With the current COVID-19 pandemic, more people are opting to away from crowds and social situations – and may work from home.
While and employer’s cybersecurity insurance can reduce liability, it makes sense to also implement several security measures in the telecommuting (work-from-home) policy to protect the company.
Use Secure Wi-Fi Networks
Sure, your employees could connect to their neighbor’s wireless network or use public Wi-Fi at a coffee shop. These unsecured networks can open the door for cybersecurity breaches, though. Instruct employees to only connect to secure Wi-Fi networks or provide a safe and secure Virtual Private Network (VPN) for use as they work.
Maintain Security Settings
To protect work-issued devices and confidential data, you may set security settings on the devices you give telecommuters. Remind employees that they should not use a proxy or other method to get around those security settings. Doing so will compromise their device and the company’s data.
Encrypt Everything
From apps to data, everything employees access from their work-issued device should be protected by encryption. This security measure makes it harder for thieves and hackers to steal or access information.
Limit Access
Employees should only have access to essential data and files, not the company’s entire virtual filing cabinet. This limited access protects information and improves security
Strengthen Passwords
To get into the device and access various files, employees should use secure passwords. The ideal password contains letters, numbers and symbols, is not easy to guess and is unique to each site. Change passwords at least once a month, too. For additional safety, utilize a two-step authentication process, PIN or token system when logging it.
Prohibit Device Lending
It’s common for telecommuters to let a co-worker or family member use their laptop or phone for a few minutes to check email, play a game or make a call. Discourage this practice since the other person could download questionable content, drop or damage the device, access confidential files, or otherwise compromises the device or security.
Protect Devices from Theft
Leaving a laptop, tablet or phone unattended gives thieves an invitation to steal the device. Remind employees to keep their devices with them at all times and not leave their work devices unattended or in an unlocked vehicle. Likewise, they should take care to secure USB drives and other accessories from theft. You can add tracking capabilities to devices for additional security.
Log Out
After every work session, employees should log out of the websites they accessed, their Wi-Fi network and their device. This log out procedure protects company data.
Telecommuting is a privilege that benefits your employees and company. Use these security measures to protect everyone.
Read more
Modern technology has made it easier than ever for employees to work from home and still remain connected to their place of employment. Using remote employment has actually become a popular trend over the last ten years, especially since selling to the global market has become such an important factor in a business being competitive. Many businesses have found that they can minimize their expenses and attract international customers with more attractive prices if they decrease their overhead by allowing workers to remotely commute.
Despite the many benefits of using remote employees, there are downsides. Many employers considering this trend wonder how they can ensure workplace safety when the employee’s physical workplace is their own home. Another consideration is the degree of employer liability in remote employment.
Fortunately, OSHA has addressed some of the safety issues surrounding remote employment. According to OSHA guidelines, employers are required to maintain a safe workplace, even for employees working from their own home. OSHA will not require an employer to inspect a remote employee’s home worksite, nor inspect it themselves.
However, OSHA may inspect the worksite of an employee that’s performing an at-home job on behalf of their employer if it possibly involves health or safety hazards and there’s a complaint. A record of all occupational illnesses and injuries must be kept on all at-home workers if an employer is subject to OSHA record keeping requirements. Keeping in mind that OSHA compliance measures shouldn’t involve controlling the home worksite of employees, employers might need to take some additional practical measures to ensure OSHA compliance.
As far as safety compliance goes, the absence of immediate supervision for remote workers is one of the main problems employers face. Experienced, highly-trained, long-term employers are generally the worst offenders when it comes to taking safety risks. This group of employees often become complacent due to the fact they’re so accustomed and comfortable with their job, feel they’re familiar with the job’s hazards, and might have escaped disciplinary action when ignoring safety procedures or taking shortcuts in the past.
One of the best ways that employers can counteract the above dangerous attitude toward safety is by using a holistic approach to safety. Employers should focus and place great importance on each individual employee actively participating in the safety process and taking responsibility for their own safety. Whether at home, on the road, or at a remote jobsite, remote employees need to be ready, willing, and able to take the appropriate actions to protect themselves in any given situation.
Employers will need employee support to make any approach to safety successful, which means that employers must have total employee involvement in the safety process. Involve your remote employees in the process of determining what’s needed to prevent injury to themselves and others during remote location work. Most employers find that the experience and firsthand knowledge of their employees is actually very advantageous in creating safe remote worksites.
Remember, employees that understand the value of safety are more likely to be motivated and willing participants. They’re also more apt to embrace safety behaviors for the longevity of their employment. Employers can reinforce their employee’s positive attitude about safety by having electronic or person-to-person safety counseling in place and ensuring safety managers are encouraging safety participation.
Read more
As technology becomes increasingly important for successful business operations, the value of a strong cyber liability insurance policy continues to grow. The continued rise in the amount of information stored and transferred electronically has resulted in a remarkable increase in the potential exposures facing businesses.
In an age where a stolen laptop or data breach can instantly compromise the personal data of thousands of customers, protecting your business from cyber liability is just as important as some of the more traditional exposures businesses account for in their commercial general liability policies.
Claims Scenario: Outsourcing Gone Wrong
The company: A national construction company that outsources some of its cyber security protections
The challenge: A construction firm partnered with a third-party cloud service provider in order to store customer information. While this service helped the company save on server costs, the third-party firm suffered a data breach.
As a result, the construction firm had to notify 10,000 of its customers and was forced to pay nearly $200,000 in incident investigation costs. The incident was made worse by the fact that the firm did not have a document retention procedure, which complicated the incident response process.
Cyber liability insurance in action: Following a data breach or other cyber event, the right policy can help organizations recoup a number of key costs. Specifically, cyber liability policies often cover investigation and forensics expenses—expenses that can easily bankrupt smaller firms who forgo coverage.
What’s more, when third parties are involved, managing litigation concerns can be a challenge. By using cyber liability insurance, organizations have access to legal professionals well-versed in cyber lawsuits and response.
Claims Scenario: Pardon the Interruption
The company: An online retail store that relies heavily on e-commerce
The challenge: A small-sized, online retailer partnered with a data centre to host its website and store its data. This is not uncommon, as many small businesses don’t have the IT infrastructure to host products, process payments and fulfil orders on-site.
Unfortunately, the data centre was targeted in a distributed denial-of-service (DDoS) attack. As a result of this attack, the retailer’s website went down for several days. While functionality was eventually restored, business interruption costs from lost sales and website downtime was over $165,000.
Cyber liability insurance in action: DDoS attacks are one of many weapons cyber criminals use to infiltrate and disrupt businesses. These attacks can impact any organization that owns a website, regardless of where it’s hosted.
Cyber liability insurance is one of the only protections organizations have against costly DDoS attacks and similar disruptions. This is because cyber policies offer business interruption loss reimbursement. Following a disruption caused by a cyber event, policies kick in and help organizations recover from any financial losses.
Benefits of Cyber Liability Insurance
- Data breach coverage—In the event of a breach, organizations are required by law to notify affected parties. This can add to overall data breach costs, particularly as they relate to security fixes, identity theft protection for those impacted by the breach and protection from possible legal action. Cyber liability policies include coverage for these exposures, thus safeguarding your data from cyber criminals.
- Business interruption loss reimbursement—A cyber attack can lead to an IT failure that disrupts business operations, costing your organization both time and money. Cyber liability policies may cover your loss of income during these interruptions. What’s more, increased costs to your business operations in the aftermath of a cyber attack may also be covered.
- Cyber extortion defence—Ransomware and similar malicious software are designed to steal and withhold key data from organizations until a steep fee is paid. As these types of attacks increase in frequency and severity, it’s critical that organizations seek cyber liability insurance, which can help recoup losses related to cyber extortion.
- Legal support—In the wake of a cyber incident, businesses often seek legal assistance. This assistance can be costly. Cyber liability insurance can help businesses afford proper legal work following a cyber attack.
When cyber attacks like data breaches and hacks occur, they can result in devastating damage. Businesses have to deal with business disruptions, lost revenue and litigation. It is important to remember that no organization is immune to the impact of cyber crime. As a result, cyber liability insurance has become an essential component to any risk management program.
Cyber exposures aren’t going away and, in fact, continue to escalate. Businesses need to be prepared in the event that a cyber attack strikes. To learn more about cyber liability insurance, contact Scurich Insurance today.
Read more
Cyber security threats and trends can change year over year as technology continues to advance at alarming speeds. As such, it’s critical for organizations to reassess their data protection practices at the start of each new year and make achievable cyber security resolutions to help protect themselves from costly breaches.
The following are resolutions your company can implement to ensure you don’t become the victim of a cyber crime:
- Provide security training—Employees are your first line of defense when it comes to cyber threats. Even the most robust and expensive data protection solutions can be compromised should an employee click a malicious link or download fraudulent software. As such, it’s critical for organizations to thoroughly train personnel on common cyber threats and how to respond. Employees should understand the dangers of visiting harmful websites, leaving their devices unattended and oversharing personal information on social media. Your employees should also know your cyber security policies and know how to report suspicious activity.
- Install strong anti-virus software and keep it updated—Outside of training your employees on the dangers of poor cyber security practices, strong anti-virus software is one of the best ways to protect your data. Organizations should conduct thorough research to choose software that’s best for their needs. Once installed, anti-virus programs should be kept up to date.
- Instill safe web browsing practices—Deceptive and malicious websites can easily infect your network, often leading to more serious cyber attacks. To protect your organization, employees should be trained on proper web usage and instructed to only interact with secured websites. For further protection, companies should consider blocking known threats and potentially malicious webpages outright.
- Create strong password policies—Ongoing password management can help prevent unauthorized attackers from compromising your organization’s password-protected information. Effective password management protects the integrity, availability and confidentiality of an organization’s passwords. Above all, you’ll want to create a password policy that specifies all of the organization’s requirements related to password management. This policy should require employees to change their password on a regular basis, avoid using the same password for multiple accounts and use special characters in their password.
- Use multi-factor authentication—While complex passwords can help deter cyber criminals, they can still be cracked. To further prevent cyber criminals from gaining access to employee accounts, multi-factor authentication is key. Multi-factor authentication adds a layer of security that allows companies to protect against compromised credentials. Through this method, users must confirm their identity by providing extra information (e.g., a phone number, unique security code) when attempting to access corporate applications, networks and servers.
- Get vulnerability assessments—The best way to evaluate your company’s data exposures is through a vulnerability assessment. Using a system of simulated attacks and stress tests, vulnerability assessments can help you uncover entry points into your system. Following these tests, security experts compile their findings and provide recommendations for improving network and data safety.
- Patch systems regularly and keep them updated—A common way cyber criminals gain entry into your system is by exploiting software vulnerabilities. To prevent this, it’s critical that you update applications, operating systems, security software and firmware on a regular basis.
- Back up your data—In the event that your system is compromised, it’s important to keep backup files. Failing to do so can result in the loss of critical business or proprietary data.
- Understand phishing threats and how to respond—In broad terms, phishing is a method cyber criminals use to gather personal information. In these scams, phishers send an email or direct users to fraudulent websites, asking victims to provide sensitive information. These emails and websites are designed to look legitimate and trick individuals into providing credit card numbers, account numbers, passwords, usernames or other sensitive information. Phishing is becoming more sophisticated by the day, and it’s more important than ever to understand the different types of attacks, how to identify them and preventive measures you can implement to keep your organization safe. As such, it’s critical to train employees on common phishing scams and other cyber security concerns. Provide real-world examples during training to help them better understand what to look for.
- Create an incident response plan—Most organizations have some form of data protection in place. While these protections are critical for minimizing the damages caused by a breach, they don’t provide clear action steps following an attack. That’s where cyber incident response plans can help. While cyber security programs help secure an organization’s digital assets, cyber incident response plans provide clear steps for companies to follow when a cyber event occurs. Response plans allow organizations to notify impacted customers and partners quickly and efficiently, limiting financial and reputational damages.
Read more
Because identity theft and data breaches are becoming an ever-growing problem, it’s important to not only have a different password for each account, but to make those passwords easy to remember and hard to guess. The following are tips you can use to make your password harder to crack:
- Change your passwords every 90 days. This might seem like a hassle at first, but hackers have a better chance at cracking your passwords if they never change. It’s also a good idea to avoid reusing passwords.
- Make your passwords at least eight characters long. Generally, the longer a password is, the harder it is to guess.
- Don’t use the same password for each account. Hackers target lower security websites and then test cracked passwords on higher security sites. Make sure each account has a different password.
- Include uppercase letters and special characters in your password. Special characters include symbols like “#,” “*,” “+” and “>.” These symbols can make your password more complex and harder to guess.
- Avoid using the names of spouses, kids or pets in your password. All it takes for a hacker to crack passwords that include these things is a little research on social media sites like Facebook and Twitter.
Read more
Public Wi-Fi allows your team to stay connected on the go. You have to be careful, though, because public Wi-Fi is notoriously unsecure. Cybercriminals could also log into the free network you use and access data on your devices, such as your login information or confidential client files. Exercise caution and stay safe in several ways as you use your laptop, tablet or smartphone on public Wi-Fi networks.
Verify the Network Name
Before logging in, research the network. Only log into Wi-Fi that originates from a legitimate source as you avoid a man-in-the-middle attack. For example, cybercriminals may name their network “Free Wi-Fi” or mimic the establishment’s name as a way to attract users. Ask the barista, librarian or other staff member to verify the name of their public Wi-Fi network before you log in.
Turn off File Sharing
Your team relies on file sharing, but this feature is lucrative for cybercriminals, too. That’s why you want to turn off file sharing when you use public Wi-Fi. This step protects your files and data you don’t want criminals to access.
Use a VPN
A virtual private network (VPN) encrypts data as it travels between your device and the server. Research free and paid VPN options, then add one to your devices for protection when you need it on the go.
Check for HTTPS
If you see a lock symbol and HTTPS in front of the website address in the status bar, you’re browsing a secure site. You can also use an HTTPS extension for extra protection.
Enable Two-Factor Authentication
With two-factor authentication, you add an extra layer of protection to your online browsing. Even if cybercriminals gain access to your password, they probably cannot get into your account since they need to enter a unique authentication code also.
Update Software
Browser and software patches can improve security. Make it a habit to install these patches when you’re connected to a trusted network. Never update software when you’re connected to public Wi-Fi.
Forget the Network
After your public Wi-Fi session ends, log off all the websites you were signed into and tell your device to forget the network. This step prevents cybercriminals from connecting to your device automatically the next time you’re in the network area.
Limit your Activity
It’s tempting to think that cybercrime couldn’t happen to you or that you can afford to be careless because you have cybercrime and business liability insurance. However, always use caution. Save sensitive or confidential work for when you’re on a trusted network.
Your company may utilize public Wi-Fi often to stay connected and get work done. Encourage your employees to use caution and follow these steps as they stay safe.
Read more
