In a recent Applied Net 2020 encore webinar, Jason Gobbel and Jeff Kite, of Kite Technology Group, along with Dustin Mooney, of RigidBits Cybersecurity, continued the conversation from their Applied Net expert panel on the current cyber trends and threats facing your business, and effective strategies for fighting back.
THREATS
1. YOUR PEOPLE
An agency or brokerage's staff is the first potential point of breach, according to the panelists. Employees share data over email or through web-based systems on a daily basis. With this activity comes the threat of data theft, selling trade secrets, etc. Given the variances in security clearances and access to sensitive information, ensuring your people are up to date on thier cybersecurity training goes a long way when it comes to protecting your company from attacks.
WHAT TO LOOK FOR
- USB drives, copious print jobs, OneDrive downloads/exports, large compressed files, etc.
- “Credential Compromise”; relating to a breach at the entry point through which personnel access their professional email or company files
- “Threat of Opportunity”; hackers send as many emails as possible to see how many people they can get to click
- Example – Log in to access this document (provide credentials)
WHAT TO DO
- When adopting cloud systems, often there are security configurations that agencies and brokerages are responsible for enabling; spend the time determining which security settings make the most sense for the amount of sensitive data you have
- DLP (data loss prevention); invest in software if dealing with a lot of sensitive information
- Multi-factor Authentication; first token (something you know — i.e., password), secondary token (something you have — i.e., biometrics, geographical data, etc.)
- Security awareness training; continuous testing and exercises
- Email protection programs that conduct a forensic dive into emails that come in; provides visibility into who is receiving the email
- Microsoft 365 offers “Advanced Threat Protection” — one of the best ways to improve an organization’s defense against cyber threats; prevents employees from being able to click on malicious links
- Ensure people with higher level privileges have maximum protection
- Hold off on immediately wiping computers of departing employees and scrub for data breaches and clues into downloaded data in bulk prior to exit
2. YOUR DATA
The panelists discussed two types of data that exist within a company's software systems. The first is data "at rest", which is inactive data that is stored physically in any digital form (databases, spreadsheets, etc.). The second is data "in transit", which is active and can be transferred via cables and wireless transmission to other locations either within or between computer systems (i.e., man in the middle attack, session cookies). The panelists emphasized the importance of monitoring both types of data for maximum protection.
WHAT TO LOOK FOR
- Malware
- Latent threats/footholds
- Extortionware
- Phishing emails that require personal/professional data (credit card numbers, bank account, info, etc.)
WHAT TO DO
- Encrypt data at rest using points of authentication (fingerprints, passwords, etc.)
- Need to consider where data in transit lives and where it’s moving; important to encrypt channels through which your data moves
- Consider how much data you are storing
- Review compliance requirements; often will refer to data retention policy (archiving)
- If you can control how much data you are retaining, you can better protect yourself from data breaches
- Avoid having large quantities of data sitting in a purge location/archive
3. YOUR VENDORS
Insurance is a trust business; therefore, agencies and brokerages need to be able to trust the vendors they are working with to prevent threats. According to the panel experts, companies often employ third-party IT vendors to assist in bolsetering their cybersecurity defenses. Cybersecurity laws require agencies and brokerages to gain clearance to prevent data breaches when entering into contract with these vendors (i.e., via a questionnaire), especially since IT providers have been primary targets, given their access to myriad networks.
WHAT TO LOOK FOR
- Lapses in communication between your agency and vendors/IT providers
- Holes in data protection package that may leave an agency vulnerable to attacks
- Vulnerabilities within IT providers
WHAT TO DO
- It’s important to understand exactly how your third party IT providers is protecting your data
- Example – Due Diligence Package, which explains data protection in great detail (part of a “shared responsibility” model)
- Have a fresh set of eyes review the package to ensure maximum data protection
- Cultivate a trusting community between your agency and third party vendor; foster frequent communication
Don't miss the next Applied Client Network webinar! Or, visit our store to access Webinar Replays on-demand.