Ransomware Insurance for Remote Work
Today, a number of companies offer work-from-home options, making remote work environments widespread. But concerns about cybersecurity are equally prominent. The best way to combat online dangers is to get cybersecurity protection. You should also be aware of the different difficulties that come with working remotely and take preventative measures to avoid them.
Since millions of Americans now work from home, one of the most frequent queries we have from brokers is whether their client’s policy will cover a cyber incident where the source or vector is a remote worker. Working from home was suddenly made necessary due to the coronavirus (COVID-19) epidemic. Working remotely has become the new standard for many companies and their staff during the workweek.
Cyber insurance considerations for remote work
It’s critical for businesses to assess their current policies as they adjust to the shifting environment of work to make sure they sufficiently address the changing requirements of their workforce. Traditional insurance might not offer enough coverage for people working from home, given the trend towards remote work. Companies should make sure that the special risks connected to remote work are covered by their current insurance policies, which include property insurance, workers’ compensation, and general liability.
What cybersecurity differences exist between regular office setups and remote work environments?
Secure networks and devices outside of the main office are part of remote work cybersecurity. It entails safeguarding distinct gadgets independently. On the other hand, conventional office configurations prioritise the protection of centralised systems in a regulated setting.
What impact does working remotely have on cyber threat detection and tracking?
Because of the multiple places and devices involved, cyber threat detection and surveillance are challenging in remote work. To get over the difficulties, businesses might employ real-time threat detection technologies and centralised monitoring systems.
Watch Out for Policy Exclusions: Use Your Own Devices (BYOD) Policy: For instance, in the present COVID-19 environment, a company without a defined BYOD security strategy may find itself overloaded with employees utilising their personal devices for work; in fact, the company may be requiring that they do so as a matter of necessity. Cyber incidents that begin with a remote employee using a personal device may not be covered by the company’s cyber insurance if it has exclusions that restrict coverage to company-owned infrastructure, even if they ultimately affect the company’s computer systems and central IT infrastructure.
Exclusions such as the one mentioned above may also affect coverage for third parties in the event that sensitive data is lost due to a security breach. It is legally irrelevant what device an employee used if the breach resulted from them disclosing credentials or granting access in any other way. Whatever happens, the corporation is responsible for any fines imposed by the authorities, notification obligations, financial losses, and other expenses. Therefore, the uncompensated third-party expenses could be high if the insurer’s response is restricted by a cyber policy’s exclusions.
Consideration of cyber insurance might give your home office an extra degree of security and peace of mind against potential online attacks. Businesses and people are more susceptible to cyberattacks and data breaches as remote work becomes more common. Policies for cyber insurance can lessen the dangers to one’s finances and reputation that come with these kinds of disasters.
In the event of a cyberattack, ransomware insurance usually covers a variety of expenditures, such as legal fees, data recovery, and consumer notification costs. Additionally, it may offer coverage for business interruption losses, which may be substantial in the event that your home office is attacked and you are rendered unable to operate for an extended period of time.
Furthermore, access to specialised resources like public relations specialists and forensic experts that may assist you in navigating the aftermath of a cyber catastrophe is frequently provided by cyber insurance coverage. By purchasing cyber insurance, you may give an insurance provider part of the financial strain and anxiety brought on by cyber risks, freeing you up to concentrate on your business and the efficiency of your home office.
Potential risk factors associated with working remotely
- Susceptible WiFi networks: Employees typically access company accounts using wireless networks at home. However, there are times when individuals may connect to public Wi-Fi networks while they are out and about, and these networks are highly susceptible to hackers. Because so many people use public networks, data theft by hackers is easy.
- Incorrect cloud configurations: The majority of remote employees rely on cloud computing to enable them to access corporate data from different places. The cloud infrastructure is necessary, but it also carries the risk of misconfiguration—the wrong settings and security precautions being put in place. In short, this renders remote workers open to cyberattacks.
- Expanded area of attack: The increased attack surface is one of the main cybersecurity threats associated with remote work. Cybercriminals have more entry points into remote workplaces where various employees use divergent devices and networks. An increased attack surface gives hackers additional chances to identify weak points and steal data.
- Vulnerable to attacks involving phishing: Scams using social engineering might arise when working remotely from any location outside the office. These scams target those who are preoccupied with outside factors and are not under the direct supervision of their organisations’ individual data security. Phishing attacks involve con artists sending emails or SMS pretending to be from the company.
- Unsecured applications (software): Periodic software updates are built into laptops. Employees who neglect to perform routine upgrades on their devices may be exposed to security risks. Furthermore, workers in distant work environments could occasionally want to communicate or share files using their personal devices. The software on those devices could present a cybersecurity risk if it is not safeguarded.
- Interactions without encryption: Information kept on the network is not protected by encryption while workers work from home. The same holds true for cloud-shared documents and company information. Employees may occasionally download files to their local device when working remotely, and these files may or may not be encrypted. Information exposure from such interactions poses threats to security.
Protecting against ransomware in remote environments
- Employee education: All staff members, whether they work in an office or at home, should have regular cybersecurity education. Employees must be acquainted with the basics of the most recent social engineering techniques as well as the protocols for reporting and responding to incidents.
- Securing remote desktop protocols: If at all feasible, deactivate the remote desktop protocol and other types of remote access. If RDP is required for the organisation to operate, it must be well protected using strong passwords, MFA, a VPN or RDP gateway, and limiting RDP access to particular individuals and IP ranges. For additional information on protecting RDP from ransomware, see this blog post.
- Implement MFA: One of the main ways that ransomware spreads is through compromised user credentials. Wherever practicable, multi-factor authentication should be enabled to reduce this risk; in particular, remote access to corporate networks and collaborative services should receive special consideration. MFA should be used to safeguard security software settings, and cloud-based antivirus management platforms make it simple to do so.
- Sustain VPN devices: The abrupt transition to remote work caused a spike in the market for paid VPNs. VPN equipment is essential for protecting data connected to the workplace, but it may also serve as a point of entry for hackers. For this reason, it’s important to keep an eye on them and update them frequently to make sure that any security flaws are immediately repaired.
- Setting up trustworthy antivirus software: To identify and neutralise the first malware used for reconnaissance and propagation in the early phases of an attack, organisations need to have a strong antivirus solution in place. As previously mentioned, enterprises should think about selecting antivirus providers with a well-established product in the consumer market, as enterprise-specific security solutions may not be able to handle the diversity of the home user environment. Since employees’ personal devices could already have active infections, it is essential for network security to include traditional detection and repair in the onboarding process.
- Filtering unwanted messages: Most dangerous spam may be prevented with a strong spam filter, which also lowers the chance of malware infection through phishing URLs and attachments. It is possible to set filters up such that specific attachment types—like documents with macros—don’t get delivered.
- Take PowerShell out. Threat actors commonly employ PowerShell, a potent administrative tool, in the early phases of an assault. Unless absolutely required, organisations ought to think about eliminating PowerShell from remote endpoints. In the event that PowerShell cannot be eliminated, it must be sufficiently protected (for example, by restricting its use to individuals who actually require it and enabling the execution of only digitally signed scripts).
- Verify requests: The shift to remote labour has interrupted and altered regular workflows, which raises the possibility of fraud. Workers should be on the lookout for fraudulent activities and urged to corroborate any strange requests or directives, whether they come from supervisors, coworkers, suppliers, or clients. If there is any doubt that the sender’s account has been compromised, confirmation should be requested through an alternate communication channel.
- Generate backups: One of the most important ways to mitigate ransomware in a remote work setting is to have a solid backup plan. While deploying local backups for each remote worker would be logistically difficult, security concerns and bandwidth constraints may discourage organisations from sending backups to their local network area server (NAS) over a virtual private network (VPN). Considering these aspects, a cloud-based backup solution is most likely the most sensible choice for the majority of businesses. For additional details on creating backups resistant to ransomware, go to this page.
All sizes of businesses need to be aware of the security risks associated with remote work and take precautions to protect their corporate assets, networks, and remote endpoints. By putting the security procedures outlined in this article into practice, businesses may greatly lower their risk of compromise and prevent themselves from being the next ransomware victim.