A focus on the most prevalent threats: Channel security efforts to threats that lead to 90% of attacks. Avoid becoming distracted by narratives marketed by security vendors. Phishing, stolen credentials, and unpatched vulnerabilities—these are some of the most common and pervasive threats leading to security breaches.
A data-driven defense strategy: Build a deeper understanding of your own infrastructure and relevant risk exposure. Implement targeted security solutions, processes, and countermeasures, after understanding your environment and threats rather than relying exclusively on outside counsel.
Multi-layered cybersecurity measures: Deploy multi-layered defenses to ensure that if one layer fails, additional layers may still detect and block the threat. These include phishing-resistant multi-factor authentication, firewalls, endpoint detection and response, cloud security, email and web security, etc.
Cyber-aware employees: Human factors account for almost 75% of all data breaches. Organizations must ensure they educate their users regarding the risks, test and validate their security reflexes using phishing simulation exercises, improve their awareness about security rules, policies, and procedures, make users more accountable and responsible towards security, and ensure they adhere to security best practices.
Third-party risk management: Organizations must assess the cybersecurity posture of their vendors and suppliers, ensuring they adhere to best practices. Regular security audits and contractual obligations can help mitigate supply chain risks. Maintaining a Software Bill of Materials (SBOM) can help security teams understand the various components of software products, including dependencies and vulnerabilities.
Incident response planning: Developing and testing an incident response (IR) plan helps minimize the impact of a cyberattack. While the average cost of a data breach is about $4.88 million, studies show organizations save at least $2 million in data breach costs if they have an IR team and practice their IR plans regularly.
Data privacy resilience: Be conscious of data collected. Only gather and store personal information necessary for business operations. Implement a process to securely dispose of data when it's no longer needed. Apply encryption and monitoring for third-party access. Restrict access to sensitive data to only those individuals who need it for business purposes. Use data leak prevention tools and user behavior analytics to identify any unusual access or movement of data.

In conclusion, these insurance industry reports underscore the urgent need for organizations to bolster their cybersecurity defenses. By addressing human-generated risks, staying abreast of emerging threats, and implementing robust mitigations, organizations can navigate the evolving cyber landscape with greater resilience.

Special Reports /

Escalating cybersecurity claims: A view from cyber insurers

Related Stories

Recommended For You