When the Digital Wolf is at the Door

Sean Bemrose has more than two decades of experience in insurance broking, and is active in the broader industry as a board member, mentor and as President of the Queensland Brokers Council (CQIB). More recently Sean assists  international insurers – such as Lloyds of London and Berkshire Hathaway in the design and development of insurance products.  Sean regularly consults with a range of commercial clients concerning their cyber liabilities and manages our complex cyber claims.

I’m going to start with some questions.

What would happen if a hacker decided to launch a cyber-attack against your business? Would they be successful? Would they easily gain access to your company’s sensitive information? Or would their attempt fall flat?  If their attack was successful, what would you do?  Would you have to pay the ransom and hope for the best, or would you restore your system from your regular backup and keep trading?  How would you survive if your critical systems took weeks to restore?

Believe it or not, cyber security isn’t just a concern for large businesses. Statistics show that smaller businesses are trending targets for cyber criminals because they make far more easy and fruitful targets. Small business owners simply must pay more attention to their IT security.

As a commercial insurance broker, I regularly see the results of cyber-attacks, and I get to observe how businesses – and their insurers – respond.  As a business owner, I know we have been subject to numerous attacks, and as such I take our cyber security extremely seriously.  In fact, I have included below a copy of a message we actually received when we were on the receiving end of a ‘cryptolock’ attack a couple of years ago.

Here are my tips for a work- over of your IT security;

1. Don’t be sloppy with your backups – Even if you don’t think you need to, you need to have regular backups. At least daily.  You also need to have multiple backups in different locations, ideally at the office and in a remote location such as your home or in the cloud.Many businesses don’t feel that they need to backup daily, but think about your emails, stock, banking etc. Remember that you could lose everything between your last backup and when your systems failed.To restore from a backup, sometimes you have to restore the programmes first before you restore your data.  That’s why doing a full image or ‘bare metal’ backup is a useful approach. Lastly, make sure that your IT provider has done a test restore of your backups onto a separate computer.  Many businesses have found out too late that their backups simply didn’t work when they needed them the most.Incidentally, when our business was attacked we were back up and running in 2 hours because we have good IT people and we have a robust backup protocol.

2. Make sure your antivirus software is up to date – Make sure you have email and attachment scanning functionality. Your IT provider should be able to discuss the relative merits and limitations of your AV software. 

3. Your password method probably needs to change – Many attacks happen because the passwords your employees use are way too simple. If your team isn’t educated, it’s possible that they’re using passwords that are way too easy to hack.
   It happens all the time. That’s why you need to implement an effective password strategy. You may not be able to stop every single attack, but you can certainly slow down a persistent hacker. 

4. You need a good firewall – Most sophisticated firewalls also include a feature that continuously updates the list of known good and known malicious applications. This way, the amount of questions relating to Internet access is minimised and your computer protection is always up-to-date.Although a firewall provides critical protection to keep your PC safe from unauthorized access 321 online casino, it cannot remove malware from a system that has already been infected. Therefore, a firewall should be used in conjunction with your antivirus software. 

5. Be smart with your staff training and access – more than 80% of successful cyber-attacks are a result of human error. That means, someone opened the wrong link, paid a fraudulent account, or one way or another left the door open to the bad guys.  Your staff need to be educated of the risks.It’s also important to manage access to your various systems, especially where it comes to ‘administrator rights’. 

6. Get some cyber insurance – Despite taking the precautions outlined above, sometimes the malware gets beyond the company firewall, and the business does get hacked. It is important to have a plan in place to deal with such an event, that unfortunately is increasingly common.For a range of unpredictable catastrophic events, such as a flood or fire, you can buy insurance policies. The same applies here, and there are cyber insurance policies available. These policies offer assistance in dealing with post hacking investigations, data breaches, extortion attempts, lawsuits and privacy violations.

Cyber risks are becoming a preeminent risk to businesses.  It’s smart to insure your business against random risks.  I think its smarter to insure against risks that specifically target your business.

TBIB have been protecting businesses for 40 years and our Cyber and Tech department can provide you with advice and coverage to suit the way you do business.

crypto locker extortion txt file