Cyberattacks 101: Preparation and Response

Cyberattacks are a growing threat for businesses of all sizes. According to Astra, 46% of cyberattacks target businesses with 1,000 employees or fewer and small to midsize businesses lose an average of $25,000 in each attack. For larger companies, the losses are often even greater. To minimize the threat, businesses need to know how to prepare and what to do after a cyberattack.

What Counts as a Cyberattack?

Before you can prepare for a threat, you need to understand it. According to the National Institute of Standards and Technology, one definition of a cyberattack is “any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.”

In other words, any attack that targets your computers, computer systems, or data is a cyberattack. Cyberattacks take many forms, including:

• Ransomware and other types of malware
• Phishing and other social engineering attacks
• Denial-of-service attacks and distributed denial-of-service attacks
• Zero-day exploits

Avoid Being a Target

If your neighborhood had an increase in burglaries, you might respond by checking your locks, installing a security system, and watching for suspicious strangers. You should use similar tactics to reduce the risk of cybercriminals targeting your business.

• Keep your software up to date. Software updates often include security patches to fix known vulnerabilities. Install these before hackers have a chance to exploit the vulnerabilities.
• Fortify your systems. Antivirus software, firewalls, strong passwords, multifactor authentication, encryption, and spam filters create a barrier between hackers and your computers.
• Train your team. Since cybercriminals may target your employees with phishing attacks and other social engineering scams, everyone needs to take responsibility for cybersecurity. Train and test your workers to avoid phishing attacks. Also make sure everyone uses strong passwords and secure computer networks. Create a cybersecurity policy that outlines the responsibilities of all workers.

Minimize the Impact of a Cyberattack

Even if preparation does not prevent an attack, it may help you minimize the impact.

• Back up your data. Weekly or daily backups will help your business continue to operate after an attack. Three common options for backups are cloud storage, internal hard drives, and removable storage media. CISA recommends the 3-2-1 rule: keep 3 copies of any important file, keep the files on 2 different media types, and store 1 copy offsite.
• Create a system for reporting incidents. If one of your employees accidentally clicks on a suspicious link, what happens next? Although it may look like nothing is happening, it’s possible your computer system is being infected with malware or otherwise compromised. The sooner your company knows, the better. It’s important to have a way for employees to report incidents of every possible incident – even if they’re not sure.
• Buy cyber insurance. Cyber insurance covers many costs associated with a cyberattack, including ransoms, compliance with data breach notification laws, and business interruptions. Your insurer will also provide expert resources to help you minimize your risks and reduce the impact of an attack.

What to Do After a Cyberattack

If you suffer a cyberattack, a quick response is critical.

• Notify your cyber insurer. If you have cyber insurance, notify your insurer immediately. Prompt notification is likely a requirement under the terms of your policy. A failure to provide notification may jeopardize your coverage. Moreover, your insurers can assist you as you deal with the attack.
• Contain the attack. It’s typically necessary to shut down the affected system to prevent further damage and spread of the attack.
• Investigate the attack. A forensic investigation will provide vital information regarding the cause and extent of the attack.
• Inform those the attack has affected. State data breach notification laws require businesses to notify consumers when their personal data has been breached. You may also need to notify vendors, business clients, and other stakeholders.
• Resume operations. If certain systems are still down, you may need to find other ways to operate. You may also need to use data backups or data recovery. In the case of ransomware, you will need to decide whether to pay the ransom.

Cyberattacks are a major threat, but businesses can protect themselves by being proactive. Do you have questions about what to do after a cyberattack or do you need help securing cyber insurance? Contact Heffernan Insurance Brokers.