PHILADELPHIA – Despite growing concerns about futuristic artificial intelligence and potential cyber-doom scenarios, most cyber incident losses still stem from familiar crimes like ransomware, cyber experts say.
That makes basic cybersecurity controls – everything from multi-factor authentication and endpoint detection and response to robust employee training – especially important, they said during interviews and sessions at the NetDiligence Cyber Risk Summit last week.
“We’ve got to just continue to hammer home on those same points around controls and multi-factor education and segmentation,” said Mike Colford, Berkeley Heights, New Jersey-based senior vice president, cyber product leader at Westfield Specialty.Most ransomware incidents still stem from some form of human error, which is impossible to prevent entirely, said Jeff Kulikowski, New York-based executive vice president, cyber and professional liability leader at Westfield Specialty.
Artificial intelligence is being used to improve methods and speed up attacks, but often with “human in the loop-type crimes” that require human mistakes to succeed, said John Menefee, Cleveland-based enterprise cyber lead at Travelers Bond and Specialty Insurance, a Travelers unit.
Therefore, controls should be deployed with human errors in mind.
“Computer security controls need to be robust enough that they can survive the human error. They just have to accept that human error is going to occur at a reasonably high rate and stop the bad act,” said Nick Economidis, Morristown, New Jersey-based chief product officer, financial lines, at Crum & Forster. “I certainly support trying to drive the human error rate as close to zero as possible, but we have to accept we’re never going to get to zero.”
Prevention of breaches was a key concern when cyber insurance was developed, Mr. Kulikowski said. Prevention is still a priority, but underwriters also recognize the need to prepare for incidents that cannot be prevented. “You need to be prepared,” Mr. Kulikowski said.
Businesses must have a plan to remain open in the event of a cyber incident, Mr. Colford said. “What do I need to do to keep my business running, maintain operations?” he said.
Network segmentation, which isolates computer functions such as human resources and point-of-sale from one another, is an important part of network security that has evolved over time, Mr. Colford said. “Now we’re looking even more granular … more of a micro segmentation,” he said.
Employee training also remains a key element of effective cyber protection.
Training staff to be highly skeptical of suspicious emails or incoming messages can create a moment of hesitation that could prevent a breach, said Mr. Menefee.
“A lot of our claims could be prevented just by having that hesitation,” he said. Briefly consulting a colleague or supervisor can also be helpful. “That communication and that skepticism to avoid being a victim is really crucial.”
Employees should understand why training is important “because one employee could basically technically create the downfall of their company with one click,” said Dana Cuoco, New York-based assistant vice president, claims, for At-Bay Insurance Services.
Training is also one of the least costly cybersecurity controls a company can implement, she said.
The majority of cyber losses “come down to authentication issues,” in some cases bolstered by social engineering, said Mr. Economidis.
This may indicate that multi-factor authentication is losing some of its efficacy against some attacks and a stronger control may be needed, he said. So-called “phishing-resistant MFA” is an improvement but not a complete solution, he said.
Compounding the challenge of improving controls is the speed at which cybercriminals can pivot between attack methods. “As soon as you get one thing under control, they pop up with another thing,” he said.
To be effective, control tools must be properly deployed and monitored, said Ashim Kapur, New York-based managing director for cybersecurity provider LevelBlue.
“You can have the shiniest tools in your network. You have the best EDR. Everything is being monitored. Everything is alerted, but nobody is monitoring,” Mr. Kapur said.
——————————————————-
Click Here For The Original Source.
