PHILADELPHIA — Despite growing concerns about futuristic artificial intelligence and potential cyber-doom scenarios, most cyber incident losses still stem from familiar crimes like ransomware, cyber experts say.
That makes basic cybersecurity controls — everything from multi-factor authentication and endpoint detection and response to robust employee training — especially important, they said during interviews and sessions at the NetDiligence Cyber Risk Summit Oct. 5-7.
“We’ve got to just continue to hammer home on those same points around controls and multi-factor education and segmentation,” said Mike Colford, Berkeley Heights, New Jersey-based senior vice president, cyber product leader at Westfield Specialty.Most ransomware incidents still stem from some form of human error, which is impossible to prevent entirely, said Jeff Kulikowski, New York-based executive vice president, cyber and professional liability leader at Westfield Specialty.
Artificial intelligence is being used to improve methods and speed up attacks, but often with “human in the loop-type crimes” that require human mistakes to be successful, said John Menefee, Cleveland-based enterprise cyber lead at Travelers Bond and Specialty Insurance, a Travelers unit.
Therefore, controls should be deployed with human errors in mind.
“Computer security controls need to be robust enough that they can survive the human error. They just have to accept that human error is going to occur at a reasonably high rate and stop the bad act,” said Nick Economidis, Morristown, New Jersey-based chief product officer, financial lines, at Crum & Forster. “I certainly support trying to drive the human error rate as close to zero as possible, but we have to accept we’re never going to get to zero.”
Prevention of breaches was a key concern when cyber insurance was developed, Mr. Kulikowski said. Prevention is still a priority, but underwriters also recognize the need to prepare for incidents that cannot be prevented. “You need to be prepared,” Mr. Kulikowski said.
Businesses must have a plan to remain open in the event of a cyber incident, Mr. Colford said. “What do I need to do to keep my business running, maintain operations?” he said.
Network segmentation, which isolates computer functions such as human resources and point-of-sale from one another, is an important part of network security that has evolved over time, Mr. Colford said. “Now we’re looking even more granular … more of a microsegmentation,” he said.
Employee training also remains a key element of effective cyber protection.
Training staff to be highly skeptical of suspicious emails or incoming messages can create a moment of hesitation that could prevent a breach, said Mr. Menefee.
“A lot of our claims could be prevented just by having that hesitation,” he said. Briefly consulting a colleague or supervisor can also be helpful. “That communication and that skepticism to avoid being a victim is really crucial.”
Employees should understand why training is important “because one employee could basically technically create the downfall of their company with one click,” said Dana Cuoco, New York-based assistant vice president, claims, for At-Bay Insurance Services.
Training is also one of the least costly cybersecurity controls a company can implement, she said.
The majority of cyber losses “come down to authentication issues,” in some cases bolstered by social engineering, said Mr. Economidis.
This may indicate that multi-factor authentication is losing some of its efficacy against some attacks and a stronger control may be needed, he said. So-called “phishing-resistant MFA” is an improvement but not a complete solution, he said.
Compounding the challenge of improving controls is the speed at which cybercriminals can pivot between attack methods. “As soon as you get one thing under control, they pop up with another thing,” he said.
To be effective, control tools must be properly deployed and monitored, said Ashim Kapur, New York-based managing director for cybersecurity provider LevelBlue.
“You can have the shiniest tools in your network. You have the best EDR. Everything is being monitored. Everything is alerted, but nobody is monitoring,” Mr. Kapur said.
Combining cyber liability insurance and technology errors and omissions coverages in a single policy can simplify a program, but buyers should understand the trade-offs, a panel of experts said.
Brokers and risk managers should examine a company’s risk tolerance and coverage needs before deciding whether to buy blended or stand-alone policies, they said during the NetDiligence Cyber Risk Summit.
Brokers often suggest a blended policy, said Stephen Young, New York-based assistant vice president, underwriting — cyber and technology at Canopius. A blended policy can make coverage “a lot more simplified,” he said.
Buyers should consider what their risk tolerance is before purchasing, said New York-based Juliet White, head of cyber at Howden U.S. This should involve “robust” discussions about their capital base, their balance sheet and what risks they can take on, she said.
Exploring the differences between blended and separate policies should help determine which best aligns with a buyer’s needs, said Kyra Smerkanich, a partner in the Washington office of law firm Saul Ewing LLP.
A blended policy could involve a client having to practice “limit management,” she said.
“Their first question should be: Does this policy coverage meet my needs, and do I understand the scenarios in which I will be covered for loss?” said Brian Lewis, cyber broking leader at Lockton Re.
Ransomware remains a persistent source of claims and losses even as cybercriminals have changed their strategies for treating data, industry experts said.
Criminals are turning to sorting and sifting data for information, rather than just encrypting it, using artificial intelligence to fuel their efforts, according to a panel at the NetDiligence Cyber Risk Summit.
“They’re not only stealing the data; they’re interrogating it to understand who the victim is,” said Andrea Vega, senior vice president, Latin America, cycomms and cyber risk, for Cypfer, a Miami-based cybersecurity firm. Analyzing stolen data can guide attackers in tailoring breaches for maximum effect, she said.
Cybercriminals can capitalize on the exfiltrated data using artificial intelligence, said Peter Hawley, head of strategic relationships for Digital Asset Redemption, a Chicago-based cryptocurrency company. “They’re much quicker to locate troublesome emails or the sensitive transactions that the company has been involved in,” he said.
Artificial intelligence has vastly reduced the “dwell time,” or the time an attacker spends in a compromised system, said Dan Ryan, managing director in the cyber risk practice of Kroll.
With AI, dwell time in some cases has shrunk to hours from days.
Advances in both recovery operations and law enforcement have also made encrypting data less desirable for attackers, the panelists said.
One criminal group relayed the message that they would no longer encrypt data because the time and effort involved were attracting the scrutiny of law enforcement and also leading to a lower financial return on their crimes, said Virginia Romero, associate director, cyber incident response lead at S-RM, a London-based cyber security firm.
——————————————————-
Click Here For The Original Source.
