Amidst the aftermath of major ransomware attacks like Lapsus$ and Cl0p/MOVEit, a surprising new player is stepping up to enhance cybersecurity measures: cyber insurers. These experts not only handle claims after an attack but also set coverage requirements and use data-driven risk assessment to hold organizations accountable for their cyber hygiene practices. How can chief information security officers (CISOs) prepare to collaborate with these influential stakeholders?
Getting to Know Your Cyber Insurer
The cyber threat landscape has become increasingly complex, leading to a significant rise in cyber insurance premiums, which have surged by 50% in the past year alone. This increase can have a substantial impact on risk management budgets, putting pressure on CISOs to demonstrate that their organizations are well-equipped to handle cyber risks. To do so, CISOs must have a thorough understanding of the role and priorities of cyber insurance companies.
Cyber insurance operates on the principles of actuarial science, which drives a global market worth $7 trillion annually. With the surge in scalable cybercrime causing financial losses for organizations, it has become evident that cybersecurity strategies need to evolve. Cyber insurers, utilizing advanced statistical methods, play a crucial role in determining the necessary changes to coverage.
The cyber-insurance market faced challenges in 2022 due to the frequency of ransomware attacks, resulting in skyrocketing premiums. As the market rebounds, insurance companies are refining their actuarial models and gaining a better understanding of cyber risks.
Prioritizing Security Measures
Underwriters are now seeking more detailed information through self-assessment questionnaires to evaluate an applicant’s security posture. From multifactor authentication (MFA) to specific group policy rules for Active Directory (AD) administrators, organizations must invest in the necessary tools or personnel to meet these requirements. Failure to do so may result in denial of coverage or higher premiums.
However, investing in these security measures can make it easier to qualify for cyber insurance and potentially reduce premiums upon renewal. By collaborating with brokers and underwriters, CISOs can create different scenarios based on cybersecurity investments. They can then use the requirements set by cyber insurers as metrics to track security goals and correlate them with insurance premiums, demonstrating the return on investment.
Conducting Audits for Cyber Insurance
The current state of cyber insurance presents actionable opportunities for security decision-makers.
Firstly, organizations should not underestimate the importance of accurate self-assessments, as they play a crucial role in the auditing and claims processes. Self-assessment surveys now ask challenging questions across various fields, such as backups, AD security, and MFA. It is essential to provide accurate information, as insurers are willing to decline coverage or take legal action against enterprises that provide false information.
Secondly, CISOs must prove that their organizations have the capabilities stated in the self-assessment forms. This requires creating and maintaining detailed records, implementing reporting systems, documenting business and security processes, and generating tamper-proof data for cyber forensics. The difference now is that CISOs need to make this cybersecurity posture visible to insurers.
Lastly, organizations are competing with each other for coverage, making it crucial for CISOs to demonstrate their organization’s superior cyber maturity. This is particularly important in vulnerable sectors like healthcare, financial services, and federal contracting. Compliance with regulations, control over the software supply chain, and proactive cyber event plans can give organizations a competitive edge. CISOs should leverage their organization’s strengths while remaining transparent about vulnerabilities.
As the cyber-insurance market stabilizes and becomes more competitive, it is essential to understand the factors that influence pricing and identify areas for improvement in cyber defense. Ultimately, the primary goal is to enhance protection against cybercrime, ransomware, and breaches by adhering to best practices. By transparently collaborating with insurers and auditors, CISOs can make informed security investments and strengthen their organization’s cyber resilience.