Posts Tagged ‘Cyber Security’

How to Ensure Cyber Insurance is a Good Value

Posted on: June 29th, 2020 by jiml | No Comments

According to a recent study, 34% of businesses now carry Cyber Security Insurance. This percentage continues to rise year to year as the cyber security risks also continue to rise.  According to a 2020 survey posted on statstica.com the number one threat to businesses is a cyber incident.  Cyber incidents exceeded changing markets, pandemics, climate change, new technology and all other threats as the leading threat to businesses today.

Are your cyber security defenses up to date? Many businesses who answer this question negatively, turn to cyber security insurance to mitigate the risk.  The logic is that if the business is not properly protected, at least they can rely on the insurance in case of a breach or other cyber security incident.  This is flawed thinking. Many cyber security policies have exclusions so that “due care” is required for payment.  Some high-profile examples of businesses not receiving the payout the expected include Sony and PF Chang’s. Sony went through an extensive legal battle to settle what their cyber security policy would actually cover.  PF Chang’s was left holding the bag for a PCI compliance penalty because a stipulation in their policy required being properly up to date with regulatory compliance. (Click here for other examples in a NY Times article)

We can’t forget that insurance companies are for-profit businesses.  Their business model is to pay-out as little as they can as is the case with all insurance models. The exclusions section of your Cyber Security Policy will be an important section to review and understand. For some the price of a cyber security policy could go a long ways toward actually securing the network. That is a decision point for businesses. Is a cyber security policy actually money well spent? Would bolstering your defenses actually be a wiser choice?

How do you make sure you get paid on a claim?  Your business will need to show “due care” as mentioned above. Due care means documentation. As a business you need to be able to show documentation of what you have put in place for cyber security and what your future plans are as well. Couple that with a good policy that has reasonable exclusions and you increase would chances of receiving a payout.

Colden Company is pleased to announce our partnership with Kaseya and Chubb InsuranceOur program combines a cyber security insurance policy with our cyber security program.  Enrollment in the program allows your business to progress toward due care while getting an affordable cyber security policy that covers your business properly. The combination of the two in one program dramatically increases your chances of receiving a payout in the event of a breach, giving you the confidence that your policy will be there for you should you need it.  Of course, following the cyber security program will also decrease the chances that you will have an incident in the first place with better security in place.

If you are interested in discussing this program with us, please reach out to us at (888) 600-4560 or email us at info@coldencompany.com.

Tweet

Putting Meltdown and Spectre in Perspective

Posted on: January 30th, 2018 by billp | No Comments

There’s recently been a lot of media attention around two vulnerabilities in computer chips. The vulnerabilities, given the ominous titles “Meltdown” and “Spectre,” exist in nearly all microprocessors made since 1995 — meaning they are found in nearly every popular business computer, home computer, and other devices such as smartphones and tablets.

One of the biggest challenges with cybersecurity is putting perspective to the severity of issues. Bugs and vulnerabilities that receive logos, names, and headlines usually result in a big – and often out-of-proportion – reaction. There’s no arguing the fact that these vulnerabilities are significant and should not be taken lightly. But, before you start to panic, the situation sounds a lot worse than it is. There is always a balance of “probability and exploitability” that businesses should consider in determining how likely they are to fall victim any cybersecurity vulnerability.

What are Meltdown and Spectre?

Both Meltdown and Spectre are hardware vulnerabilities in computer chips (microprocessors) that allow a non-privileged user to access information on the computer that they shouldn’t be able to access. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to access secrets stored in the memory of other running programs, which might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages, and even business-critical documents. This is a particularly big problem for cloud services like Microsoft Azure and Amazon Web Services, where multiple “tenants” use the same physical hardware.

Meltdown and Spectre require a high degree of sophistication, time, and luck for hackers to be able to exploit. These vulnerabilities have been around for 20 years and are something that both researchers and government agencies have been aware of for at least six months, yet we haven’t heard of any active exploits in the wild.

How Do I Protect Myself?

This is where things get complicated…

All major hardware and software vendors have released patches that address Meltdown and Spectre in the weeks since the disclosure of the vulnerabilities. In the case of Microsoft, its patches for Windows require that your antivirus software to updated to ensure Meltdown/Spectre updates won’t crash your computer (users of Colden Company’s Managed Antivirus are compatible with Microsoft’s updates). Intel released – and then retracted – updates to its microcode (software that runs the processor), and Microsoft then released an emergency update to fix the problems that Intel’s buggy updates caused.

The updates can be more impactful on computers (particularly servers) running older Intel processors and/or certain workloads, where updating to mitigate Meltdown/Spectre has the potential to reduce performance between 5% and 30%. The performance impact is very dependant on what software is running on the computer. Microsoft attempted to add some clarity to the potential performance impacts in a recent blog post.

To get back to the question of how you protect yourself and your business, Colden Company recommends patching – and not panicking – as reliable patches are made available from hardware and software vendors.  Ask yourself how quickly you can reliably apply known-good and tested patches from reliable vendors, especially on critical systems.

Use the following steps to guide you down a good path to mitigating Meltdown and Spectre.

  1. Update antivirus software to ensure Meltdown/Spectre patches from Microsoft aren’t blocked.
  2. Update operating systems with relevant patches.
  3. Update hypervisor hosts, guest OSes, and cloud instances.
  4. Update system BIOS / firmware.
  5. Update web browsers where applicable.
  6. Check for updates to other applications and peripherals.

If even the above steps seem daunting, our best recommendation is to partner with experts at Colden Company to help ensure your business is protected.

Conclusion

The scope of this issue is huge. According to a survey of 500 IT professionals by IT organization Spiceworks, 70% of businesses report they continue patching despite the guidance from Intel to stop. 46% of companies have reported performance degradation, 26% are dealing with system “hangs” and freezes, and 22% are experiencing issues with computers not rebooting properly after the patches are installed. Costs from the mitigation effort also mounting for some companies. 29% of companies with more than 1,000 employees said they expect to spend more than 80 hours addressing the flaws, and 18% said they expected to spend more than $50,000.

While exploiting either Meltdown or Spectre requires a high level of sophistication, it’s still early days, and incidents that take advantage of Meltdown and Spectre will be inevitable. Laptop and desktop workstations are at the greatest risk, so make sure that you’re current with Microsoft patches as they’re released. You should be diligent about patching all systems and mobile devices. Work with your cloud providers and business partners to ensure they have a mitigation plan. Don’t worry, don’t panic, but be diligent and be sure to install patches as soon as they become available for your specific operating systems and devices.

This is a complicated topic and can quickly become overwhelming. Give the experts at Colden Company a call and let us help you protect your business against these and other cybersecurity risks. Call us at 888-600-4560, email us, or visit us on Facebook or Twitter.







National Cyber Security Awareness Month

Posted on: October 28th, 2017 by jiml | No Comments

October was National Cyber Security Awareness Month. Here at Colden Company we are trying to do our part to raise awareness through webinars, social media posts, and other communications. We often say here at Colden Company “If you are running your business the same way you were three or four years ago, you are not staying the same, you are falling behind.” This saying was originally intended to apply to technology because technology is continually advancing; if your business is not taking advantage of it, your competition likely is. The saying is also particularly appropriate for data security. The threats facing your business are not staying the same; they have increased in both number and complexity over the years. We do not think anyone reading this would disagree with that point. In conjunction, your defenses should also be improving to combat the increasing threats. If you are using the same defenses you were three or four years ago, you are not staying the same, you are falling behind the data security curve and, most importantly, exposing your business to more risk.

Raising awareness to cyber security concerns is a worthwhile exercise. However, it seems like we are running the risk of desensitizing people to the risk by continual bombardment of this breach and that vulnerability that appear on the nightly news. Not all vulnerabilities are equal in size and scale and some judgment needs to be used to inform the public of the risks. Having said that, the risks are real. Cyber criminals have, unfortunately, been wildly successful with certain hacking campaigns like ransomware, which has lined their pockets with millions of dollars (and in some cases tens of millions) which they are using to perfect their craft. Hacking is a business and it is big business – make no mistake about it.

As a business, you may read about the latest breach and think to yourself “Here we go again. I can’t stop it so why worry about it.” We understand that sentiment. The question we would pose is “If you could stop a data breach at your business, would you?”. It’s true that there are many different threat vectors that hackers can use to attack your business. Why not spend time and effort blocking the most common ones? There are things you can do without breaking the bank to further protect your business. Incremental improvement may just save the day and prevent a breach.

When a hacker probes your business for a vulnerability and your business is protected from it, do you know? In most cases, the answer is no. Hackers use sophisticated programs to probe networks and attack the ones that are vulnerable and leave the ones that are not. This makes proving return on investment (ROI) for security a much more difficult number to show. How do you show ROI on something that did not occur? We can only do so, by citing the costs of breaches that have occurred.

Hacking attempts and breach attempts happen on a much more regular basis than you may believe. It is almost a certainty that your business was targeted at some point in the last year. The frequency with which this type of activity occurs would surprise most. We see more of this because it is our business to protect our customer’s critical data and we have tools in place to monitor and report on certain types of attacks. Unfortunately, the business that have with the best security measures in place are often the ones who had a security breach or had some type of security scare. It is analogous to buying the home security system after the break-in; you don’t want to go through that experience again, so you prepare.

So, in closing, I ask you to do this. Tomorrow morning when you wake up, pretend you just got a phone call from a staff member who told you there has been a data breach at your business and data has been compromised or lost. What would you do? How would you feel? If you would like to avoid that feeling, take the time to improve your data security to keep pace with the increasing threats. After all, if you are staying the same, you are falling behind.

Give our certified security experts at Colden Company a call at (888) 600-4560 or email us, or visit us on Facebook or Twitter.