{"id":5089,"date":"2024-08-29T16:31:27","date_gmt":"2024-08-29T21:31:27","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/cyber-insurance-security-technologies-premiums"},"modified":"2024-08-29T16:31:27","modified_gmt":"2024-08-29T21:31:27","slug":"cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/08\/29\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums\/","title":{"rendered":"Cyber Insurance: A Few Security Technologies, a Big Difference in Premiums"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

When the BlackCat ransomware gang compromised healthcare-billing services firm Change Healthcare in February, several security controls failed: The company did not adequately protect its Citrix remote-access portal, did not require employees to use multifactor authentication (MFA), and <\/span>failed to implement a robust backup strategy.<\/a><\/span><\/p>\n

The subsidiary of UnitedHealth also <\/span>had no cyber insurance<\/a><\/span>, meaning its parent company had to foot the bill, at least $872 million, and \u2014 in hindsight, perhaps just as important \u2014 missed the benefit of a cyber insurer’s focus on what strategies can minimize claims. Both insurers and “insursec” firms, which combine insurance and security services, are awash in data on the current threat landscape and the technologies that appear to make the most difference \u2014 among them, backups, MFA, and protecting remote-access systems.<\/span><\/p>\n

Finding the right security technologies for the business is increasingly important, because ransomware incidents have accelerated over the past few years, says Jason Rebholz, CISO at Corvus Insurance, a cyber insurer. Attackers posted the names of at least 1,248 victims to leak sites in the second quarter of 2024, the highest quarterly volume to date, according the firm.<\/span><\/p>\n

“Without a doubt, attacks are increasing in terms of frequency and severity \u2014 the data is pointing to that,” he says. “We also see that when you focus on specific security controls, you can have a meaningful impact on both preventing those incidents, but also in just recovering from the incident [with fewer costs].”<\/span><\/p>\n

Cyber insurance has become a security best practice, with the vast majority of security-mature companies (84%) retaining a cyber-insurance policy while another 9% are in the process of obtaining a policy, according to <\/span>a recent survey<\/a><\/span> of 400 security decision makers by insursec firm At-Bay and analyst firm Omdia, a sister company to <\/span>Dark Reading<\/span><\/span>. Overall, 72% of all firms consider cyber insurance to be critical or important to their organization, the survey found.<\/span><\/p>\n

Three (or Five) Defenses Every Company Needs<\/h2>\n

More than 60% of insurance claims involve a ransomware incident, while email-based fraud accounts for another 20% of claims, according to At-Bay. Because most successful attacks use vulnerable or misconfigured remote-access points or compromise an individual system through email, improving security on those two vectors is paramount, says Roman Itskovich, chief risk officer and co-founder at At-Bay.<\/span><\/p>\n

The insurer charges less to customers who <\/span>use email systems with better security, such as Google Workspace<\/a><\/span>, and more for on-premise email systems, because Google users have filed fewer claims. The insursec firm also found that companies who use self-managed virtual private networks <\/span>have a 3.7 times greater likelihood of filing a ransomware claim<\/a><\/span>.<\/span><\/p>\n

“We take VPNs very seriously in how we price [our policies] and what recommendations we give to our companies … and this is mostly related to ransomware,” says Itskovich.<\/span><\/p>\n

For those reasons, businesses should take a look at their VPN security and email security, if they want to better secure their environments and, by extension, reduce their policy costs. Because an attacker will eventually find a way to compromise most companies, having a way to detect and respond to threats is vitally important, making managed detection and response (MDR) another technology that will eventually pay for itself, he says.<\/span><\/p>\n

“How do you catch someone who just made the beachhead before they access your database, or before you get to your accounting system?” Itskovich says. “For that, we find that EDRs are very, very effective \u2014 more specifically, EDRs that are managed.”<\/span><\/p>\n

Backup, But Verify<\/h2>\n

For smaller companies, email security, cybersecurity-awareness training, and multi-factor authentication are critical, says Matthieu Chan Tsin, vice president of cybersecurity services for Cowbell. In addition, secure data storage can help get a company back up and running quickly, minimizing the business impact of a ransomware attack, he says.<\/span><\/p>\n

“We look at encryption and how we help our policyholders better store the data,” Tsin says. “Having good backups, having some cloud backups, some in-house backups [are critical], because that’s truly the one thing that will get them back to business as quickly as possible.”<\/span><\/p>\n

Companies with robust backups are about 2.4 times less likely to need to pay a ransom, according to Corvus Insurance. The cyber insurer recommends a “3-2-1 policy,” where the business makes three different backups to at least two different types of media, with at least one backup kept offsite. The company found that policy holders with strong backup strategies claimed 72% lower damages than businesses who did not maintain robust backups, <\/span>according to its Q2 2024 Cyber Threat Report<\/a><\/span>.<\/span><\/p>\n

The strategy is effective enough that attackers have moved to double-ransom techniques, where they not only encrypt data to make it unusable, but also steal the data to extort the business. In 2024, nearly all ransomware incidents (93%) involved data theft, a sharp increase from 2022 when less than half of incidents involved data theft.<\/span><\/p>\n

“Backups can have a pretty meaningful impact as a kind of line of last defense, if you are getting getting attacked via ransomware,” Corvus’ Rebholz says.<\/span><\/p>\n

The Dark Horse: Disruption Risk From Third Parties<\/h2>\n

Attackers also seem to be focused on compromising aggregators \u2014 those third-party firms have some sort of privileged access to a host of other companies: Firms such as network-monitoring service <\/span>SolarWinds<\/a><\/span>, healthcare billing provider <\/span>Change Healthcare<\/a><\/span>, and auto dealership services firm <\/span>CDK Global<\/a><\/span>. In the second quarter of 2024, third-party breach events accounted for about 40% of all claims processed, up from 20% in the last quarter of 2023, according to Corvus.<\/span><\/p>\n

“We call out IT services as one of the industries that are getting hit, and that’s one of those reasons \u2014 it’s just kind of a one-to-many [relationship], right?” Corvus’s Rebholz says. “What we can see from this year \u2014 in particular, the first half of the year \u2014 is there are some big names out there that were third parties that got hit, and we can see a subsequent increase in the frequency because of that.”<\/span><\/p>\n

Major destructive attacks, such as <\/span>WannaCry<\/a><\/span> and SolarWinds, can lead to significant costs for cyber insurers, and in some ways are analogous to natural catastrophes. However, determining the right risk ratings for such events is more difficult, because the causes \u2014 and probability of occurrence \u2014 are far from simple, says At-Bay’s Itskovich.<\/span><\/p>\n

“[SolarWinds] was a threat actor delivering malicious software through the update mechanism; <\/span>CrowdStrike<\/a><\/span> was a software error in the update; CDK Global was was a ransomware attack on the company; WannaCry was a widespread vulnerability,” he says. “If you [think about] natural catastrophes, you deal with hurricanes and earthquakes and maybe a couple other secondary perils \u2014 it’s much simpler.”<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

When the BlackCat ransomware gang compromised healthcare-billing services firm Change<\/p>\n","protected":false},"author":12,"featured_media":5090,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-5089","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?fit=2560%2C1440&ssl=1",2560,1440,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?fit=2048%2C1152&ssl=1",2048,1152,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/cyber-insurance-a-few-security-technologies-a-big-difference-in-premiums-scaled.jpg?fit=2560%2C1440&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5089","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=5089"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5089\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/5090"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=5089"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=5089"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=5089"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}