The prevalence of ransomware has had a devastating impact on businesses over the past few years, with insurance underwriters seeing increasingly large ransomware payouts. As a result, some core cyber security hygiene fundamentals are being required by insurers to qualify for coverage. Many companies wrongly assume that having backups in the cloud can prevent or reduce the impacts of a ransomware attack. For example, secure cloud backup has become a hard and fast requirement. Most cyber insurance providers are demanding that companies supply proof of their backup implementation to obtain an affordable policy. This needs to be investigated and confirmed by the client to ensure that a claim will be paid.
There are some additional capabilities that must now be implemented with cloud backups to pass the underwriting process. These include malware scanning, encryption, segmentation and multi-factor authentication.
Many companies wrongly assume that having backups in the cloud can prevent or reduce the impacts of a ransomware attack. In fact, a recent survey conducted by Ermetic into the security posture of AWS environments and their vulnerability to ransomware attacks found that in every single account tested, nearly all of an organization’s S3 buckets were vulnerable to ransomware.
As a result, insurers do not consider all backup scenarios as acceptable. Underwriters often require that a company’s most sensitive applications be offline, immutable, and clearly catalogued through audit. The use of data has become an essential force multiplier for businesses, but data exposure in turn creates tremendous risks. Whether it is a data lake, business intelligence data warehouse, customer information, or security telemetry, it is essential that organizations protect these crown jewels in a highly secure environment.
Several techniques can be implemented to ensure the security and resiliency of backup architectures. One is file change management, also known as File Integrity Management (FIM), which ensures that you are monitoring any changes to the backup environment. FIM can identify any modifications made to a cloud storage solution and generate alerts so administrators can investigate whether they are malicious or not.
Another key technique is conducting a comprehensive audit of all cloud storage components and associated applications to ensure recovery processes will function as expected in the event of a breach. Organizations must know where all critical data is stored and abide by the privacy laws of the jurisdiction where that data resides
Using a strategy of change management and comprehensive visibility will provide organizations easier access to cyber security insurance coverage at more favorable rates. To ensure they maintain the highest level of financial protection in the event of a breach or ransomware attack, companies must continue to extend these measures as new data and applications come online, and their attack surface grows.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.wapacklabs.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/3702558539639477516
Comments