Tom: Over the past year, the cyber insurance industry has recognized the increase in cyber risk. Therefore, many organizations are finding their cyber insurance rates increasing, sometimes at dramatic rates of 200% or more. The cost of a breach averaged $3.86 million in 2020, according to the Ponemon Institute’s Cost of a Data Breach Report.

Insurance companies are now performing more extensive cyber risk analysis of organizations before offering insurance and even could deny insurance if they feel the organization has too much cyber risk exposure. The challenge is that the insurance carriers may not do a thorough analysis, and it could weigh negatively in favor of the organization or could be negative towards the organization.

Say for instance the company has made investments in cybersecurity, had their controls independently validated, and scored exceptional in an external penetration test, the insurance company could still rate them as high risk thus pricing the insurance high and perhaps unaffordable.

Yair: We do see a major tsunami of ransomware attacks, and most of it is coming from nation states or cybercriminals within those nation states, so it is very hard for federal, state, and local law enforcement involved with cyber to deal with it as they don’t have much jurisdiction over these areas of the world.

When it comes to the cyber insurance market, many organizations and also local government entities are using cyber insurance in an attempt to protect themselves, especially from ransomware. However, many cyber insurance policies in recent years also require more effort from their clients to be more in compliant with national standards such as the NIST Cybersecurity Framework, the Cybersecurity Maturity Model Certification (CMMC), or the European’s General Data Protection Regulation (GDPR), which may cause some challenges for organizations if their cybersecurity posture is not up to par with some national or international standards.

So, when it comes to cyber insurability, the requirements from the insurance companies should focus also on faulty business processes that cause some of the vulnerabilities. For example, a real estate company that is doing transactions with thousands of customers daily has been asking their customers to share Personally Identifiable Information (PII) including tax returns and pay stubs over regular unencrypted emails. Such practices are compromising the integrity of both the customers and the company.

Andrew: I don’t foresee an end to ransomware attacks anytime soon, so I see the overall demand for cyber insurance increasing. The main challenges I see right now are that insurers have no process to ensure their clients maintain an ongoing minimum security posture.

The current model has clients answering questions on a checklist or submitting a data spreadsheet to the insurer. The best-case scenario is that this data is a snapshot in time and doesn’t represent their ongoing security posture. Worst-case scenario is that the client misrepresents their security posture in an attempt to get insured.

Long-term, I envision a scenario whereby cybersecurity insurers create a standard their clients must meet and a required process of ongoing monitoring to ensure that the client stays compliant with that standard.

Bilge: Cyber insurance is an emerging market, and it is in its infancy compared to the many other insurance types. Cyber insurance has many uncertainties and unknowns that may prevent the market from growing. Cloud adoptions bring standardization to IT infrastructures of insureds that might be a positive factor for the proliferation of the cyber insurance market; however, it is not sufficient for insurers to fully understand the cybersecurity posture of a small business.

According to the OECD’s report titled Enhancing the Role of Insurance in Cyber Risk Management, the quantification of a cyber breach is the biggest concern among cyber insurers. The main challenges for quantifying cyber breaches are the lack of historical data on cyber incidents, the changing nature of the cyber risk/threat environment, and the limited access to corporate security information necessary for underwriting. All of these factors make cyber risks difficult to understand for the cyber insurance sector.

At this point, it is vital to close the gap between the insurers and cyber experts. The collaboration and cooperation between cyber experts and insurers will help mature and grow the cyber insurance sector, which will finally help faster and less expensive insurance premiums. Insurers need to understand the characteristics of cyberspace, cyber threats, and vulnerabilities; then, based on that knowledge, they should correctly assess a company’s cybersecurity posture/maturity. After making these assessments correctly, they will have the right amount of appetite and confidence to insure their clients.

At this point, four types of cyber companies can tremendously help cyber insurers overcome the market challenges and maturing the cyber insurance market. Those are (1) cyber risk scoring companies, (2) cyber threat intelligence companies, (3) enterprise risk management companies, and (4) cloud security posture management companies. One can call these companies “intermediaries” in the context of cyber insurance. They can play an essential role between the cyber insurance sector and customers.

Bruce: Trends in the cyber insurance market are recognizing the impact of ransomware attacks. As the cyber insurance market has matured with the ability to gather the actuarial data on cyberattacks, risk is calculated to determine the premiums for cybersecurity policies. Cybersecuirty insurance also recognizes rate calculation determined by risk reduction measures of security controls that are implemented. A general perspective of organizations is that cyber insurance alievates the need to implement proper security controls.

With the increase in cyberattacks, specifically ransomware, cyber insurance companies realize the increase in organizations that file claims on cyber policies. The cyber insurance industry is recognizing that the pricing models may not have identified the increase in claims, causing many cyber insurance companies to re-evaluate the pricing model, with some reconsidering the offering of cybersecurity insurance all together.

Tom: The challenge that many organizations face is how they will determine if the cost of cyber insurance is worth the cost of the increased rates. When you look at the cost of a breach, I believe it is, but some organizations may not be able to afford the new premiums. However, a breach to a small organization could bankrupt it, while a larger organization could absorb the cost of the breach.

I don’t think many small businesses understand how costly a breach is and how much it could impact their ability to stay open. While the focus so far has been on large companies, it is only a matter of time before hackers turn their attention to small businesses.

Yair: Absolutely! It is unfortunate that small business owners assume that they are not going to be the next target of cybercriminals. Research provides strong evidence that over the past two years, smaller companies are easier targets for cybercriminals as the efforts to successfully penetrate their business is significantly lower, and the payout, especially when it comes to ransomware, is quicker as it is mainly done based on impulse of a single key decision maker or the company owner rather than an established highly professional team. So rather than trying to hack one large company and negotiate $1M in ransom, these cybercriminals are breaching 100 smaller companies asking for $10K each and make faster return on investment for the adversaries.

Here at NSU’s Center for Information Protection, Education, and Research (CIPhER), which has been designated by the National Security Agency (NSA) as a National Center of Academic Excellence (CAE) in Cyber Defense since 2005, we’ve been conducting ongoing research on small business cybersecurity. Our Master students in our cybersecurity programs conduct risk assessment projects at small organizations (we publish with fictitious company names to protect their identity) where we see repeatedly smaller organizations are ill prepared for cyber incidents and just unaware of the risks associated with any of their operations that are online.

These operations don’t have to be sophisticated web-based or cloud-based operations, even their use of a cellphone and access to an email account where they do their business opens them up to massive cyber risks, as is documented yearly by the FBI’s Internet Crime Complaint Center (IC3). Some posters from the work of our graduating students can be found via: https://infosec.nova.edu/current-student-research/masters-students/index.html where our students develop a full project to address the top identified cyber threats to a small organization either from the technical perspective or the managerial perspective.

Andrew: The short answer is “yes.” The more relevant questions to consider are: to what degree should small businesses be concerned with cyber risk, and do they understand their particular threat landscape? For example, law firms have a different set of cyber risk concerns than real estate firms do. Not all small businesses face the same threats, so it’s essential to have a nuanced conversation specific to the particular small business.

Bilge: All businesses, whether small or large, should be concerned about cyber threats. According to Verizon’s 2021 Data Breach Investigations Report (DBIR), there is not much difference between small and large businesses in terms of both numbers and patterns of security breaches. As a matter of fact, small businesses should be more concerned about cyberattacks because some peculiarities of small businesses can make them more vulnerable than large enterprises.

First of all, most small businesses are usually on a tight budget; they typically can’t include cybersecurity talent in their workforce, contrary to large businesses that generally have dedicated cybersecurity units and professionals working full-time in these units. The fact is that small business are usually in a false illusion of security. Some businesses assume that cyber threats will not be interested in their networks because they don’t have anything worth stealing other than a static website. The lack of security awareness is a general problem for small businesses; this is common across all organizational layers of small businesses, from the owner to the operational level.

Another false assumption is quite common for small businesses that migrate their IT infrastructure to a public cloud service. They usually assume that cloud service providers will provide all necessary security measures.

Last but not least, cyberattackers frequently use small business networks as a passageway to the enterprise networks. Supply-chain attacks are one of the most rewarding attacks for cybercriminals. That was the case for the 2013 Target breach in that cybercriminals first penetrated the network of Target’s HVAC supplier.

Bruce: Everyone should be concerned about cyber risk, specifically small businesses. Small businesses are easy targets because they do not have the resources for extensive cybersecurity controls. However, small businesses rely heavily on technology to operate efficiently, including utilizing the internet. Any business that uses the internet and web services is exposed to threats worldwide, no matter the business size.

Tom: One of the great things about cybersecurity is that there are a variety of frameworks that you can use to protect your business effectively. The NIST Cybersecurity Framework can be used by any organization to assess and develop best practices around cybersecurity. There are dozens of others as well, some more complex than others but all with fundamentally the same concepts.

Businesses should also hire expertise to support their cybersecurity program. Whether they hire dedicated staff or hire an outside consulting firm, there are opportunities to bring in highly skilled staff to help your organization combat the risks around cybersecurity.

To be successful however, you have to have buy-in at the top. The owners, board members, and executives all need to understand the risk and take an active role in understanding how it could impact their business. You also need to educate your staff by providing cybersecurity training and awareness. They are the most important asset in protecting an organization from a cyber attack.

Yair: The majority of the small business owners or key decision makers are just unaware of how much they can improve the cybersecurity posture of their company with very little investment. For example, taking the time to educate their employees about proper cyber hygiene, which there are many YouTube videos about, aside from taking a few minutes of work, doesn’t cost much for the company.

Also, being aware of phishing emails and what they can do to mitigate them, or the multi-billion dollar scam—Business Email Compromise (BEC) (see the FBI’s report: https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/business-email-compromise).

Other measures should include implementing information security policies and also compliance programs to enforce such policies. Even if it’s a very small company with just a handful of employees, creating the cybersecurity awareness culture in the organization can go a long way in mitigating some cyberattacks such as phishing or ransomware.

Just the same as businesses investing in their legal or accounting support, they must invest into cybersecurity support. While there are many actions that small business owners and key decision makers can take on their own, there are still many other actions that they must consult with cybersecurity professionals on. The same way one would go and consult a specialized MD on a medical issue that they have, they need to also consider making the effort—ahead of a cyber incident—to discuss the risks to their organizations, understand the impact of such risks to their organization, and then develop a proper set of actions to mitigate such cyber risks.

Andrew: Small firms have to start by understanding that they are a potential victim of a cyberattack, regardless of size. Too many small firms think they are “too small” to be attacked when the data shows they are not. Once they accept this reality, they should move on to doing the basics—asset management and classification, policy development, technical controls, data backup and restoration planning and testing, and employee training and awareness.

Bilge: As opposed to the 80s, 90s, and early 00s, company networks today don’t have virtual perimeters. It is crucial to invest in a UTM box with integrated antivirus, intrusion detection and prevention, content filtering, e-mail filtering, and VPN solutions; however, it is a small portion of cybersecurity in today’s ultra-connected world. BYOD is the new Business as Usual (BAU) today; working from home has also become a new BAU setup because of the COVID-19 pandemic. All of these necessitate companies to have state-of-the-art endpoint security measures more than ever before. Endpoint security is not as easy as perimeter security because of its distributed nature, the diversity of endpoint devices, and end user’s freedom expectations. It requires fundamental shifts in security mindsets such as they should consider adopting zero trust architecture, also known as perimeterless security. More specifically, each small business should have a security action plan for mobile devices, such as how they will update mobile devices, whether they will use mobile device management software, whether they will use VPN solutions, and whether they consider adopting new concepts like SASE (Secure Access Service Edge).

The adoption of public cloud infrastructures is quite common among small businesses today. It brings a higher security standard compared to the on-prem infrastructures of older days. However, small business owners and IT administrators should be aware that using a public cloud service does not mean that they also outsourced cybersecurity. They should be acquainted with the shared responsibility model; the responsibility of securing a company’s computing environment in the cloud is shared between the Cloud Service Provider (CSP) and the business itself.

The cloud model sets the general baseline for the responsibilities of both parties. In an Infrastructure as a Service (IaaS) model, the CSP provides underlying infrastructure, including virtual servers, network devices, and storage. The client is responsible for using up-to-date and securely configured operating systems and applications running on them. In the Platform as a Service (PaaS) model, securing operating systems and COTS applications has been transferred to the CSP. The client is responsible for the security of the applications it has developed. In the Software as a Service (SaaS) model, most responsibility belongs to the CSP; the client is still responsible for the security of the SaaS product. In short, the cloud customers always have security responsibilities, especially in the IaaS deployments; the client is responsible for most security as if the servers are on-premises.

Below is a list of cybersecurity best practices for small businesses:

1. Provide appropriate security training for all employees, including computer users, IT staff, and managers. Security training should be more like a security awareness session for computer users, but it should be more in-depth and technical for the IT team.
2. Set policies and associated action plans for mobile devices; specifically analyze the new posture caused by the COVID-19 pandemic.
3. Using vulnerable (out-of-date) software is the number one reason for ransomware attacks. Always use up-to-date endpoint devices. Always use the most up-to-date versions of operating systems (Windows, IOS, Android) and Internet browsers across the company networks. Web browsers are the prominent entry points to the Internet; always use the updated web browsers across the business networks. Never forget to update the firmware of IoT devices—such as webcams, access control systems—that resides in the network.
4. Physical security is always essential, even in the era of ubiquitous computing. Wi-Fi security can be considered an essential and usually ignored part of physical security. Use strong Wi-Fi authentication and encryption protocols and strong passphrases to eliminate hack attempts of nearby cybercriminals.
5. Strong passwords are important; however, never rely on the passwords. Always use multi-factor authentication whenever it is applicable.
6. Access control is at the heart of cybersecurity; it is also essential to implement zero trust. Adapt an access control policy; never use shared accounts, define user groups and roles, never use default allow rules, never grant full access to all data.
7. Adopt a data backup plan and backup your essential information and systems to respond timely and effectively in business contingencies.

   There are many layers of cybersecurity, including but not limited to technical, organizational, administrative, physical layers. Security guidelines and standards might be a lighthouse for most small businesses. From the standardization and certification perspective, Cybersecurity Maturity Model Certification (CMMC) might be a valuable guide for small businesses to grow to certain levels of cyber maturity. Although CMMC targets the Controlled Unclassified Information (CUI) for Department of Defense contractors, it has the potential of becoming prevalent for enforcing security standards for small businesses in the U.S.

Bruce: Any business that effectively manages cyber risk will start with an assessment of the technology environment. Many small businesses cannot afford to conduct extensive assessment. Small businesses rely on their internet provider to implement the necessary security controls that protect the organization from bad actors, malware, and other malicious activity.

Small business owners need to understand what security controls or protections their Internet Service Providers (ISP) have implemented. With the understanding of cybersecurity protection that the ISP provides, small business owners can determine what additional cybersecurity controls need to be implemented to ensure the organization’s security.