Reduce your insurance premium on your Cyber policy

At the onset, we would like to say that Cyber Insurance is no substitute for cybersecurity defense. The Organization has to be in top gear on cybersecurity to ensure that all the assets of the organizations are safe from any unwanted event. However, in the unlikely event of an event occurring, having a cyber policy takes care of the financial implications of such an event.

Cyber risk insurers inspect and analyze several parameters of the organization before issuing any policy. These are:

• If any organization lacks adequate IT security policies, then the insurer might refrain from issuing a policy to that organization
• If any organization is in non-compliance with global Information Security standards such as the EU- GDPR, PCI DSS, HIPAA, ISO 27001, SOX, etc. then the insurer might reject the organization’s insurance coverage application
• If any modern organization with a huge number of privileged accounts in their network infrastructure, has no Privileged Access Management (PAM) solution deployed, then the organization might be deprived of any cyber insurance
• If any organization has partial deployment of any information/ IT security solution to secure its network and systems, then the insurer might deny issuing any policy
• If any organization applies for insurance during the process of migrating data to the cloud or MSP environment, then the insurer might reject the application and ask them to re-apply after the completion of data migration, because

When Cyber insurance premiums can rise manifold?

There are a good number of deciding factors that Cyber Insurance organizations look for deciding whether the insurance applicant organization is eligible for insurance coverage and the premium:

• A cyber insurance company always insists that an organization has to undergo a security vulnerability assessment test for cyber attacks. The insurer inspects the organization if it has adopted the best IT security practices by enabling robust defenses and is able to control the user activities in the modern IT ecosystem. Any kind of loophole in the security infrastructure pushes the organization towards uncertainty for insurance coverage or a higher premium. Therefore organizations should always conduct cyber vulnerability tests regularly.
• Employee education regarding every crucial security awareness, such as phishing, social engineering or malware attack should be part of an overall IT security framework. For administrative level IT threats, insurers expect that the organization should have a robust security mechanism (e.g. Privileged Access Management., PAM) in place to mitigate threats like malicious insiders’ risks, unauthorized users, compromised third-party access, password management misuse and more. Therefore for cyber hygiene, administrator-level access should be always secure, governed and controlled.
• Best security practices also include Zero Trust Privileged Access Security based. With modern-day organizations’ IT operations getting increasingly segmented and distributed, the insurers evaluate security weaknesses in the IT ecosystem and make decisions on insurance coverage. Therefore organizations should have adequate safeguards to monitor users in a distributed and segmented environment.

The Bottomline: Cyber Insurance premium is inversely proportional to an organization’s cyber hygiene. The more robust is cyber hygiene with appropriate tools especially Privileged Access Management (PAM), lower will be the cyber insurance premium.

ARCON is a leading enterprise risk control solutions provider, specializing in risk-predictive technologies. ARCON | User Behaviour Analytics enables to monitor end-user activities in real-time. ARCON | Privileged Access Management reinforces access control and mitigates data breach threats. ARCON | Secure Compliance Management is a vulnerability assessment tool.