Tackling the New Cyber Insurance Requirements: Can Your Organization Comply?

With
cyberattacks
around
the
world
escalating
rapidly,
insurance
companies
are
ramping
up
the
requirements
to
qualify
for
a
cyber
insurance
policy.

Ransomware
attacks
were
up
80%
last
year,
prompting
underwriters
to
put
in
place
a
number
of
new
provisions
designed
to
prevent
ransomware
and
stem
the
record
number
of
claims.
Among
these
are
a
mandate
to
enforce
multi-factor
authentication
(MFA)
across
all
admin
access
in
a
network
environment
as
well
as
protect
all
privileged
accounts,
specifically
machine-to-machine
connections
known
as
service
accounts.

But
identifying
MFA
and
privileged
account
protection
gaps
within
an
environment
can
be
extremely
challenging
for
organizations,
as
there
is
no
utility
among
the
most
commonly
used
security
and
identity
products
that
can
actually
provide
this
visibility.

In
this
article,
we’ll
explore
these
identity
protection
challenges
and
suggest
steps
organizations
can
take
to
overcome
them,
including
signing
up
for
a


free
identity
risk
assessment.

How
Can
You
Protect
Privileged
Users
If
You
Don’t
Know
Who
They
Are?

Underwriters
are
now
requiring
MFA
on
all
cloud-based
email,
remote
network
access,
as
well
as
on
all
administrative
access
for
network
infrastructure,
workstations
and
servers,
directory
services,
and
IT
infrastructure.
The
last
requirement
here
is
the
biggest
challenge
–
so
let’s
examine
why.

The
problem
is
that
defining
administrative
access
is
easier
said
than
done.
How
do
you
compile
an
accurate
list
of
every
admin
user?
While
some
can
be
easily
identified
–
for
example,
IT
and
helpdesk
staff
–
what
about
so-called
shadow
admins?
These
include
former
employees
that
may
have
left
without
deleting
their
admin
accounts,
which
then
continue
to
exist
in
the
environment
along
with
their
privileged
access.
As
well,
there
are
also
users
with
admin
access
privileges
who
may
not
have
been
officially
assigned
as
admins,
or
in
some
cases
temporary
admins
whose
accounts
weren’t
deleted
after
the
reason
for
their
creation
was
complete.

The
bottom
line
is
that
in
order
to
secure
all
user
accounts
with
MFA,
you
first
need
to
be
able
to
find
them.
And
if
you
can’t
do
that,
you’re
at
a
loss
before
you’ve
even
started
considering
what
the
best
protection
strategy
is.

The
Case
of
Service
Accounts:
An
Even
Bigger
Visibility
Challenge

Cyber
insurance
policies
also
require
organizations
to
maintain
a
list
of
all
their
service
accounts.
These
are
accounts
that
perform
various
tasks
in
an
environment
from
scanning
machines
and
installing
software
updates
to
automating
repetitive
admin
tasks.
To
qualify
for
a
policy,
organizations
need
to
be
able
to
document
all
service
account
activities,
including
source
and
destination
machines,
privilege
level,
and
the
applications
or
processes
that
they
support.

Service
accounts
have
become
a
major
focus
for
underwriters
because
these
accounts
are
often
targeted
by
threat
actors,
due
to
their
highly
privileged
access.
Attackers
know
service
accounts
are
often
unmonitored,
therefore
using
them
for
lateral
movement
will
go
undetected.
Attackers
seek
to
compromise
service
accounts
using
stolen
credentials
then
use
those
accounts
to
get
access
to
as
many
valuable
resources
as
possible
in
order
to
exfiltrate
data
and
spread
their
ransomware
payload.

The
challenge
of
inventorying
all
service
accounts,
though,
is
an
even
greater
one
than
doing
so
for
human
admins.
The
reasons
is
because
there
is
no
diagnostic
tool
that
can
detect
all
service
account
activity
in
an
environment,
meaning
that
getting
an
accurate
count
of
how
many
exist
is
challenging
at
best.

As
well,
unless
meticulous
records
have
been
kept
by
admins,
determining
every
account’s
specific
pattern
of
behavior
–
such
as
their
source-to-destination
machines
as
well
as
their
activities
–
is
extremely
difficult.
This
is
because
of
the
many
different
tasks
that
service
account
perform.
Some
accounts
are
created
by
admins
to
run
maintenance
scripts
on
remote
machines.
Others
are
created
as
part
of
software
installation
to
perform
updates,
scans,
and
conduct
health
checks
related
to
that
software.
The
upshot
is
the
getting
full
visibility
here
is
close
to
impossible.

The
Right
Assessment
Can
Identify
Gaps
in
Identity
Protection

To
qualify
for
a
cyber
insurance
policy,
organizations
need
to
close
their
gaps
in
identity
protection.
But
first
those
gaps
have
to
be
identified,
because
you
can’t
address
what
you’re
not
aware
of.

With
the
help
of
a
thorough
assessment,
companies
will
finally
be
able
to
see
all
their
users
and
their
level
of
privilege,
identify
any
areas
lacking
MFA
coverage,
and
also
get
a
picture
of
other
identity
protection
weaknesses,
such
as
old
passwords
still
in
use,
orphaned
user
accounts,
or
any
shadow
admins
that
are
in
the
environment.

By
focusing
on
authentications,
the
right
assessment
will
reveal
exactly
how
users
are
gaining
access
and
identify
any
attack
surfaces
not
currently
being
protected.
These
include
all
command-line
interfaces
and
service
account
authentications,
which
will
allow
organizations
to
meet
the
new
cyber
insurance
requirements
with
ease.

A
rigorous
assessment
can
also
uncover
additional
areas
not
currently
required
by
insurers
but
still
vulnerable
to
attack,
such
as
file
shares
and
legacy
apps.
Coupled
with
actionable
recommendations,
organizations
will
soon
find
their
security
posture
dramatically
improved.

Do
you
know
where
your
gaps
are?
Sign
up
today
for
a

free
identity
protection
assessment
from
Silverfort
to
get
complete
visibility
into
your
environment
and
uncover
any
deficiencies
that
need
to
be
addressed
so
your
organization
can
qualify
for
a
cyber
insurance
policy.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts