Following the introduction of Australia’s Mandatory Data Breach Notification requirements in February 2018, and the European Union’s General Data Protection Regulation in May 2018, cyber insurance is increasingly being incorporated into an enterprise’s risk management strategy.

Following wide-scale cyber-attacks in 2017, brokers, insurers and TPAs played a key role keeping clients up to date and educating them on how to respond. These cyber events also increased organisational awareness around the need to harden networks against attack.

Below we run through five fundamental rules which can minimise network disruption, as well as discussing employee cyber security education.

1. Scheduled Patching: Cyber-attacks often seek to exploiting unpatched vulnerabilities in software, particularly older versions of operating systems which software vendors may no longer be supporting. It’s important that organisations regularly update their software to supported versions, and maintain a regular schedule of implementing the latest security patches.
2. Perimeter Firewalls: A firewall is a set of programs that monitors access to a network and protects against unauthorised access. It’s the gatekeeper that prevents malware and viruses from infecting a network.
3. Email Security: Email filters aren’t just designed to block spam – email is frequently exploited by cyber criminals to spread attacks, so a robust email filtering system should be in place to prevent malicious attachments from reaching employees. Additionally, training employees to be aware of suspicious emails and the social engineering techniques that often accompany them assists cyber defences.
4. Regular Backups: The extent to which attacks can disrupt business operations depends largely on how reliant you are on the data stored on your network. Having an up-to-date backup can mitigate most of the risk. Run regular backups and make sure these are stored securely and are isolated from your network. The 3-2-1 backup rule recommends having at least three copies of your data. Store the copies on two different types of media with one backup copy stored offsite.
5. Restrict Access: Limit access to host systems to trusted entities.

Employee Education

The most vulnerable point in any network is its human users. While you can install firewalls, filters and anti-virus software on every other component of your network, education about online safety is the only way to make the human element of your network secure.

The most effective thing organisations can do is create a security culture, where staff understand the threat, can spot the danger signs and know to report anything that looks suspicious.

A good starting point is to educate staff about the warning signs of a malicious email. This encourages vigilance, and also addresses once of your greatest points of vulnerability. Some common signs to look out for include:

1. The email states that “urgent action” is required – this is designed to alarm staff into taking action without thinking it through thoroughly.
2. The “From” email address is not quite right. It may be very similar to the company address, but slightly different.
3. The email includes a link to a website that may look like the real thing, but is fake. If you look in the address bar, it will not show the correct web address. For example, you might see the Google homepage, but the address bar will read: www.gooogle.com, not www.google.com
4. The email message may contain very poor spelling and/or grammar.
5. The email message asks you for personal information. For example: your bank would likely never call you and ask for your bank account number.

A good corporate education program should also teach staff how to manage a suspicious email, how to handle inbound attachments and how to check a link is safe to click on

Cyber-attacks move quickly, so speed of response is vital to minimise loss when incidents occur, so it’s important to partner with organisations who understand the issues and are ready to respond

GB was recently awarded ISO27001 certification for its outstanding information security practices for the fourth consecutive year, and works closely with insurers, brokers and underwriters to provide comprehensive claims management services for all classes of insurance, including cyber.

For more information about our cyber claims management services contact Gallagher Bassett.