- News & Resources: Listings >
- Blog
- Brand and Network Considerations When Adopting AI Corporately
- Integrating XDR, SIEM, and SOAR
- 3-2-1 –Go? Not so quick, this time.
- 5 Things a CISO Shoud Know
- 10-Step Patch Management Checklist
- Penetration Testing vs. Breach Attack Simulation
- Current big cyber breaches and impact on businesses
- Smart Infrastructure Gets Lit Up!
- Securing Industrial IoT: The Missing Puzzle Piece
- 7 Common Cybersecurity Mistakes Made by SMBs
- The Future of Physical Security: Cloud-Based Systems
- Autonomous and Sensor Technology Use Surging
- 2024 Facilities Trends Will Require Facilities and IT Teams to Work in Tandem
- NGFW vs. WAF. What’s the Right Firewall for You?
- Chris Hadfield’s Words To Live By
- Industrial Revolution 4.0 + IIoT
- Digital Fluency Drives Innovation
- Your Cloud Needs Protecting, Too
- Your building alarm systems could become obsolete. In 2024!
- Zero Trust 2.0: Zero Trust Data Resilience (ZTDR)
- We just got, or got used to, Wi-Fi 6. What is Wi-Fi 7?
- What Does the Board Need to Know? Business Metrics that CISOs Should Share – 4th and Last in a Four-Part Series
- Why 2024 is the Year for AI Networking
- International Women’s Day is Tomorrow – Great Time to Think About…
- Data-Centric Security Step One: Classifying Your Data
- The Network – Unsung Hero of Super Bowl LVIII
- What Does the Board Need to Know? Business Metrics that CISOs Should Share – Third in a Four-Part Series
- Boosting IT Team Performance by Fostering Intuition, Curiosity and Creativity
- Breach Remediation Costs Can Wipeout Bottom Line and Business
- Hoodied Hackers Now Favour Hugo Boss
- What Do You Need to Tell the Board? Business Metrics that CISOs Should Share – Second in a Four-Part Series
- How to Get People to Re-Engage After the Holidays
- What Does the Board Need to Know? Business Metrics that CISOs Should Share – First in a Four-Part Series
- Android Devices MUST be Updated + IT Departments Being Cut as Privilege Escalation Escalates
- Today’s Common Cloud Migration and Management Concerns
- Protect Your Healthcare Network from Cyberattack – Lives are at Stake
- Happy Halloween: Black Cats Lead to Boo….Hoo.
- Insurance Underwriters are Protecting Their Flanks
- Insurance Companies Cracking Down as Cybercriminals Become Better Business Builders
- Scary Cyberattacks Stats
- Parents, Profs and IT Professionals Perceive Back-to-School Through Different Lens
- Zscaler’s new IDTR and other tools that leverage generative AI
- Vanquish Vaping, Vandalism and Villainy
- Fabric for Fast-Paced Environments
- Changes to Cyber Insurance Requirements – What you Need to Know
- Cybersecurity Readiness – Newly Released Report
- Passwords Leaked…Again
- 10-Step Patch Management Checklist
- Remote – Again – For Now… and Still Maintaining Engagement
- Protecting Pocketbooks, Passwords and Property from Pilfering
- Raspberry Robin: Highly Evasive Worm Spreads over External Disks
- Cisco Introduces Responsible AI – Enhancing Technology, Transparency and Customer Trust
- Managing Customer Trust in Uncertain Supply Chain Conditions
- Hope on the Horizon
- Toys of Tomorrow… What will spark your imagination? Fuel your imagination?
- Protecting Purses and Digital Wallets
- The Password that Felled the Kingdom + MFA vs 2FA
- The MOE’s RA 3.0 and Zscaler
- 7 Critical Reasons for MS Office 365 Backup
- Penetration Testing Important, but…
- Social Engineering and Poor Patching Responsible for Over 90% of Cybersecurity Problems
- Breach Incidence and Costs On the Rise Again + 5 Ways to Reduce Your Risk
- Cybersecurity Insurance Policies Require Security Audits and Pen Testing
- Wireless strategies for business continuity gain importance as enterprise expand IoT, cloud, and other technologies
- How Cybercrooks are Targeting YOU
- Enabling Digital Transformation with Cisco SD-WAN
- WFH Post Pandemic – What It Will Look Like. What You’ll Need.
- Leaders to looking to the IoT to improve efficiency and resiliency
- Cyber Security Vernacular – Well, some of it, for now
- Why You Need Disaster Recovery, NOT Just Back-Ups
- 10 Reasons Why Having an Expert Manage Your Cybersecurity Makes Sense and Saves Dollars
- Converting CapEx IT Investments into Manageable OpEx
- The Hybrid Workplace – Planning the Next Phase
- Cisco Cloud Calling: Empowering Customers to Thrive with Hybrid Work
- When You Can’t Access the Cloud
- How to Keep On Keeping On
- New Cisco Research Reveals Collaboration, Cloud and Security are IT’s Top Challenges
- Threats from Within on the Rise
- Cloud Covered? If Not, Take Cover!
- Zero Trust and Forrester Wave Report
- Password Based Cyber Attack: Like Leaving Keys Under Doormats
- So, What’s Up With Sensors?
- Sensors and Systems Create a Digital “Last Mile” and Help Skyrocketing Costs
- Scanners Provide Peace of Mind for Returning Students and Workers
- Sensors Improve Operations and Bottom Line… Easily and Cost-Affordably.
- Cisco Meraki Looks at 2021
- 2020 Holiday Shopping: Cybersecurity and Other Tips to Safeguard Wallets and Systems
- How to make the most of the technology you have
- Personnel, Planet and Business Progress: More Interdependent Than Ever Before
- Sure… you can get them all in the boat – but can you get them to work well together?
- Pushing the Zero Trust Envelope – Cisco is Named a Leader in the 2020 Forrester Zero Trust Wave
- Cloud Data Must be Protected, Too!
- Don’t Let Anyone Get the Dirt on You – Make It Instead!
- How IoT Devices Can Help You and Your business
- WebEx – A World of Possibility
- Creating Your Breach Response Plan Now Will Save You Thousands Down The Road
- Been hacked? Here’s what you must do next.
- The Need for Pen Testing is At an All-Time High
- 5 Ways an IT Reseller Improves Your Performance and Peace-of-Mind
- 5G and Wi-Fi 6: Faster, more flexible, and future ready. Are you?
- Network and Data Security for Returning and Remote Workers + Disaster Recovery Symposium
- Collaboration and Cisco WebEx: Protecting Your Data
- Thursday’s Virtual Conference Tackles Today’s Supply Chain Trials and Tribulations
- 10 Tips to Reduce Cloud Storage Risk
- COVID-19 Crisis Fuelling IT Spending
- Supply Chain/Logistics Experts Share Their Expertise
- Cisco Breach Defence Overview
- Announcing Our New Website and Blog
![Changes to Cyber Insurance Requirements – What you Need to Know](https://cloudmanaged.ca/wp-content/uploads/bfi_thumb/May-1-shutterstock_61550143-3k687yyu0pku10bk0pmc5m.jpg)
More changes? If you’re like most people, seeing changes to what’s covered, along with the cost of your current cyber insurance policy, you may be wondering if it’s worth the cost. It is, of course, but that doesn’t make the budget hit any less painful.
Insurance company loss ratios have been over 60% consistently for the past five years, causing some insurance underwriters to discontinue the coverage. Others are raising their premiums to compensate.
Globally, premiums increased 94% from 2019 – 2022, and we are certainly seeing similar increases here, at home.
There are two key ways in which this is impacting Canadian organisations.
1. Nation-state attacks are being excluded from many policies.
There has been a significant increase in nation-state attacks since the pandemic took hold, as well as other types of cyberattacks originating from outside Europe and North America.
Today, it’s highly possible that a stakeholder with whom you collaborate regularly, or one of the firms within your supply chain, manufacturers its products in China, or elsewhere offshore. One of these companies may do business with a company in Russia, Iran, North Korea or the many other countries behind such attacks.
Now, your network could be vulnerable to a nation-state threat vector. And all it takes is the smallest of security shortcomings, somewhere along the line, for this to morph into a massive problem for you. It’s like a small drop in the ocean rippling out until it becomes a tsunami-sized wall.
This is now so problematic that many insurance companies no longer cover nation-state attacks. These underwriters are likening them to acts of war, which are not covered by most policies. Merck & Co.’s successfully took its insurers to court in 2022, arguing that the exclusion should only apply when use of armed forces was involved as part of a recognized conflict. The court agreed.
The result: As of March 31, 2023, Lloyds of London (one of the largest insurers in the world) introduced clearly-defined exclusion clauses for state-back cyberattacks. Other underwriters are following suit.
2. Insurance Underwriters are Tightening Policy Requirements
Today, it is common for insurance companies to require that clients be able to prove they are doing everything they can to ensure their networks are secure, and that employees have been trained in terms of processes to follow.
Typically, in the initial meeting to set up or change your cyber insurance policy, you will be asked questions such as:
-
When was your last security audit and what did it reveal?
-
What MFA solution do you use?
-
What are your response plans for both cyberattacks and recovery from those cyberattacks – and can we get a copy?
-
Do you store customer data such as names, addresses, credit card information – and how are you protecting that data?
-
As employees bring their devices to work (BYOD), how do you protect those devices, ensure the devices are healthy, and ensure the employees are who they say they are?
Although requirements vary slightly from carrier to carrier, based on the above questions, it will come as no surprise to find that most insurers require the following:
-
A recent security assessment, including penetration testing report.
-
Some form of multifactor authentication. Duo, which is offered by Cisco, is one good solution; we also offer others, including fob options when unions prevent cloud-based applications that impact personal devices.
-
Data backup and recovery software solutions. Many insurance companies are also starting to require that firms show they have solid disaster recovery plans and processes in place.
-
Having an Uninterruptible Power Supply (UPS) that will keep networks, equipment, point-of-sale terminals, laptops and other critical tools running in a power failure, helping to prevent data loss and apparatus damage, until your generator kicks in… or at least until you are able to shut down everything safely, if you don’t have a backup generator. Sometimes that buffer can be the difference between being able to get up and running again quickly, or not, and your insurance carrier knows this, too.
One of our partners, Eaton, has a wide selection of options – one that is likely right for you.
-
Ensuring that your Remote Desktop Protocol (RDP) is not exposed. Although the remote display and input capabilities are great for windows-based applications running on a server; it’s important that vulnerabilities are locked down.
-
Secure email – insurers want proof that you are using email filtering, validation and pre-screening for potentially malicious attachments and links.
-
Endpoint security. Again, we have partners with excellent products/ solutions for protecting endpoints.
-
Firewalls that block unsolicited and unwanted incoming network traffic and/or some form of SASE to protect your perimeter. The are excellent offerings from Zscaler, Extreme Networks, Cisco and Palo Alto for this.
-
Internal security controls, including policies, tools, process and procedures that have been implemented to safeguard your environment.
-
A vendor management plan that shows access rights, processes and protocols for revoking privileges when access is no longer needed, ways of logging and monitoring remote access by third-party companies, as well as “business” continuity plans for change of vendors and other solution providers.
-
Some insurers also require that your data be resident on servers in your home country and/or on servers in approved countries – and that your providers can show redundancies as needed.
With the way things have been changing over the past 12 months, we always recommend that clients review their cyber insurance policies carefully to ensure they are fully compliant as nearly 20% of claims were rejected in 2022.
We can help you with the audit, ensuring that you are compliant based on what your insurance company requires – and provide you with a plan for putting the necessary solutions in place, if you aren’t. If you’d like to learn more, or arrange for a security audit (usually the starting point), please feel free to contact us at [email protected] or call us at 416.429.0796 or 1.877.238.9944 (toll free).