In his latest column, Siegfried Müller explains what cyber insurance is all about and which IT security measures companies should implement.

Two things are obligatory at the beginning of the year: First, make good intentions. Because even if it is obvious that certain goals that are euphorically set for the new year – the usual perennial favorites such as “eat healthier” and “exercise more” – are really difficult to realize, these are nevertheless at the top of the list for many people on New Year’s Eve.

Secondly, to be presented with a large number of forecasts regarding current IT trends in the first days of the new year. These are somewhat comparable to good intentions – here, too, there are some that are not easy to realize and, likewise, a certain number of popular no-brainers regularly appear in the respective predictions of the experts.

By nature, this favorite is always there: IT or cyber security – this year with the interesting term “Cybersecurity Mesh”. Sounds impressive. If you’re not quite sure what’s behind it, the following information might help: In Gartner’s “The Top 8 Security and Risk Trends We’re Watching” the term cybersecurity mesh is defined in generalized terms as “an integrated security structure and posture to protect all assets, regardless of location”. Good, but really, this shouldn’t be a new trend for the coming year – after nearly two years of home offices caused by Covid, right?

What 20 percent cybersecurity mechanisms is about

Now, I certainly don’t want to even suggest that cybersecurity shouldn’t be among the relevant trends for 2022. This is (unfortunately) the case. Because the increasingly sophisticated attack methods – now even air gap networks that are completely separated from other systems or the Internet are being attacked – have become many times more complex and thus more successful. As they affect increasingly digitized companies, serious damage can be caused – due to the resulting dependencies.

For this reason, adequate action must be taken, that provide the necessary comprehensive protection. An economically sustainable approach to this can be derived as follows, in accordance with the Pareto principle: With 20 percent cyber security mechanisms, it is possible to reduce the risks by 80 percent. Reducing the residual risk, i.e., the remaining 20 percent, on the other hand, would require 80 percent of the total effort. In other words – by deploying the right cyber security measures, an appropriate level of protection for IT systems can be established with a relatively small investment. Despite all this, of course, there is still a potential threat situation. But a solution is now being offered for this: cyber insurance.

Cyberinsurance: Between theory and reality

Of course, cyber insurance cannot prevent attacks, but it can at least mitigate their impact. After all, in the event of an incident, the unauthorized intrusion into IT systems or the spread of malware not only damages the company directly, but potentially more widely. For example, the loss of sensitive data can result in claims for damages from customers, or a production standstill and the resulting delivery bottlenecks can result in high penalties. It may therefore make sense to consider additional coverage – starting with coverage for production or revenue losses, through IT forensic investigation to determine the extent of damage and the perpetrators’ modus operandi, to recovery of the IT systems.

Sounds good in theory. But in reality, the now stricter regulations and the stricter risk assessments that go with them mean that companies cannot necessarily mean that companies can’t necessarily take advantage of them. This is because, among other things, it is generally necessary to prove that patch management ensures that IT systems are not vulnerable to attack thanks to continuously updated software, or that employees are sufficiently well trained, or that data backup complies with generally accepted requirements. These are all requirements that are by no means easy to implement for every company, especially not for small and medium-sized enterprises, because it is precisely here that know-how and (financial) resources for comprehensive IT security management are often lacking.

Moreover, cyber insurance does not cover everything (anymore) – even though the risk of being targeted by cyber criminals is constantly increasing, simply due to increasingly sophisticated methods such as supply chain attacks. In principle, the attitude is understandable in view of the high amounts of damage caused by ransomware attacks alone. To be on the safe side, it is advisable to clarify in advance exactly which insurance benefits are offered and what can be done to reduce the individual risk.

These IT security measures can be easily implemented

IT security still leaves a lot to be desired, otherwise the damages that are published annually – current estimates vary between 20 and 100 billion euros – cannot be explained. Yet there are some IT security measures that can be implemented relatively easily.

1. Keep an eye on software quality: It is advisable to use only security-certified software and to apply updates and security patches for software and plug-ins as soon as possible.

2. Manage access rights: It has been proven that more than half of all attacks can be traced back to employees, so-called insider threats. Some of these are former employees whose access to internal IT systems has not been completely blocked. It should therefore be ensured that access authorizations are strictly regulated and can be conveniently managed.

3. Use IT security measures in line with the state of the art: The “state of the art” refers to the best performance of an IT security measure available on the market to achieve a legal IT security goal. A positive side effect is that the use of IT security measures in accordance with the “state of the art” should theoretically even have a positive effect when evaluating a security incident, since the best possible technology was used to defend against it. Because the fact that this is required, for example, under the IT Security Act and DSGVO speaks for its high importance.

Yes – the forecast for 2022 indicates that the security situation is not expected to ease, and the first reports of new attacks are already being issued. But if companies have also made good intentions in terms of cyber security and implement them consistently, they can achieve a lot.

With this in mind, I wish you a good start to the new year.

_____

The column was published in its original German version on produktion.de.