Cyber Defense eMagazine February Edition for 2022

Keeping Premiums Low Once Coverage is Secured
Once secured, cyber insurance premiums can be kept low on renewal by continuously improving upon
pre-established security postures, a process that can greatly help prevent attacks, such as those from
business email compromise or ransomware. Still, successful attacks happen and when they do, taking
the proper steps to mitigate risk can help keep your premiums low.
If a breach occurs and company data is being held for ransom, companies need to implement strict
policies that restrict anyone at the organization from reaching out to the threat actor. We have seen many
cases where someone on either the security or leadership team contacted the hacker and divulged
information that made the situation even harder to resolve. Examples include providing their names,
company, whether they have a cyber insurance policy and the value of the data that was taken - giving
more power to the hacker than intended. Keep in mind, hackers don’t always know who they have
attacked and how valuable the data they found is. Instead, teams should contact an experienced recovery
and remediation group, along with their cyber insurance company, to get assistance as quickly as
possible. With this approach, experts can begin to rebuild company infrastructure even as negotiations
play out. It might be counter-intuitive to get the bill running sooner, but at the end of the day, it is almost
always the most cost-effective option. This act reduces the potential business interruption claim, gets a
head start on recovery and identifies systems that could be re-built or upgraded vs. paid to unlock faster.
Having your counsel work with regulators when breached has also become more essential than ever.
Most recently, in September 2021, the U.S. Department of the Treasury’s Office of Foreign Assets Control
(OFAC) produced an updated advisory on the use of digital currencies in ransomware attacks and other
financial crimes, discouraging companies from simply paying the ransom to regain operational control
after a successful ransomware attack. While these advisories are aimed at the payment of ransoms to
sanctioned entities, it also may address the ballooning of ransom demands and spiking cyber insurance
costs over the past year.
In working with the client, their counsel, an IR firm and the insurer, the decision to pay a ransom is always
determined on a case-by-case basis, and only after an expert analysis of the situation can be compiled
and payment due diligence completed. While there are still times when a ransom is paid, more and more
often, companies are alternatively using the resources provided by their insurer to remediate and rebuild.
Even with much of the cyber insurance landscape still in flux, opting into cyber insurance can provide a
sense of security if a victim of a cyber attack. It can help companies recover after a data breach when
thousands or even millions of dollars are accrued from business disruption, revenue loss, legal fees,
forensic analysis and more. To best obtain cyber insurance, working directly with brokers and insurers
that can provide advice for setting up security tooling and processes and protocols can be a huge boon
for candidates. Even as coverage is secured, keeping premiums low can be addressed by maintaining
and improving upon internal and external security practices, which can help mitigate risk further, making
your systems protected from the majority of inevitable attacks. And, should a breach occur, calling your
broker, insurance agent and associated firms at the first sign of a breach, such as remediation and
recovery or those well-versed in OFAC regulations, will enable businesses to get back online faster, with
more business value intact.
Cyber Defense eMagazine – February 2022 Edition 91
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.