The Rise in Cybercrime and Cyber Insurance

Over the past year, we have profiled major cyberattacks to raise awareness about the surge in cybercrime after 2020. Businesses continue to struggle with balancing remote work and the need for stronger security measures. Some companies, unwilling or unable to invest in structural security improvements, choose to take out cyber insurance policies instead.

How Cyber Insurance Aims to Help

Cyber insurance, also known as “cyber-liability insurance,” helps companies recover from cyber threats and attacks. A policy reduces disruptions and downtime during an incident and helps absorb the financial costs of dealing with and recovering from a cyberattack. But what happens when a leading cyber insurance provider becomes the target?

CNA Hit by a Major Cyberattack

CNA, a well-known insurance company, offers a range of insurance solutions, including cyber insurance policies that protect against ransomware attacks. In a public statement, CNA confirmed that “on March 21, 2021, CNA determined that it sustained a sophisticated cybersecurity attack” and that “the attack caused a network disruption and impacted certain CNA systems, including corporate email.”

The hacking group known as Phoenix encrypted data on over 15,000 CNA devices, potentially compromising sensitive client information. While CNA is working with the FBI to mitigate the fallout, this attack could signal the start of a ‘second wave’ of cyberattacks.

Why This Attack Matters

This breach raises a critical concern: cybercriminals now see cyber-insured organizations as prime targets. While cyber insurance is designed to counter cyber threats, threat actors recognize that insured organizations are more likely to pay ransom demands.

If Phoenix accessed CNA’s client data, the organizations that purchased cyber insurance may become future targets. This attack highlights the evolving strategies of cybercriminals and the increasing risks companies face.

Steps to Protect Your Business

If your organization has purchased cyber insurance through CNA, take these steps to protect yourself:

• Acknowledge that your risk of attack has increased.
• Monitor the news for updates on compromised information.
• Strengthen your business’s cybersecurity measures beyond just insurance.

If you need help identifying vulnerabilities in your business’s security, reach out to us at info@optfinity.com for more information.

2020 shifted the business world’s mindset on a lot of important issues.  Policies about time off, remote work, sick policies, and office communication have all adapted in response to the pressures of the coronavirus pandemic. However, the dramatic global increase in cybercrime, especially ransomware attacks, have created a new pressure on businesses to adapt their security policies as well.  This shift in security has resulted in relatively new products like cyber insurance increasing in popularity, as smaller companies look for a one-step security solution.  However, experts in the field are promoting a more holistic style of digital threat prevention called “cyber resilience.  But what is cyber resilience, and you can you implement it at your organization?

Cyber resilience is the ability to predict, resist, recover from, and adapt to both adverse and changing business conditions. By creating a cyber resilient business, you increase your ability to respond flexibly and efficiently to a multitude of potential attacks or general failures.  Implementing cyber resilience at your place of business means creating backups, strategies to minimize downtime, disaster response plans, managing cyber decisions from a business-oriented perspective, and finally, using a data-centric security strategy.

Data-centric models deliver the most value when they are used to create visibility throughout a business.  Endpoint security, IAM, and security controls are all examples of how to provide that increased visibility that makes data-centric models so valuable.  Finally, zero-trust models are becoming ever-more popular.  The NSA went so far as to issue guidance on implementing a zero-trust model, saying that “Zero trust is a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy based on an acknowledgment that threats exist both inside and outside traditional network boundaries.”

With the increase in digital threats and cyber attacks over the past two years, experts are recommending for organizations to take another look at their security protocols.  However, some people are falling prey to common misconceptions about digital threats and cybersecurity and leaving their organization vulnerable as a result.  Here are 5 of the most common misconceptions about digital threats and cybersecurity.

Myth #1 : THREAT ACTORS ONLY TARGET BIG BUSINESSES

Many small-to-medium business owners don’t view ransomware and other digital threats as real dangers for their organization.  Because SMBs have fewer employees, store  locations, and revenue than large conglomerates like Google or Target, decision makers often assume that threat actors like hackers will view them as too small a fish.  The truth is that 76% of all cyberattacks are against businesses with less than 100 employees.

MYTH #2 : CYBERSECURITY IS TOO EXPENSIVE

The coronavirus affected many small business’s ability to pay their bills.  Many are cutting down on spending that the organization’s decision makers have deemed frivolous.  Cybersecurity spending has been one of those expenses–but it shouldn’t be! Basic security protocols, like multi-factor authentication, password managers, and phishing awareness campaigns are inexpensive ways to protect your business from real threats.

MYTH #3 : you need an in-house expert

Some people believe that an in-house expert is necessary for business security.  However, the expense of a full-time, salaried employee can be too much for a small business to afford.  Furthermore, one employee rarely has the experience, expertise, or time to fully meet the security needs of an organization.  However, one option that isn’t often considered is outsourcing your security concerns to another company. By outsourcing, you can take advantage of a full suite of security experts, for less cost than an in-house team.

myth #4 : anti-virus software is good enough

Anti-virus and anti-malware programs are an important tool in ensuring your devices’ security.  Despite their usefulness, they are not a substitute for strong security policies and enforcement. If the hackers use a new kind of malware to infect your network or PC then there’s a high chance that these anti-virus software won’t be able to detect those. These programs are only the first line of defense for your system.

Myth #5 : threats are from the outside

When people consider what cybersecurity threats look like, they often imagine a lone hacker sitting in a dark basement.  Most attacks, in fact, are internal, with over 75% of data breaches coming from insiders at an organization.  Security protocols need to take into account that not everyone within an organization needs access to sensitive information and tools.  Take a look at our article on internal threats if you’re interested in learning more.

Popular Barcode Scanner App Turns Malicious, Affects Millions

A once-trusted barcode and QR code scanner app has turned on its users, compromising nearly 10 million devices.

Lavabird Ltd’s Barcode Scanner gained popularity on the Google Play Store as a go-to solution for Android users. Unlike Apple’s newer devices, Android phones don’t come with built-in QR code or barcode scanning capabilities, making apps like Lavabird’s essential for many consumers. For years, the app maintained a clean security certificate, earned thousands of positive reviews, and showed no signs of malicious code.

Security-conscious users trusted the app—until a routine update transformed it into malware.

Malwarebytes Identifies the Threat

In late December, Malwarebytes, a cybersecurity company focused on malware detection and prevention, started receiving complaints from users. These users reported that their devices began launching ads automatically through the built-in internet browser.

This behavior resembled “malvertising”—a form of malware usually linked to newly installed apps. However, affected users hadn’t downloaded any new apps recently. Malwarebytes eventually traced the source of the infection to Lavabird’s Barcode Scanner, which had been operating safely on devices for years.

Removing the App Removes the Threat

Fortunately, uninstalling the app appears to eliminate the malware. However, the bigger concern lies in how easily an app built up trust, only to later deliver a malicious update without raising red flags.

For today’s consumers, checking reviews and permissions before downloading an app no longer offers sufficient protection.

How to Protect Yourself and Your Devices

Start by reviewing the apps on your phone. Delete any that you no longer use, and keep an eye out for unusual behavior after installing or updating an app.

If you manage a business and issue work phones to employees, consider restricting app downloads and updates. Doing so gives you more control over device performance and security.

Need help creating a mobile device security strategy for your organization? Reach out to us at info@optfinITy.com—we’re here to help.

Why Can’t I Be the Admin of My Own Computer?

Everyone who works in IT dreads hearing this question. Admin privileges provide powerful access, enabling major system changes like editing files and downloading software.

Calling your IT provider just to type in a passcode can feel frustrating. If your job involves frequent software downloads, it’s easy to see why you might want to “cut out the middleman.” But what’s the worst that could happen?

Principle of Least Privilege

No two IT providers are exactly the same—each operates with unique approaches. Still, many core principles of IT and cybersecurity remain consistent across the industry. One of these is the principle of least privilege. This concept ensures that users receive only the level of access necessary to perform their tasks. While some users may need admin-level privileges, most do not.

The principle of least privilege aims to minimize the damage that any single account can inflict on a system. For example, a user might delete an important file or accidentally download malware. In other cases, a cybercriminal may compromise the account. By applying the principle of least privilege, organizations can reduce or even prevent these risks.

Every additional admin account on a device increases its vulnerability to threats. When that device serves a business purpose, these risks extend to the entire organization. Threat actors with admin access can make destructive changes that ripple across the company, potentially causing widespread damage before anyone can stop them—if they can stop them at all.

The Bottom Line

Is the principle of least privilege inconvenient? Yes. But it’s far less inconvenient than dealing with a major security breach.