Cybersecurity Archives - The Reschini Group

The Reschini Blog: Cyber Emergency Drills Build Vital Muscle Memory

From days spent in Kindergarten, right up until your most recent fire drill at the office, we have been conditioned to respond to emergencies through repetition. Walk calmly to the nearest exit, gather in a pre-ordained spot, and account for everyone before notifying first responders of any missing associates. We have it all down, thanks to muscle memory.

But what about a cyber emergency? What must be done in that scenario? Who is responsible for each function? How do we know we’re being effective? Those muscles may not have ever been stretched, but it’s imperative that this happen.

Knowing what to do in the event of a cybersecurity incident is vital to protect sensitive and crucial data. Poorly coordinated responses not only have the potential to increase liability, but also can impact how insurance claims are paid following a breach.

Properly preparing for a cyber emergency includes:

Identifying who needs to be on the response team.
Describing each person’s roles and responsibilities.
Knowing how to categorize an incident.
Determining how to track milestones and save key evidence.

While most states require certain businesses to have written policies, actually practicing them is the only way to make those policies meaningful. Once a plan has been established, the organization should run tabletop drills, presenting various scenarios and measuring how the team responds in real time. Only through this kind of positive, productive repetition can the required muscle memory be developed to blunt, contain, and successfully recover from a cyber security emergency.

For more insurance-related information on this and other topics, contact the professionals at The Reschini Group.

The Reschini Group provides these updates for information only, and does not provide legal advice. To make decisions regarding insurance matters, please consult directly with a licensed insurance professional or firm.

The Reschini Blog: Cybercrime Impacts All Industries

Working in IT today is like running a marathon sprint.

Not only do the digital professionals need to keep their systems and users running smoothly at a baseline level, they also need to stay up-to-date on new applications and software packages and how they could be used to advance the growth of their organizations.

And then there’s the ever-present specter of cybercrime – an unending and constantly expanding web of innovative and malicious attempts to steal information, hold data for ransom, and generally take control of the digital identity of companies. What’s worse, no industry is immune to these dark forces, who can wreak havoc and extort enormous financial damages.

According to the Pittsburgh Technology Council, most CEO surveys rank cybersecurity threats as a top-five risk, regardless of industry type. CEOs care about data breaches and ransomware attacks because those attacks have become so common, regardless of organizational size or IT staff experience. Furthermore, CEOs know that a ransomware infection or a data breach can put the very life of their organizations at risk.

IT teams have trouble keeping a current and standardized set of security best practices, because to do so – with proper patches and policies amid a continuously changing environment – is time consuming, expensive, and downright difficult. One solution comes in the form of enterprise cloud infrastructure platforms, which offer a secure-by-default cloud experience with best-in-class security features incorporated from the start.

Using advanced tools like this can free internal IT staffs, since they only need to work with the cloud infrastructure provider to select and configure features most relevant to the organization’s needs and vulnerabilities. Those IT professionals can then spend their time more efficiently, working on strategic projects while reducing exposure to cybersecurity issues.

Keeping the bad guys at bay online doesn’t have to be a marathon sprint, where the best efforts simply can’t keep running at full capacity. You can bring your cybersecurity exposure under better control, thereby improving your insurance coverage against losses.

The experts at The Reschini Group can provide specific guidance in this area. Contact us today to learn more.

The Reschini Blog: Cyburgh Event Offers Cybersecurity Insight

The Reschini Group prides itself on offering pertinent, credible, practical guidance to its business customers regarding the constant threat of cyber crime. With a presence in One Gateway Center in Downtown Pittsburgh, our firm remains connected to the city’s growing reputation as a center of cybersecurity advances and trends.

One of those premier cybersecurity-related events is “Cyburgh,” an annual conference of national and international experts, sponsored by the Pittsburgh Technology Council (PTC).

According to the PTC, vulnerability affects the bottom line of the region’s businesses. The Cyburgh initiative aims to advance Pittsburgh as an internationally recognized leader in cybersecurity. Through presentations and idea exchanges, Cyburgh is a forum for cybersecurity professionals to engage with and learn from peers, thought leaders, and solution providers.

Now in its sixth year, Cyburgh is a virtual event, scheduled this year in three sessions from May 25 through May 27. Participants will learn from thought leaders and subject matter experts from Pittsburgh and beyond. The focus will be on the business and strategic areas that leaders and technical professionals need to know about.

The event is geared toward Chief Executive Officers, Chief Operations Officers, Chief Information Officers, Chief Information Security Officers, Chief Privacy Officers, Practitioners, Business Leaders, and IT Managers in corporate, small business, academic, and non-profit organizations who want to gain vital insight about protecting their enterprises and mitigating risk.

Cybersecurity remains an ongoing issue for businesses of all sizes, in all markets, and across all industries. Our team offers expert advice on protecting our customers through the proper insurance packages. Events like Cyburgh open the door to a wider, deeper exploration of the many tentacles of cybersecurity, and we encourage all business owners to take full advantage of this special event.

You can register for Cyburgh 2021 at:

https://www.pghtech.org/events/2021Cyburgh_1#2021Cyburgh_1

The Reschini Blog: The Ramifications of Ransomware

It’s one of the oldest plots in the movies. A person or object of great value gets kidnapped. A demand for money or some other form of tribute is demanded. And either the ransom gets paid, or a rescue ensues. The end, curtain down, talk about the film on the ride home. Nice and tidy.

Until it happens in real life, and the true impact of ransomware – the infiltration of your computer system, complete with unwanted access to your most sensitive information – becomes all too clear.

And don’t think it couldn’t happen to your small business. Ransomware strikes at systems large and small. In fact, a small contractor servicing a large corporation can serve as one of the easiest “back doors” for a hacker to make an enormous score.

In 2019, the Internet Crime Complaint Center (IC3) received 2,047 complaints identified as ransomware, with losses in excess of $8.9 billion. That’s billion. With a “b.” Even while citing those statistics, IC3 also insists that instances of ransomware remain vastly underreported, so the true total of losses is probably much higher.

Intricate, elaborate, expensive software systems designed to block sophisticated ransomware attempts can be effective, and have real value in the ongoing fight. But it’s also important to remember that ransomware hackers can gain all the access they need by the simplest of methods, as well. A targeted phishing attack that gains the credentials of top managers can parlay that information into a quick and substantial ransom payment.

So how to avoid the chilling and costly incidence of being held for ransom by outsiders capturing your proprietary data? Establish a relationship with federal law enforcement authorities and trusted organizations like the non-profit National Cyber Forensics-Training Alliance (ncfta.net), conduct continuous employee awareness training that includes top officials of the company, increase knowledge of ransomware tactics and trends to stay ahead of the threat, and review your insurance coverage against losses attributable to ransomware attacks.

The professionals at The Reschini Group can work with you to audit your exposures and craft a policy package to provide the proper level of protection. Because being held for ransom is not a plot device in a movie that you can walk away from. It’s all too real.

Testing Cyber Security Systems

Cybercrime is set to cost companies more than $6 trillion per year by 2021. That’s trillion, with a T. Nobody wants to be in that pile. That’s why testing your systems for cyber security makes a lot of sense.

Three main tests are used to safeguard businesses against cyber attacks:

Vulnerability scanners – This approach assesses the computers in your business network for weaknesses: entry points that can be exploited by cybercriminals hoping to gain access to your data. Vulnerability scanners act like hackers to investigate these potential vulnerabilities. The aim of a vulnerability scan is to build a strong sense of the state of your cybersecurity setup from an internal and external perspective, identify weaknesses, and improve your security to better protect against these risks.

Penetration testing – Here, cybersecurity experts purposefully ‘attack’ a network to review how secure it is. It simulates a real attack, but in a controlled way. As such, the term ‘ethical hacking’ is sometimes applied to penetration testing. While vulnerability scans highlight any weaknesses in your business network, penetration tests take this a step further by determining what kind of malicious activity is possible if those weaknesses are exploited.

Program update checks – These are important because software that is not regularly updated gives attackers more chances of infiltrating your system and your business. Some program settings may allow automatic software updates, and others will ask your permission. All users should regularly check to ensure that all available updates are accepted (or scheduled for a convenient time) on every device they are responsible for.

The continuously and rapidly evolving cyber world offers tremendous competitive advantages and cost efficiencies. The dark side of cyber operations moves just as swiftly, though. Check the status of your cybersecurity insurance by contacting the professionals at The Reschini Group.

Excerpted from: https://blog.avast.com/cybersecurity-tests

Back to Basics: Top Five Ways to Avoid a Cyber Attack

Hackers and digital saboteurs are here to stay. But that doesn’t mean surrendering to their threats and actions. Sometimes the best ways are the tried and true ones, and that is generally true when it comes to cybersecurity, as well.

According to Cybersecurity Insiders*, here are the top five ways to protect your company from a cyber attack:

Hardware: Have secure and sophisticated hardware, which is password protected and backed up by two-way authentication. Also, it is better if you don’t overlook the effectiveness of protecting your data storage drivers. Because if neglected, then it gives an opportunity to anyone and everyone to walk away with your firm’s sensitive data.

Physical Security: Most data breaches occur when stolen equipment reaches the hands of hackers. For instance, if an employee loses his/her laptop, then sensitive data can easily reach the bad guys. So, outline physical security strategies storing the data on the cloud, which is protected by multiple security layers, and imposing responsible security policies among all employees.

Encrypting Data: Encrypted data becomes useless to a hacker, most of whom could not break into the encryption in the first place.

Backing Up Data: Having a backup copy of the latest data protects you even if a hacker accesses your system. The backup needs to be done in an effective manner and must be in an immediately retrievable form.

Cybersecurity Insurance: Should an attack occur, most cybersecurity policies today not only cover the financial loss caused from data theft but also help in co-paying the costs involved in recovering data, including paying data recovery experts and buying new hardware and software.

Don’t let your guard down. Protect what’s yours. The professionals at The Reschini Group are available to help determine some appropriate options for your specific circumstances.

* https://www.cybersecurity-insiders.com/ways-to-prevent-cyber-attacks-on-your-company/

Unabated: Current Cybersecurity Trends

It’s such an obvious question, but one that bears repeating: Does your business have adequate contingency plans in the case of a cyberattack?

From malware and loss of data to reputational damage, the fallout from an attack could harm your business significantly, and from a number of different and distinct directions – not the least of which is business interruption and the major loss of income it could represent.

Here are a few of the most common cyberattacks seen in 2019 and continuing so far this year, according to FounderShield*:

Malware Attack – When a cybercriminal installs malicious software in your system without your consent, wreaking havoc on your daily business operations.

Phishing Attack – When a cybercriminal sends fraudulent communications via email that may seem legitimate—typically appearing from a trusted source—but instead is meant to install malware or trick people into handing out personal and sensitive information.

Man-in-the-Middle Attack – When a cyberattacker stealthily slips into your system between a two-party transaction, such as public Wi-Fi, interrupting your traffic by installing malware, giving the cybercriminal plenty of time and space to steal your information.

Denial-of-Service Attack – When used by competitors, Denial-of-Service (DoS) attacks overtake your networks to drain your resources and bandwidth by stopping your system from fulfilling authorized requests—from clients or customers, for example.

SQL Injection Attack – When a cyberattacker uses malicious code to force your Structured Query Language (SQL) servers into divulging sensitive information, potentially modifying your data, administrative operations, or operating system.

Mitigating such data breaches requires substantial costs in notifying customers, providing credit-monitoring services, restoring files and computer systems, dealing with lawsuits, and paying regulatory fines, all of which create additional financial losses following the cyberattack. A cyberattack could also put your reputation at risk. While plenty of trustworthy companies experience breaches, such an episode erodes a brand’s image of security and trust.

The threat from cyberattacks continues unabated, so make sure you’re adequately protected with cybersecurity insurance. Talk with the professionals at The Reschini Group to learn more.

* https://foundershield.com/cyber-insurance-trends-2020/

Not Quite Enough: General Liability Insufficient for Cyber Coverage

Take a look at your business’ general liability insurance policy, and you’ll probably see a reference to property damage. To the uninitiated, that sounds like it covers a multitude of potential events – even an online hack or attack, right?

Wrong. Seriously wrong.

Cyber liability insurance is not automatically included in a general liability policy. Cyber liability insurance, priced and purchased as its own policy, can pay for expenses if a small business suffers a data breach or malicious software attack, including customer notification, credit monitoring, legal fees, and fines.

According to Insureon.com, when criminals infiltrate a network, steal data, or hold data hostage, the business they steal from could be held liable. A data breach at a small business can end up costing thousands of dollars in customer notification expenses, legal fees, and fines or settlements. In fact, the average cost of a small business data breach is $86,500, according to the Internet security firm Kaspersky Labs. The coverage included in cyber liability insurance pays these costs, allowing your company to survive a breach.

And don’t assume that hackers won’t come after small businesses. A recent report by Verizon found that 61% of all cyberattacks hit small businesses, and that those attacks often succeed because small businesses are less likely to have a strong defense.

Cyber liability insurance is key for companies that handle sensitive information, work in the cloud, operate in cybersecurity, or typically handle:.

Credit card or bank account information
Medical information
Social Security or driver license numbers
Customer names, email addresses, phone numbers, and addresses
Cybersecurity for other businesses

Contact the professionals at The Reschini Group to learn more about fashioning an appropriate cyber liability insurance package for your business. Your existing general liability policy may not be quite enough.

Staying Safe: Five Tips to Greater Cybersecurity

Cybersecurity practices remain a key focus for both the Financial Industry Regulatory Authority (FINRA) and the U.S. Securities and Exchange Commission (SEC). An article* in Forbes magazine summarizes five best practices cited by these organizations to mitigate the risk of cyber attacks:

Governance

FINRA has found that although Boards of Directors are actively focused on cybersecurity, during their regulatory exams up to two-thirds of companies were found to have deficiencies or weaknesses in their policies and procedures. Cybersecurity policies need to be specific and articulate the procedures necessary for implementation.

Risk Assessment

Risk assessment should be an ongoing process as opposed to a single point in time. Companies should gather and evaluate indicators of potential risks on a monthly, quarterly and annual basis. They should also look to what’s happening at other organizations and other industries, both to gain best practices ideas and to help thwart attackers’ plans.

Cybersecurity Training

Because employees represent the biggest risk, training needs to be conducted regularly and be varied, both in method (such as in-person, email, blogs) and with different topics (such as passwords or visitor access). Show employees what good cyber behavior looks like so they may bring those practices home with them to protect their families and personal systems, as well.

Access Management

While the SEC watches how organizations conduct reviews of access rights periodically, it is estimated that about half either do not follow policies and procedures for terminating access rights, or inadvertently provide unauthorized system access to users contrary to established policy. Best practice is for any remote access to a core network to be protected by two-factor authentication.

Vendor Management

Risk from vendors needs to be addressed and constantly vetted and assessed. One idea calls for the business to obtain permission before bringing on any new vendor that handles, touches, or stores data. To make it easier, create a list of pre-approved vendors.

The team of professionals at The Reschini Group can help assess your cybersecurity exposures and offer comprehensive insurance solutions to transfer cyber risk and protect your company. Contact us to learn more.

* https://www.forbes.com/sites/joannabelbey/2017/06/30/how-to-avoid-cyberattacks-5-best-practices-from-sec-and-finra/#56ae09df1a16

It CAN Happen To You: Cybersecurity Claims Impacting All Levels of Business

The market for cybersecurity coverage remains competitive, and more business owners have decided to invest in insurance policies to protect from hackers and malware. That’s the good news.

But the risk still outweighs the precautions taken, according to insurance industry watchers – and that’s the bad news. Not enough clients are adopting the coverage, especially when proof continues to pile up that no organization is safe from a cyber event.

A 2019 Cyber Readiness Report from specialty provider Hiscox found that 53% of U.S. businesses reported a cyber attack in the previous 12 months, from 38% the previous year. In all, 45% of those companies experienced three or more attacks in the past year. Yet 27% of firms have no plans to adopt cyber insurance, according to the report.

Considering the potentially devastating cost of recovering from a cyber attack, that statistic becomes especially alarming. According to McAfee’s 2018 Economic Impact of Cybercrime Report, the global cost of cybercrimes is estimated to be between $445 billion and $600 billion. But less than 20% of all businesses have purchased cyber insurance. That rate continues to increase, but not nearly to the degree to guard against harm to the level of exposure that remains.

Adopting a line of thinking that “It won’t happen to me” may be the biggest mistake of all, according to industry experts. Business owners who only think of cyber attacks in terms of data breaches miss the other risks that exist, including extortion and business interruption – all of which represent serious and costly issues that need to be addressed through coverage.

The team at The Reschini Group can help put together the best package of cyber protection coverage for your business, regardless of size, scope, or industry. Contact us to learn more.