Amidst the aftermath of major ransomware attacks like Lapsus$ and Cl0p/MOVEit, a surprising player is stepping up in the cybersecurity field: cyber insurers. These experts not only handle claims after an attack but also set coverage requirements and use data-driven risk assessment to hold organizations accountable for their cyber-hygiene practices. So, how can chief information security officers (CISOs) prepare to collaborate with these influential stakeholders?
Getting to Know Your Cyber Insurer
The cyber-threat landscape, especially ransomware attacks, has significantly increased cybersecurity risks. As a result, cyber insurance premiums have risen by 50% in the past year, impacting risk management budgets. CISOs face the challenge of proving to their cyber insurers that their organizations are adequately prepared to handle cyber risks. To do so, CISOs must fully understand the role and priorities of cyber insurance companies.
Insurance companies rely on accurate risk quantification, and cybersecurity is no exception. Actuarial science drives a global market of $7 trillion in insurance premiums annually. With the surge in scalable cybercrime causing financial losses, organizations recognize the need for changes in their cybersecurity strategies. Cyber insurers, using advanced statistical methods, play a crucial role in determining these necessary changes.
The cyber-insurance market faced challenges in 2022 due to the frequency of ransomware attacks, leading to skyrocketing premiums. Therefore, it is more important than ever to establish a good relationship with your cyber insurer. As the market stabilizes, insurance companies are refining their actuarial models and gaining a better understanding of cyber risks.
Prioritizing Security Measures
Underwriters now require more detailed self-assessment questionnaires to evaluate an applicant’s security posture. From multifactor authentication (MFA) to specific group policy rules for Active Directory (AD) administrators, organizations must invest in the necessary tools and resources to meet these requirements. Failure to do so may result in denial of coverage or higher premiums.
However, investing in these security measures can make it easier to qualify for cyber insurance and potentially reduce premiums upon renewal. By collaborating with brokers and underwriters, CISOs can create different cybersecurity investment scenarios to gain buy-in from CFOs and the board. They can use cyber-insurance requirements as metrics to track security goals and correlate risk with insurance premiums, attaching dollar values to cyber investments.
Conducting Audits for Cyber Insurance
The current state of cyber insurance presents actionable opportunities for security decision-makers.
Firstly, accurate self-assessment is crucial during the auditing and claims processes. Cyber insurers use these assessments to evaluate organizations. The surveys ask challenging questions covering various fields, such as backups, AD security, and MFA. It is essential to provide accurate information as insurers are willing to decline coverage or take legal action if false claims are made.
Secondly, CISOs must prove that their organizations have the capabilities stated in the self-assessment forms. Creating detailed records, building reporting systems, documenting business and security processes, and generating tamper-proof data can be achieved with advanced cybersecurity tools. The difference now is that CISOs must make their cybersecurity posture visible to insurers.
Lastly, organizations are in competition with each other for coverage, and CISOs must demonstrate their organization’s superior cyber maturity. This is especially important in vulnerable sectors like healthcare, financial services, and federal contracting. Compliance with regulations, control over the software supply chain, and proactive cyber event plans are strengths that should be highlighted while being transparent about vulnerabilities.
As the cyber-insurance market stabilizes and becomes more competitive, it is crucial to understand the factors influencing pricing and areas that need improvement in cyber defense. Ultimately, the primary goal is to enhance protection against cybercrime, ransomware, and breaches by adhering to best practices. By transparently collaborating with insurers and auditors, CISOs can make informed security investments and strengthen their organizations’ cyber resilience.