Cyberattacks continue to be a major threat for organizations of all types and sizes. In addition to the old and familiar dangers, new dangers have emerged, including the recently discovered Log4j vulnerability. It looks like 2022 is shaping up to be another challenging year for cybersecurity. Here’s a look at the risks, insurance impacts and best practices.

The Log4j Vulnerability

If you’re not a computer programmer, you may not have heard of Log4j until recently. Log4j is a very common piece of software used to log activities in many different programs. Unfortunately, hackers may be able to exploit a recently discovered vulnerability in order to gain access to computer systems. In fact, it’s already happening. CSO says that a gang of cybercriminals has been using the vulnerability to plant cryptominers and backdoors.

This is a serious threat that requires immediate attention. The FTC has said that companies that do not take remedial steps to identify and patch instances of Log4j software may be in violation of the FTC Act. CISA provides guidance on the Log4j vulnerability.

Ransomware and Business Email Compromise

Ransomware continues to be one of the most urgent business exposures. According to Property Casualty 360, ransomware attacks surged between 200% and 300% in 2020 and have continued to double since then. Ransom demands have also increased substantially, and to put pressure on victims to pay, attackers have adopted new strategies that include denial-of-service attacks, victim harassment and threats to leak data.

Business email compromise (BEC) is another serious and evolving risk. These social engineering schemes target individuals in an attempt to convince them to make wire transfers, share sensitive information, click on malicious links or complete other actions. Armed with new technology, including deepfake video and audio, scammers may be successful in launching even more convincing attacks in the months and years ahead.

The Impact on Cyber Insurance Rates

Cyber insurance rates have skyrocketed. According to the Council of Insurance Agents & Brokers, cyber insurance rates climbed 27.6% in the third quarter of 2021. The increases are attributed to the rise in ransomware and other cyberattacks.

In addition to rate increases, businesses may encounter reduced capacity and stricter underwriting. To secure good coverage and to avoid claims, it’s important to make sure cybersecurity policies are in line with current best practices.

Cyber Best Practices

Cyberthreats are everywhere, so businesses must stay vigilant.

• Install software updates and patches as they become available, including the Log4j patches. According to SC Media, 57% of successful breaches can be linked to unpatched systems. Despite this, many businesses struggle to apply software patches in a timely manner, leaving them open to attacks. In fact, two years after the WannaCry ransomware attack resulted in losses of up to $4 billion, some organizations still hadn’t applied the patches needed to protect themselves against the malware.
• Use multi-factor authentication. In addition to using strong passwords and not sharing them with others, multi-factor authentication can help keep your systems secure. Some cyber insurance carriers will not provide coverage for accounts not using multi-factor authentication.
• Provide all workers with cybersecurity training and reminders. This cannot be the sole domain of the IT team anymore. Everyone has to take responsibility for cybersecurity. Training should include how to spot malicious links and spoofed emails and how to keep accounts private and protected.
• Use settings that prioritize cybersecurity. For example, the principle of least permission can limit who has access to sensitive systems, and encryption can help keep data secure if it falls into the wrong hands. Conduct an expert review of your computer systems.
• Back up data. Many ransomware attacks now involve threats to leak or sell data, so backups are not a foolproof defense against attacks. Nevertheless, having backups can help you minimize business interruption if a cyberattack occurs.
• Pay attention to what happens off premises, too. The rise of remote work has introduced new security issues. Problems can also occur when people take portable devices, such as laptops and flash drives, from the office, as these items can be lost or stolen.
• Create policies to reduce the risk of social engineering. For example, you can flag emails from outside sources, making it more difficult for a hacker to pretend to be a coworker. Also, create protocols to verify requests for wire transfers or sensitive information.
• Have a cyberattack response plan. If a cyberattack occurs, quick action can mitigate the damage. A response time is also important to make sure you’re in compliance with various data breach notification laws.
• Maintain sufficient cyber insurance. Cyber coverage can help cover many of the costs associated with a cyberattack. Carriers can also guide you through the process of responding to an attack.

Need Guidance?

Wilson, Washburn & Forster is a boutique independent insurance agency that has been in business since 1961. We have many cyber insurance markets and can help your company secure insurance for this growing exposure. You will find that our experience, claims handling, service, and community commitment is unrivaled.

Contact us today at 786-454-8384 for a complimentary analysis of your current insurance program by an insurance specialist in this field.