CyberheistNews Vol 11 #21 [Heads Up] The Cybersecurity Insurance Landscape Is Fundamentally Changing Right Now

CyberheistNews Vol 11 #21

[Heads Up] The Cybersecurity Insurance Landscape Is Fundamentally Changing Right Now

There is a sea change happening you need to know about. We have observed significant developments in the cybersecurity landscape recently, to a large extent driven by the enormous damage caused by ransomware.

I asked Roger Grimes to summarize what is happening at the moment, and we just published a blog post with his observations after he researched the matter and spoke to subject matter experts.

Here is a paragraph from his blog post: "Ransomware has been so successful in compromising victims and getting big payouts that it has led to a rapid, fundamental change in the cybersecurity industry. Many previous cybersecurity insurance players are getting out of the industry or refusing to insure for ransomware and other cyber crime. Those that are left are charging more, insuring for less and requiring proof of far stronger controls before a policy is issued."

Expect significantly higher premiums, less coverage, more outs, less options, and stronger requirements.

"If you already have a cybersecurity insurance policy call your broker to see if anything has changed because for sure the terms you had in the past will not be the terms you have going forward.

Additionally, you may want to check out if they offer any other services that they didn’t use to offer. To paraphrase an old commercial, today’s cybersecurity insurance industry was not your father’s cybersecurity industry. In fact, it isn’t even what your cybersecurity insurance industry was just a few months ago."

Here is the whole post from May 26, it's a 6-minute read, and again you need to know this before you find out it's too late.

Please forward to your friends:
https://blog.knowbe4.com/cybersecurity-insurance-landscape-is-fundamentally-changing-right-now

[Live Demo] Ridiculously Easy Security Awareness Training and Phishing

Old-school awareness training does not hack it anymore. Your email filters have an average 7-10% failure rate; you need a strong human firewall as your last line of defense.

Join us Wednesday, June 9 @ 2:00 PM (ET), for a live demonstration of how KnowBe4 introduces a new-school approach to security awareness training and simulated phishing.

Get a look at new features and see how easy it is to train and phish your users.

NEW! AI-Driven phishing and training recommendations based on your users' phishing and training history.
NEW! Brandable Content feature gives you the option to add branded custom content to select training modules.
NEW! Security Awareness Proficiency Assessment Benchmarks let you compare your organization’s proficiency scores with other companies in your industry.
Did You Know? You can upload your own SCORM training modules into your account for home workers.
Active Directory Integration to easily upload user data, eliminating the need to manually manage user changes.

Find out how 39,000+ organizations have mobilized their end-users as their human firewall.

Date/Time: Wednesday, June 9 @ 2:00 PM (ET)

Save My Spot!
https://event.on24.com/wcc/r/3110214/5D9F71BFE5D7D7FBA2952D161C674BF4?partnerref=CHN2

[Eye Opener] Ransomware-as-a-Service Is Organizing, Becoming More Devastating and Costly

Take a look at the complex relationships that exist today between the ransomware gangs and the various services they utilize, and you quickly realize this is a very organized and effective business.

Ransomware has quickly grown into a robust ecosystem of players, vendors, suppliers and service providers all working in the interest of taking your organization for as much money as is humanly possible.

Cryptocurrency and blockchain data provider Chainalysis in their "Ransomware 2021: Critical Mid-Year Update Report" shed some light on exactly why. In 2020, the total amount paid by ransomware victims rose 311% from the previous year.

Like reputable online services, both the ransomware code itself and the supporting services it requires are offered in tiers of services to meet the needs of the “customer”. Take the example below showing the various packages offered for use of ransomware software.

CONTINUED:
https://blog.knowbe4.com/ransomware-as-a-service-is-organizing-becoming-more-devastating-and-costly

See How You Can Get Audits Done in Half the Time, Half the Cost and Half the Stress

You told us you have challenging compliance requirements, not enough time to get audits done, and keeping up with risk assessments and third-party vendor risk is a continuous problem.

KCM GRC is a SaaS-based platform that includes Compliance, Risk, Policy and Vendor Risk Management modules. KCM was developed to save you the maximum amount of time getting GRC done.

Join us Wednesday, June 9 @ 1:00 PM (ET), for a 30-minute live product demo of KnowBe4's KCM GRC platform. Plus, get a look at new compliance management features we've added to make managing your compliance projects even easier!

NEW! Control guidance feature provides in-platform suggestions to help you create controls to meet your specific scopes and requirements.
Vet, manage and monitor your third-party vendors' security risk requirements.
Simplify risk management with an intuitive interface and simple workflow based on the well-recognized NIST 800-30.
Quick implementation with pre-built requirements templates for the most widely used regulations.
Dashboards with automated reminders to quickly see what tasks have been completed, not met, and past due.

Date/Time: Wednesday, June 9 @ 1:00 PM (ET)

Save My Spot!
https://event.on24.com/wcc/r/3110203/CB3BBD0FE16A17E539F194EC7ADF1873?partnerref=CHN

More Targeted Phishing Attacks Are Coming

By Roger Grimes. I have been in the cybersecurity business for 34 years. I am not innately brilliant, but one of the things I seem to do well is to spot trends as they happen early in their cycle. It is likely just because I have seen so many trends and have been around for their growing development.

The growing trend I am seeing right now is increasingly targeted attacks. In the past, most malware and hacker attacks were almost accidental if your organization got hit. The hacker(s) would send out 200M phishing emails and whoever was unlucky enough to open them and click on the links was almost random.

I do not have any real figures, but I bet the number of attacks that targeted specific people and organizations numbered in the tens of thousands in a given year while the number of random attacks numbered in the trillions. In the past, odds were that if your company got hit by a hacking attack or malware it was simply a matter of overwhelming odds. Sure, there have always been targeted attacks, but they were a miniscule percentage of the attacks in comparison.

That is changing. I can feel it. I can see it. And in an industry that does not need it, it has foreboding implications. Here is why and what it means.

CONTINUED:
https://blog.knowbe4.com/more-targeted-phishing-attacks-are-coming

Learn To Detect and Defend Against Supply Chain Attacks Before They Compromise Your Network

Your job is to safeguard your organization and its assets from bad actors trying to infiltrate your network. But what do you do when the threat is coming from what looks like a trusted partner or vendor? If they get hacked, the bad guys can target you based on your partnership. These attacks are incredibly hard to detect because they are actually coming from TRUSTED sources. In today’s environment you can trust no one!

Join Roger Grimes, Data-Driven Defense Evangelist at KnowBe4, for this webinar where he’ll break down supply chain attacks to help you differentiate the good guys from the bad guys. He’ll discuss:

How cyber criminals pulled off recent, high-profile supply chain attacks
Why these threats are so hard to detect
What you can do now to prevent these cyberattacks from compromising your organization
How to turn the tables on attackers and use their attempts to actually improve your security posture

Get the information you need to know now to protect your organization! And earn CPE credit for attending.

Date/Time: Wednesday, June 16 @ 2:00 (ET)

Save My Spot!
https://event.on24.com/wcc/r/3213715/3EBDBDECC0CC04BE422B420090CEDF56?partnerref=CHN

Let's stay safe out there.

Warm Regards,

Stu Sjouwerman
Founder and CEO
KnowBe4, Inc

PS: You can see me in a TD Ameritrade interview about our recent earnings call. You may have missed it but KnowBe4 (KNBE) recently went public.
https://tdameritradenetwork.com/video/rB4A-HmtHb2Bea9RDUMAZA

Quotes of the Week

"What a man does not understand, he does not possess."
- Johann Wolfgang von Goethe - Poet (1749 - 1832)

"The improvement of understanding is for two ends: first, our own increase of knowledge; secondly, to enable us to deliver that knowledge to others."
- John Locke - Philosopher (1632 - 1704)

"Many of the truths that we cling to depend on our point of view."
- OB1 KNBE

Thanks for reading CyberheistNews

Security News

8th Layer Insights, a New Podcast in the CyberWire Network, Is Now Available

A fascinating new podcast, hosted by Perry Carpenter, is now up in the CyberWire network. Perry is well known in the industry as an influential author, security researcher, and behavioral science enthusiast, and he’s appeared on their shows many times over the years. In this show, he brings in industry experts to discuss how the complexities of human nature affect security and risk.

Check it out and subscribe on your favorite podcast app:
https://thecyberwire.com/podcasts/8th-layer-insights/0/notes?utm_source=dailybriefing&utm_medium=Announcement&utm_campaign=8thlayerpostlaunch

A Popular Fraud Combo Is Back: Elon Musk and Bitcoin

Researchers at Bitdefender warn that cybercriminals continue to impersonate Elon Musk in Bitcoin scams. One campaign that started on May 15 involved sending thousands of emails telling users to register for a $5,000 Bitcoin giveaway organized by Tesla.

“79.72% of scam emails appear to be sent from IP addresses in Germany, targeting users in Europe and North America. 11% of the fraudulent emails have reached users in the UK, 79.26% in Sweden, and 9.22% in the US,” the researchers write. “Cybercriminals mix and match subject lines, pdf names, and messages to dodge spam filters.

Blog Post with Examples:
https://blog.knowbe4.com/a-popular-fraud-combo-is-back-elon-musk-and-bitcoin

UK Royal Mail Smishing Crew Nabbed by City of London Police

According to a report by ZDNet, there were arrests made due to suspicions of sending 'smishing' texts. Smishing is a form of phishing that sends SMS messages in order to steal personal information.

In this real-life scenario, recipients were sent fake versions of trusted organization's websites like the Royal Mail. The text claimed that the recipient needed to pay a postage fee by entering specific details in order to rearrange a delivery.

Detective Chief Inspector Gary Robinson said in a statement, "The success of these operations shows how through our close collaboration with Royal Mail, the financial services sector, and mobile phone networks, we are cracking down on the criminals ruthlessly targeting the public."

Investigations are still ongoing with the City of London planning to make more arrests. With new smishing tactics out in the wild, it's important for your users to take every text message seriously. Frequent phishing tests and new-school security awareness training can ensure your users are prepared to spot and report any suspicious activity.

Blog with links:
https://blog.knowbe4.com/uk-royal-mail-smishing-crew-nabbed-by-city-of-london-police

What KnowBe4 Customers Say

"We’ve recently conducted our first internal phishing campaign (the Baseline Phishing Test) and with KnowBe4 platform, we were able to effortlessly evaluate our Phish-prone percentage and design our training program that is better tailored to our needs.

I was impressed by how many resources and functionalities the KnowBe4 platform provides to support all stages of the training and awareness program implementation.

We are about to launch our new and improved training and awareness program, just making some last minute amendments to reflect our phishing simulation results.

Thanks to the KnowBe4 robust, integrated environment for the full spectrum of the training and awareness field, we could have gone for even more sophisticated Training Program that we initially thought.

The number of helpful guides and articles on the best use of the available resources within the platform, made our work so much easier. We are happy campers!"
- B.K., ICT Security Manager

The 10 Interesting News Items This Week