifer made a very simple mistake: he forgot to turn on his VPN. VPN’s help users stay anonymous online by connecting to the internet using shared IP addresses. Guccifer routinely used a VPN to cover his tracks online, but at one point simply forgot to turn it on before logging onto a social media site. The mistake allowed authorities to trace the hackers location directly back to GRU headquarters.
And the rest, they say, is quite literally history.
Hacker Fail #3: Hoist with his own petard
We saved the stupidest for last. For a while now, a transcript of a chat between hackers has been passed around the internet. In the chat, two rivals hackers were arguing with one another and threatening to attack the other. One of the hackers claimed to be using a program that allowed him to remotely delete a hard drive by simply entering in the target’s IP address. Calling his bluff, the other hacker shared his IP in the chat. However, instead of giving his actual IP, he gave him a loopback address that pointed right back at the would-be hacker’s own computer. So, when he ran the IP address through the program, he ended up wiping out his own hard drive instead of his rival’s.
Subscribe to our blog here: https://mailchi.mp/90772cbff4db/dpblog
