By Joseph Carson, Chief Security Scientist at Delinea
Cyber insurance is a safety net which protects businesses from the potentially catastrophic costs of ransomware, data breaches and other digital threats. Which is true – as long as an organisation manages to satisfy the increasingly rigorous security controls to meet the coverage qualification criteria.
In the face of accelerating insider cybercrime, a rise in ransomware attacks and other threats, some insurers are increasing their premiums. Others are simply exiting the market altogether. As a result, cyber insurance is becoming more expensive and harder to obtain.
Organisations can no longer contact an insurer, arrange coverage and relax, safe in the knowledge that a big pay out will allow them to mop up the financial damage of a cyberattack, should one occur. In order to simply qualify for protection, businesses must be able to demonstrate their cyber resilience and prove they have deployed appropriate protection. We argue that the best place to start is by securing a well-known defensive weak point: privileged access which has administrator-level powers.
Check Your Privileged Access
If an attacker manages to into a privileged user account, they gain the literal keys to the kingdom, and it could be game over for defenders. This is one reason why businesses should ensure key corporate assets are only accessible to authorised users.
Privileged Access Management (PAM) is one of the best solutions to protect and manage access. Yet as well as improving an organisation’s security posture, a PAM solution also demonstrates that a business has reduced the risks and is better prepared to face the latest threats. We are not alone in making this claim, because underwriters are also now questioning clients as to whether they have deployed secure access systems before signing off insurance policies. PAM should therefore be a foundational part of any organisations’ cybersecurity posture.
Insurers evaluate cyber risk using a variety of models and metrics. AIG, for instance, makes its evaluation metrics available to the public. Others including Zurich use frameworks from the National Institute of Standards and Technology (NIST) to carry out a cyber risk assessment report. The methods of assessing risk will vary among providers, but they are all looking for the same fundamentals: strong, proactive cybersecurity defences that respond to the latest threats. Secure access is an important part of risk reduction insurers are looking for when making decisions.
The authoritative Verizon Data Breach Investigations Report 2021 found that 61% of breaches involved credentials, with stolen credentials used in 25% of breaches. It is so easy to buy or steal passwords that organisations must be realistic about the limited protection they offer. PAM is a more robust way of securing access, protecting privileged accounts from unauthorised access, and limiting the potential damage of an incident.
Managing Privileged Access
A PAM solution can monitor all administrator accounts usage to discover unusual behaviour. This could be as simple as detecting a logon at 3am on a Saturday morning, which could reveal that a business either has some seriously hard-working employees or that a threat actor is trying to access its network.
Red flags can also be raised if a privileged account starts accessing large amounts of sensitive information or when a high number of privileged user accounts are accessed at the same time. If a manager’s account suddenly starts exfiltrating data and uploading it to a mysterious, unknown website, they have either been compromised or conducting actions that put the organisations at increased risks.. Spotting this behaviour and shutting it down quickly limits the damage.
PAM tools reduce risk and liability, protecting against external threats as well as internal, insider risks. Multi-factor authentication (MFA) is another vital part of the puzzle, protecting privileged accounts from unauthorised access. Insurers will look favourably on businesses which have deployed this technology and can therefore prove they protect privileged accounts as well as monitor their usage for anomalies.
When looking for a PAM solution, decision makers should be sure to check it offers automation which manages authentication, authorisation and monitoring. It should also focus on orchestration, serving as a kind of conductor that enables the security team to launch and fine-tune a multifaceted defence that enables seamless, secure access when needed on demand – or prevents it where necessary.
Installing PAM is not just a useful first step to securing insurance. It will allow organisations to meet their insurers’ changing requirements. In an age where cyber insurance is becoming harder to obtain and more expensive, it pays to have an answer to underwriters’ questions before they ask them. Businesses that have deployed PAM will have a powerful argument in their favour and give them a serious advantage when securing or renewing a cyber insurance policy.
