Avoiding preventable cyber claims

By Michelle Waldron, Cyber Services Team Leader, Beazley

The perceived threat of cyber risk is diminishing in the eyes of business leaders around the world, having dropped 27% over the past two years, according to Beazley’s Risk & Resilience research. This raises the question of how prepared organizations truly are for the growing cybercrime risk.

You may have developed a cyber defense strategy and made a considerable investment in security solutions, and you may feel good about the tools and processes that are keeping your system and your data safe. But is your organization getting the most out of its cyber security investment?

Built-in security features are included in many popular tools and platforms at no additional cost, and providers regularly update these solutions to address the emerging and evolving cyber threats. Yet because many of these features are so seamlessly embedded into larger products, and in most cases they are not enabled by default, these features can often be overlooked. These are tools that you are already paying for, so it makes sense to maximize them as part of your security strategy.

Filter outbound connections

As the recent MOVEit breach demonstrated[1], cybercriminals are always looking for new ways to attack, with tactics ranging from third party supplier attacks to more sophisticated social engineering and phishing techniques. In the face of these threats, outbound network filtering is a free method for improving protection against supply chain attacks.

Limiting outbound network connections to known and approved flows ensures that your server can only communicate with pre-defined destinations on the internet. This prevents the server and its software from communicating with cybercriminals’ command and control servers. If a server can communicate without restriction, a criminal can rapidly exfiltrate a significant amount of data. Filtering makes it harder for an attacker to do this.

In most cases, filtering can be implemented using existing tools and firewalls. A good place to start is establishing a baseline and identifying existing outbound connections. Then look to implement rules denying all unexpected connections to unknown destinations.

Secure access to cloud services

It’s harder for a cybercriminal to gain access to a system that requires multiple layers of identification for login, rather than a single knowledge-based factor like a password. Multifactor Authentication (MFA) incorporates those layers, requiring something you know (a password or PIN), something you have (a physical token or mobile device), or something you are (a fingerprint).

Some of the more popular cloud platforms have MFA as a base security feature at no additional charge. This should always be turned on. Microsoft also recently released a feature that makes it possible to tie an MFA session to one device only. This adds an additional layer of protection against MFA bypass attacks.

Users may complain about the “hassle” of MFA. But the simple fact is that when MFA is in place, attackers aren’t as successful in defrauding people.

Harden your security configuration

When you utilize a secure, hardened configuration, it’s more difficult for attackers to move laterally within your system. To limit the impact of a breach, segregate administration groups and limit their scope. Use purpose-dedicated service accounts with the least privilege principle to limit the impact of one compromised account.

Security configuration can further be hardened by keeping domain administrator accounts to a minimum and configuring them with unique, random, and complex passwords. These accounts should only be used to connect to domain controllers, and ideally should never be allowed to connect to the internet. However, if they must be used to connect remotely in the case of an emergency, a virtual private network with MFA should be used. Finally, ensure that these accounts are monitored, and that alerts are in place.

Limit opportunity for attackers

There are many free tools that attackers could use to their own advantage if your organization does not properly leverage them. Simply turning these security features on deprives attackers of the opportunity to utilize them.

One example is a Windows device encryption tool called BitLocker. If this is not enabled, an attacker can repurpose it to encrypt drives and lock out device owners. When enabled, BitLocker becomes one less feature for attackers to leverage. Another example is a Microsoft LAPS (local administrator password solution), which allows users to have different local administrator passwords on each device. If LAPS is not enabled, attackers can enable it on their own, locking administrators out of local administrator accounts on user devices.

No one single control or tool can completely protect your organization against the possibility of a cyberattack. But by having a multi-layered approach to identifying and addressing vulnerabilities on every level, and making the most of built-in security tools, your systems and assets will be better protected.

The information set forth in this document is intended as general risk management information. It is made available with the understanding that Beazley does not render legal services or advice. It should not be construed or relied upon as legal advice and is not intended as a substitute for consultation with counsel. Beazley has not examined and/ or had access to any particular circumstances, needs, contracts and/or operations of any party having access to this document. There may be specific issues under applicable law, or related to the particular circumstances of your contracts or operations, for which you may wish the assistance of counsel. Although reasonable care has been taken in preparing the information set forth in this document, Beazley accepts no responsibility for any errors it may contain or for any losses allegedly attributable to this information.

[1] What You Need to Know About the MOVEit Data Breach - Experian