Aug. 3, 2020

This paid piece is sponsored by Marsh & McLennan Agency.

The popularity of working from home has steadily increased over the past 15 years and has been estimated at 4.7 million employees in the U.S. — a 173 percent increase since 2005. This trend is likely to continue for the near future, even without the catalyst of a public health emergency.  However, many corporations may be inviting their employees back into their office environment as shelter-from-home restrictions are lifted and the pandemic crisis lessens.

“We have seen such a drastic shift in the way we think about work, and with that comes its own set of challenges,” said MMA risk management consultant Jared Ducommun. “The new business normal is that cyberthreats are constantly evolving and becoming more invasive with time.”

While handling the many concerns organizations will face with this shift, cybersecurity may be overlooked. Yet it is a critical area to prepare for to ensure continuation of operation in these tenuous times.

“You can never guarantee that you are immune to cyberattacks, but you can make sure that you and your organization are prepared,” Ducommun said.

Consider the following security and privacy best practices as your organization shifts from a work-from-home environment back to the office:

• Back up data and critical servers, and test resiliency. In addition, run vulnerability scans before employees and their hardware connect to the corporate physical environment.
• Physical connectivity of employee hardware can introduce malware into the corporate hardware environment, so it is important to upgrade your cyber hygiene with the latest anti-virus, firewall and endpoint protection, along with timely patching of systems.
• Advise employees to not connect non-corporate managed devices into the corporate environment – i.e. flash drives, USBs.
• Implement use of email filters and sandboxing, or quarantining, of opened links to prevent malicious links from downloading malware.
• Remind employees of the proper safeguard protocols of mobile computing devices and paper files in transit.
• Require employees to participate in privacy and security awareness training before returning to work.
• Safeguard sensitive individual health information, especially if employees are diagnosed with COVID-19. In addition, organizations should be aware of privacy concerns raised with contact tracing of their employees.
• Schedule a third-party assessment of your IT environment for a comprehensive audit of your security and privacy controls.
• As ransomware is usually deployed after several weeks of an undetected initial infiltration – upwards of 200-plus days, according to a recent Ponemon/IBM study – it is important to ready your incident response plan and cyber insurance policy to ensure you know who and how to respond when a cyber incident occurs.
• Review master service agreements of incident response firms such as legal and forensic firms that are approved by your cyber insurance carrier.
• If your organization does not purchase cyber insurance, now is the perfect time to consider coverage. Working through the application process can act as a mini-assessment, and the overall budgetary spend is less than many cybersecurity initiatives.

Why cyber insurance is more important than ever

Threats + vulnerabilities = risk

Threats

• Ransomware attacks jumped 148 percent in March from the previous month.
• Q1 2020 coronavirus-related phishing email attacks are up 600 percent.
• Ransomware demands have continually increased over the past year because of increased sophistication of attacks, such as infiltrating critical systems and backups, with multimillion-dollar demands becoming more common.
• The majority of small and medium-sized businesses – 83 percent – said they feel prepared for a ransomware attack. Forty-six percent of SMBs have been targeted by ransomware, and 73 percent have paid the ransom.
• The FBI and U.S. Secret Service recently have issued alerts for the growing threats on the compromise of business email and malicious email attacks.

Vulnerabilities

As organizations use virtual private networks, or VPNs, for telework, more vulnerabilities are being found and targeted by malicious cyberactors:

• IT and information security budgets are stressed. Furloughs and/or illness of IT staff have occurred and may intensify at corporations and their vendors, adding to their cyber vulnerabilities.
• Wide-sweeping information security initiatives are delayed because of implementation issues under COVID-19 and stressed budgets.
• Contact tracing at the employer/employee level is at its infancy and has privacy implications. Think wrongful collection, retention, use, sharing, defamation, emotional distress, etc. in regards to the tracking of employee, customer and vendor COVID-19 diagnoses.

Risks

• Organizations may be unprepared to respond when a security failure or privacy loss occurs.
• Organizations are depending on their technology resiliency more than ever that malware-induced network disruptions can exacerbate economic challenges.
• If an organization has an incident response plan, it will face increased challenges, especially with a remote workforce.
• Organizations’ reliance on their supply chain is more critical than ever, and a supply chain disruption caused by a security failure or computer system failure of their vendors can further aggravate financial losses.

MMA solutions

• Cyber insurance can help expedite and ensure a compliant response when an incident occurs, ensuring balance sheet and reputational protection.
• Cyber insurance can be a more cost-effective solution, especially now, compared to cybersecurity and can be put in place quickly.
• Marsh’s proprietary policy forms, cyber risk assessments and analytics can help assess an organization’s security and privacy risk profile and build customized coverage for an organization.
• Marsh’s local resources, claims administration and specialized cyber claim advocates provide additional accountability before, during and post incident.

To learn more, click here.