CEO Advice: How to Prevent Cyber Attacks & Prepare for the Future

What is your organizations’ cyber recovery strategy and cyber risk threshold? Who has the better insight into your cyber vulnerabilities – your IT leader, or cybercriminals?

Every day, these threats are intensifying at an alarming rate. In this blog post recapping our latest webinar, Dataprise and Risk Cooperative’s CEOs, Steve Lewis and Andres Franzetti, provide analysis on how to prepare for your next cyberattack and how to prevent cyber attacks in the future. We will cover:

• Current cyber risk landscape, including types of threats, data on the average impact, and tightening insurance market environment
• Strategies for building resilience to mitigate risks today and in the future
• Cyber insurance coverage, crisis management strategies, and cyber oversight

The Current Cyber Risk Landscape + Threats

Since the beginning of 2020, there has been a ransomware attack every 10 seconds. Does that surprise you? The world has seen attackers double down on both ransomware and cyber-attacks simply because it is continuing to work and be profitable. These threats can no longer be ignored, as on average, they are costing $2.4 million an attack.

Additional Risks & Impact of Cyber Insurance Coverage

Andres Franzetti, Co-Founder, and CEO of Risk Cooperative, a national insurance brokerage, provides additional insight on the changing climate of cyber risk. Franzetti states “Over the years, we have transitioned from large scale data breaches in large corporations to business interruption and shutting down organizations around ransomware and the costs have gone up”.

Allianz Insurance Cyber, a Global Insurance company provides a review and survey of about 1700 cyber policies they hold, concluding that:

• Business Interruption losses accounted for 60% of the claims in the past 5 years
• The average cost of cybercrime for organizations has increased 70%
• 770 claims were lodged in the first 9 months of 2020. (2019 had a total of 809 claims)
• Almost 500,000 ransomware incidents were reported globally in 2019, costing at least $6.3bn
• Total ransomware costs are thought to be over $100bn

A Constantly Evolving Risk

Insurance underwriters are struggling to underwrite and price cyber risk accurately due to a lack of data and its highly evolving nature.

• While cyber insurance coverage adoption has increased 22% since 2019, premiums remain insufficient to cover claims losses.
• Loss ratios in 2020 were 73%, the highest level recorded in the last six years.

Franzetti points out that, to counter high losses, insurers are limiting coverage, exiting high risk and non-profitable markets, and incorporating:

• Rate increases range from 35% to 100%
• Additional coverage exclusions, like patch management (aka “SolarWinds” endorsement).
• Capped carrier limits.
• Reduced limits for ransomware or even excluded coverage.
• Excluded third-party caused breaches

Additionally, without robust cybersecurity policies in place, firms are no longer eligible to apply for cyber insurance coverage.

Effective, Resilient IT Infrastructure Is Table Stakes

Wondering how to prevent cyber attacks? Effective cybersecurity is the only way to effectively protect your company and its data. But Steve Lewis points out, “Resilient infrastructure in addition to cybersecurity, is equally critical”. He goes on to talk about why business continuity and disaster recovery are critical saying that worst case, “your cybersecurity is going to fail because at the end of the day there are thousands of hackers, and if they get through, you need to have a copy of your high-fidelity data somewhere that they weren’t able to hack.”

One of the biggest problems in relying on cyber insurance coverage is that most lethal threats aren’t always standard in the coverage your organization has. State-sponsored “cyberterrorism attacks” are increasingly excluded across policies. As an example, both the SolarWinds and Kaseya attack were likely state sponsored. Also, lost portable electronic devices may not be included in your coverage. If you have remote employees or employees that are on the phone or use tablets, this could be critical for you.

Integrating Your Cyber Security Strategy

Integrating your Cybersecurity strategy and your key infrastructure is critical for your organization to be as safe and prepared as possible. Some integration tips:

• Cybersecurity only works effectively if tightly integrated with your critical IT infrastructure – e.g., Business Continuity / Disaster Recovery (BCDR) and network layer infrastructure.
• BCDR also is not standalone – it too only works effectively as part of an integrated approach across cyber and at the network layer.
• This means your key network, and indeed your compute and storage infrastructure, must align with and be integrated into your cybersecurity and BCDR approaches.
• And that your main attack surface, and earliest indicators of an issue- your users -have a Help / Service desk which also is integrated into your cybersecurity and BCDR approaches.
• Your users are now using an explosion of mobile devices to work from home so all the above needs to integrate with an affirmative strategy for managing your users’ mobile devices

Strategies for Building Resilience

As an organization, do you know what your data is worth? It is important to quantify the true cost of how a potential cybersecurity incident would affect your business. By quantifying risk, you can protect IP and contract values, have the right level of business income insurance limits, and better risk control performance monitoring, which can assist in threat assessment.  

Cyber Insurance Coverage

Cyber insurance coverage allows you to transfer and mitigate financial costs incurred because of a cyber incident as well as provide critical breach response resources during a cyber event. There are many cyber policies available, but not all policies provide equal coverage.

Cyber overlaps across various insurance categories because of its nature. This can create gaps in coverage and added exposures to your organization, which is why a robust cyber policy can mitigate most potential loss scenarios.

Cyber insurance plans go beyond financial risk transfer, so cyber policies can provide a range of proactive and risk mitigation services such as training, workshops, and more. Integration with MSSP’s is another component.

Final Thoughts: How to Prevent Cyber Attacks

With the growing climate of ransomware attacks and other cybersecurity incidents, now is the time to look into your organization and ask, are we properly prepared? If you would like to learn more about how to prevent cyber attacks, watch our on-demand webinar.

We invite you to assess your own midmarket organization’s security with our Cyber Hygiene Quiz. Take this short test today to learn more on how to prevent cyber attacks, find out what to do if one occurs, and receive our personalized recommendations for managed cyber security, managed detection and response, and continuous vulnerability management.