As threat actors bring new sophistication to their techniques and adapt to improved cybersecurity efforts, more and more companies will realize they can no longer count on the default configuration of off-the-shelf IT solutions and tools like PaaS or SaaS.
Technology providers respond to changes in the threat landscape by adding or enhancing security functionalities all the time, but those features are often not turned on by default. Organisations need to stay on top of security enhancements in the products they use, so they can enable and properly configure these security features. If users just stick with the default configuration, they will be left unprotected.
In 2023, more organisations will come to realize that default / off-the-shelf configuration is no longer enough – they must fine tune. Businesses that are working with an MSP must also talk to their provider to make sure that they're implementing the right controls and make that part of vetting and managing their MSP relationship.
The success or failure of a threat actor comes down to security hygiene. If an organisation makes it harder for threat actors at every step, they might eventually give up and move on to target less-protected victims. At a minimum, organizations should have basic controls in place to block commonly used initial attack vectors, including phishing, stolen credentials, and other exposed vulnerabilities. After this important first step, robust controls that lessen privilege escalation, lateral movement, and exfiltration are ideal.
As security trends evolve, underwriting questions are also evolving. Using tools like our View of Risk, Beazley continuously helps our insureds to identity and address areas where we see an opportunity for them to optimize their controls.
The information set forth in this communication is intended as general risk management information. It is made available with the understanding that Beazley does not render legal services or advice. It should not be construed or relied upon as legal advice and is not intended as a substitute for consultation with counsel. Although reasonable care has been taken in preparing the information set forth in this communication, Beazley accepts no responsibility for any errors it may contain or for any losses allegedly attributable to this information. Non-insurance products and services are provided by non-insurance company Beazley affiliates and independent third parties. Separate terms and conditions may apply.
As security trends evolve, underwriting questions are also evolving. Using tools like our View of Risk, Beazley continuously helps our insureds to identity and address areas where we see an opportunity for them to optimize their controls.
