In the ever evolving landscape of cyber risk, cyber insurance is more important than ever. This is a policy that is specifically tailored to the cybersecurity and information security needs of your institution, potentially covering incidents such as ransomware, cyber extortion, data destruction, and more. To engage with insurers and take out such a policy, the broker will be asking for information around how you secure your institution, including your user access practices and how you are managing to least privilege. CEO and Founder Zach Duke spends a few minutes sharing the cautionary tale of the National Bank of Blacksburg as well as some things to consider when working to secure this type of insurance. Watch the video then read on for further discussion.
The question Zach asks is an important one: how is the cyber insurance broker going to validate your cybersecurity posture when drafting your policy, with your user access reporting being one example? While there are some boilerplate questions and requirements, how can they determine the more specific and nuanced elements of your information security practices? This question becomes particularly potent if we act like it is a matter of “when” but not “if” we are compromised, and find ourselves needing to send this proof to the insurance broker following an incident. For example, managing to least privilege is a given in most cybersecurity policies, but that may or may not be carried out to its full effectiveness in practice. Will the user access reporting processes you have in place today be able to validate that you are managing to least privilege? If you aren’t sure or if you would like some more information, our Finosec team is ready to talk with you and discuss solutions. To schedule a meeting, click here.
Also, if you would like to watch more of these videos as well as interact with a community of others in your industry, please join Finosec Academy today!
