6 Questions You’ll Need to Answer If Applying for Cybersecurity Insurance

The cybersecurity landscape seems to get more dangerous every year. Besides having to deal with a COVID-pandemic over the last 18+ months, there has also been a cyber pandemic. That pandemic has included an increase in cloud account attacks of 630%, an increase in ransomware of 485%, and a five-fold increase in firmware attacks. The cost of remediating an attack is well over a million dollars, whether it’s a data breach, ransomware, or something else.

This has caused companies to turn to a new type of business insurance. This insurance will help them reduce their risk of a major loss due to a network security breach. Cybersecurity insurance (also known as cyber liability insurance) is targeted business insurance that specifically covers the costs due to a cyber incident. The covered items can vary according to the carrier. Here is an example of the costs that cyber liability insurance covers from Nationwide:

• Customer notification of a data breach
• Providing credit monitoring services for people whose information was compromised
• Setting up a communications center for affected individuals
• IT solutions to protect your data and computer systems from damage and future attacks
• Legal expenses that result from a data breach
• And more

If you’re applying for cybersecurity insurance, you’ll likely have a long questionnaire to fill out about the current IT security protections that you have in place. This can be confusing to many people that aren’t familiar with technical terms used in cybersecurity. They may answer wrong indicating they don’t have the protection that they actually do have. This can cause you to pay hundreds of dollars more in annual premiums than you should. If you’re looking into cyber liability insurance, we’ll be happy to help you with the questionnaire. We’ll ensure you’re not paying more than you need to and help you navigate the terminology. Below are some of the common questions you can expect to see on a cyber insurance application.

Are Your Backups Secured with Access Credentials, Different from Other Admin Credentials?

Data backup systems are a vital part of the fast remediation of a cyberattack that impacts your data. If you don’t have proper security in place for your backup system, you will end up with backups being compromised. Or even much higher costs in the event of a ransomware attack. This question is about additional protection put on backups. Give them unique administrative logins, apart from other admin logins elsewhere in your system. If they’re unique, this helps reduce the risk of one of them being compromised.

What is the Estimated Time it Would Take to Restore Your Data and Essential Functions After a Ransomware or Malware Attack?

Many companies don’t know the answer to this question. This is because they don’t have an incident response plan and haven’t tested data restoration. But this is a vital piece of information for cybersecurity insurance companies. If you don’t know how long it takes to restore your systems after a ransomware attack, you could end up paying the ransom, which would put the insurance company on the hook for that payout if it’s included in your policy. For example, Colonial Pipeline, which suffered a major ransomware attack last spring, did have a backup of their data. They opted to pay about $4.4 million in ransom anyway because they thought it would be a faster way to get operations back up and running.

Do You Use Any End of Life or End of Support Software?

When software reaches the end of life or end of support, it means that it’s no longer supported with critical security patches. If you are still running EOL software, you will be facing higher premiums. The carrier may even reject your application altogether. 

Do You Use Multi-Factor Authentication Across Your Cloud Accounts? 

Multi-factor authentication significantly reduces (by 99.9%) the risk of a cloud account data breach. This makes it one of the most important protections you can have for your cloud infrastructure.

Do You Encrypt All Sensitive & Confidential Information in Your Organization’s Systems?

If you’re applying for cybersecurity insurance, they’ll want to know how you’re handling all sensitive and confidential information. Encryption is done automatically in some systems, and in others, you need to specifically enable it and direct users on how to use it. The first step in enacting encryption for sensitive and confidential information is to use a tagging system (like Microsoft 365 sensitivity labels) that can classify information that needs to be encrypted. Once tagged, you can easily automate those encryption activities, which would allow you to answer “yes” to this question.

Are Emails Pre-Screened for Potentially Malicious Attachments & Links?

Email filtering is a critical safeguard against phishing attacks, but often companies are only screening for malicious attachments and not links. Links are now the most common method used in phishing attacks. Several software solutions enable you to screen for dangerous links to keep phishing out of user inboxes, thus decreasing your risks of falling victim to a cyberattack.

Get Help Shoring Up Your Defenses from Copperband

Copperband Technologies can help your southern Kentucky or Middle Tennessee business with all your cybersecurity needs, from doing an IT security assessment to helping you reduce your risk by implementing the most impactful safeguards. Contact us today to schedule a consultation! Call 931.263.8000 or email us.

Take Control of Your Tech

Stay up to date with resources and tips our team at Copperband provides. Get the MUST know straight to your inbox!