Have You Reviewed Your Cybersecurity Insurance Policy?

Coverage Loopholes

Cybersecurity rates are increasing while coverage is decreasing. Per the Wall Street Journal, “Direct-written premiums collected by the largest U.S. insurance carriers in 2021 swelled by 92% year-over-year”. Most of the increase is due to the sophistication of the attacks, higher ransomware payment demands, and the number of attacks. The State of Ransomware 2021 global survey (per Sophos) includes the following chilling facts:

  • The average cost of remediating a ransomware attack more than doubled in the last 12 months. Remediation costs, including business downtime, lost orders, operational costs, and more, grew from an average of $761,106 in 2020 to $1.85 million in 2021. This means that the average cost of recovering from a ransomware attack is now ten times the size of the ransom payment, on average
  • The average ransom paid was $170,404. While $3.2 million was the highest paid out of those surveyed, the most common payment was $10,000. Ten organizations paid ransoms of $1 million or more
  • The number of organizations paying ransom increased from 26% in 2020 to 32% in 2021, although fewer than one in 10 (8%) managed to get back all their data.

All this bad news results in cybersecurity insurance increases for your organization. 

Steps you can take to get the most value out of your cybersecurity insurance

Review your cybersecurity posture – take a self-assessment against theCIS Critical Security Controls (CIS Controls). Seeing how your organization ranks against the control can provide a snapshot of focus areas for improvement before obtaining or renewing your cybersecurity policy. If you aren’t sure where to start with the assessment or need help implementing improvements, Dewpoint’s cybersecurity experts are here to assist.

Review your data – the more highly sensitive data your organization holds, the more risk. Taking the simple step of reviewing your data can reduce your premium. Determine if you need the data to conduct your business and review the best way to safeguard it through additional security and limiting access to critical employees. If you need to print the information, make sure the paper is kept in a locked cabinet and office and destroyed in a secure method. If it is all virtual, use encryption software for email and limit file-sharing capabilities. 

Review your policy for loopholes – most insurance policies do not cover “an act of war.” If a ransomware attack occurs because of the current Russian invasion of Ukraine, would you be covered? It’s an excellent question to ask your provider, given the uncertainty in our world, and determine the definition of “war.” For more information on different types of insurance and what they cover, click here.

What’s Next?

Navigating through the cybersecurity insurance maze can be a daunting task. Dewpoint can help by starting with an assessment to identify gaps in your current environment and recommendations to reduce those gaps. Organizations with poor security controls may be uninsurable or unable to afford a policy if available. Reach out to one of our security experts to help you get the most value out of your cybersecurity insurance and increase your overall security posture.

Are You Taking Full Advantage of Your Microsoft Products?

Increase in Subscription Rates Across the Board

Microsoft rolled out a significant price increase on March 1st. This increase impacted some of the most common Microsoft 365 Business and Office 365 subscriptions. However, Microsoft has added additional value through numerous applications and features such as Microsoft Teams, Power Apps, Power BI, Power Automate, Stream, Planner, Visio, OneDrive, Yammer, and Whiteboard. 

The price increases can be significant to a small or midsize enterprise’s bottom line; thus, reviewing your subscription options is critical. Microsoft offers a la carte options, small bundles or suites, and larger bundles composed of smaller ones. Finding the right fit for your business is more important than ever.

Current Price Changes with More to Come

Below are the price changes effective March 1st: 

  • Microsoft 365 Business Basic (from $5 to $6 per user)  
  • Microsoft 365 Business Premium (from $20 to $22) 
  • Office 365 E1 (from $8 to $10) 
  • Office 365 E3 (from $20 to $23)  
  • Office 365 E5 (from $35 to $38)  
  • Microsoft 365 E3 (from $32 to $36) 

These increases were applied globally with local market adjustments for specific regions. Microsoft also announced some changes for month-to-month subscriptions coming in October (more details to follow), so it will be important to use this opportunity to optimize your licensing. 

How to Get the Most Value Out of Your Microsoft License

At Dewpoint, we ensure you get the most out of all these great applications and features. As your Microsoft Silver Partner, we are as committed as ever to helping our clients and the broader business community make the best technology decisions for their organization. That includes ensuring you get maximum value from your Microsoft subscription investment through our support. Below are specific areas where we can help:

  • Advanced Email Protection – comprehensive, multi-layered protection against malware
  • Backup for Microsoft Office 365 – protect your users against data loss through regular backups across the entire 365 tenant
  • Email Archiving – tamper-proof archiving with unlimited storage
  • Email Encryption – protect sensitive email communications automatically
  • Microsoft Teams – review and provide training to your staff on Teams to make sure you are using all of its capabilities
  • Power BI – transforming your data into easily readable reports and dashboards for quick analysis

One Size Does Not Fit All

We can help you identify the best license for you based on specific employee requirements. Typically, employees fall into one of four categories:

  • Frontline employees: Workers who are not usually assigned a traditional desktop computer
  • Basic corporate employees: Workers who are tied mainly to one location and have essential productivity and collaboration needs
  • Advanced corporate employees: Those working in multiple locations or who need access to more-advanced Office suite functions, collaboration services, email archiving, or legal hold
  • Specialized corporate employees: Similar to advanced corporate employees, but need more-specialized services such as business intelligence, archiving, or e-discovery

Contact us if you need help determining whether lower-level suites or a la carte options could reduce your costs and fulfill your requirements more effectively without compromising productivity.

Are you Attending the Grand Rapids IT Symposium?

Symposium Focused on IT Professionals

The IT Symposium on May 26th, hosted by the Information Technology Management Association (ITMA), is the premier single-day event designed exclusively for the IT executive community. The symposium incorporates topics that you want to hear about. Some of this year’s agenda topics include “Leading Cyber Aligned IT Risk Reduction,” “It’s Ransomware, a CIO’s Nightmare,” “Diversifying the Source of the IT pipeline,” and “Conquering the Great Resignation.”

Dewpoint – the Wi-Fi Sponsor

We are proud to be the Wi-Fi sponsor for the 2nd year. Be sure to stop by the Dewpoint booth to learn how we can help you on your IT journey and a chance to win a great prize. If you are interested in attending the Grands Rapids Symposium, register today. Click here to learn more about how ITMA brings local IT leaders together to share ideas and knowledge. Of course, you don’t have to wait until the symposium to discuss your IT needs with Dewpoint; reach out to us today.

Will Your Business Survive a Ransomware Attack?

Most Small and Midsize Businesses Won’t Survive an Attack

Ransomware attacks are on the rise. Over 46% of the world’s total attacks are targeted against the US. Unfortunately, new research from CyberCatch, a cybersecurity platform provider, shows that 75% of small- and midsize businesses would be forced to close if a bad actor demanded a ransom. It is not a question of “if” an attack will occur for most companies but “when.” You can take steps to mitigate your risk and prepare for an attack.  

To Pay or Not Pay

Even if your business decides to pay the ransomware demand, it does not guarantee that you will recover your data in a usable format. Remember, you are dealing with criminals; thus, there is no code of ethics. Per the available research, 58% of extortionists attempted a second ransom after receiving payment, and 42% did not decrypt the files after payment, so the data was still unusable. Furthermore, if you pay in Bitcoin, the transactions are public and traceable. If used for any illegal transactions, they could be traced back to your business.

Even if you pay and recover your data, it takes an average of 16.2 days to remediate an incident. Think about having your business interrupted for more than two weeks. Not to mention the damage that is done to your reputation and inability to service your customers. The devastation done to one Illinois College is causing them to shut down indefinitely. In Michigan, Kalamazoo Community College was forced to close its campus after an attack. These are just two recent examples of attacks.

What Happens if Attacked

If your business becomes a ransomware target, these steps can help your business survive.

Assess the attack –

Take a picture of the infected device’s screen before unplugging it. Pay attention to the payment deadlines or the number of days. Many times, the longer it takes to pay the ransom, the more the ransom demand. Check all of your systems to see if your network is compromised or if the attack is localized.

Immediately call your experts –

This could be your internal IT team or a trusted IT vendor to supplement your team. In addition, if you have cyber insurance, contact them, and you may want to involve local law enforcement.

Determine the data you can recover –

once you have identified what is infected, check on your backup systems to assess what data is recoverable. If you determine you need to pay the ransom to recover your data, have a clear communication plan on when and what you will pay.

Reset your systems –

immediately reset all passwords. Ensure you have the latest software versions and run any patches to strengthen your security. Watch for backdoors that bad actors could further exploit.   

Do you have a Ransomware Plan?

We can help. Dewpoint has the security and infrastructure experts and experience to mitigate your ransomware risks and create a recovery plan in case you’re attacked. By taking simple cybersecurity steps, you can reduce the probability of an attack and its impact. Like in sports, we believe the best defense against an attack is a great offense. Contact one of our cybersecurity experts today.   

Is Your Organization Prepared for World Password Day?

Cybercriminals continue to exploit password weaknesses

The ninth annual World Password Day is May 5th. Intel initially created this event to raise awareness about the importance of strong passwords. Even after reminders and the organization’s updated security policies, per a Google/Harris survey, 52% of users reuse the same password for multiple (but not all) accounts; 35% of users reuse the same password for all of their accounts, and only 13% use a different password for all accounts. In addition, over 82% of employees admit to recycling passwords.

In 2020, the top type of information stolen worldwide was credentials. – over 60% of data breaches involved cracking or using stolen or recycled credentials. Although your organization may have strict password policies, that doesn’t mean your end-users aren’t reusing passwords for their Facebook, personal email, or Amazon accounts. 

Emphasizing and enforcing good password policies

Require confidentiality –

ensure your employees understand the need for password confidentiality. Remind them regularly that sharing or having “post-it” notes with passwords is not allowed.

Use block-listing –

automatically prohibit specific passwords or password strings like the famous “123password”. 

Set a minimum length –

typically, a minimum of eight characters and symbols is required, but your organization may want to use a longer length.

Set a password history –

don’t allow the reuse of previous passwords (going back at least four to six prior passwords) to discourage people from cycling through changes to revert to a familiar password. Monitor password changes and investigate employees who make changes within a short period. They may be changing to “outsmart” the password history requirement.

Don’t use password hints –

although helpful in reminding your employees of their password, the ‘hint’ is often something familiar that a hacker can easily find out from social media.

Implement Multi-factor authentication (MFA) –

according to Microsoft, MFA can stop  99.9% of threats to passwords. It can be implemented in various ways, from phone calls, text messages, or codes. MFA is a simple yet effective roadblock to accessing an account and strengthening overall data security. 

Reinforce password standards –

training and reminding your staff about password guidelines should be part of your overall cybersecurity plan. Include password training as part of your security awareness training. Sending a “password reminder” is as easy as sending out this article to your team and recognizing national password day.

Password policies are just one step

Reinforcing good password policies is a simple way to increase your organization’s cybersecurity posture. However, it is crucial to evaluate your organization’s overall IT security to keep it safe. Contact Dewpoint today to set up an evaluation and take the additional steps to increase your IT security and reduce threats.

Looking for a Solution to Quickly Analyze Your Data?

Where’s my Data?

If you are like most organizations, the amount of data to sift through from spreadsheets, databases, the web, and SharePoint files is overwhelming. Power BI turns chaotic data into an easy-to-read, immersive, interactive experience that leads to insights, making it an ideal business intelligence solution.

What is Power BI?

Microsoft Power BI is a collection of SaaS products, applications, and connectors that work together. When implemented, Power BI collects data from various sources, whether you use cloud sources, different file types, or on-premise data warehouses to store your data. Power BI is broadly applicable for many kinds of analyses through a user-friendly interface.

Power BI consists of several elements that all work together, starting with these three basics:

  • A free Windows desktop application – Power BI Desktop
  • An online SaaS – Power BI service
  • Power BI mobile apps for Windows, iOS, and Android devices

Why do I need Power BI?

Your organization runs on data. It’s easy to collect, but the problem is analyzing quickly and efficiently. That’s where Power BI comes in. The platform has over 160 built-in connectors (see figure below) available to help you securely compile data from various sources into reports and dashboards. Power BI is extensible, enabling the creation of custom connectors. Use it to transform your data and help your organization:

  • Improve the decision-making process by accessing data in real-time
  • Boost productivity by giving your employees a centralized location to view data
  • Enhance your customer’s experience by understanding their changing needs and predicting the best way to meet those needs

What are the steps to Develop a Power BI Dashboard?

The development process is relatively simple:

  • Install Power BI desktop
  • Get data sources (identify and access all of the data sources required to create your final report or dashboard)
  • Model and transform data using the Power Query transformation tools and the DAX language to add calculations and value to that model
  • Creatively and effectively tell a data story with the many built-in visualizations (hundreds of customized visualizations are available, and most are free)
  • Publish your report to the Power BI service (or you can save your report to an internal Power BI report server)
  • Create a dashboard by collecting visual tiles from one or more reports
  • Share reports and dashboards internally or externally

How Can I Use Power BI?

Below are some real-world examples and case studies.

COVID 19 Summary

To track and report COVID cases, our client needed a dashboard that could be “sliced and diced” by individual regions, the state, and nationally. The project involved pulling data from various public sources, including COVID case data, populations, maps (by areas within the state and nationally), charts and tables. We developed a dashboard that provided a quick snapshot of “hot regions” and trends using Power BI. In addition, we set up a data gateway with scheduled, regular refreshes from external sites. 

Interactive Dashboard

The client previously had a SharePoint site with various folders containing reports for several divisions from different data sources (billing, project tracking, hour tracking) regarding projects and their hours worked in multiple phases, categories and types. The Dewpoint Team pulled all the data sources into Power BI, creating an interactive dashboard that went beyond the prior simple static PDF reports. Now the client can view Key Performance Indicators (KPIs) of the percentage of green projects, trends by month, the percentage in different category types, and a split between division direct or enterprise work. In addition, we developed detailed tables to show all the individual line details with the ability for each person to filter their details. Finally, we implemented row-level security, so that client leadership can see all divisions in one report (or filter as desired); however, each division can only view their data.

Need Help?

Power BI offers solutions fit for any industry. All businesses collect data, and Power BI helps you utilize your data for decision-making. With over 25 years of providing technology solutions to solve business problems, Dewpoint can help you get the most out of Power BI. We understand different businesses will need different levels of the tool; thus, we always start with taking a quick evaluation of your business to provide a solution that fits you. Contact us today to help produce insights that drive business decisions.

Are You Overspending on Cloud?

MSE Public Cloud Spending Pitfalls

When most midsize enterprises listed their considerations for moving to a public cloud, cost-saving was a significant factor. Unfortunately, many MSEs do not realize the full savings benefits. Per Gartner’s research, “organizations without a plan for cloud cost management may be overspending by 70% or more”. Developing and updating a cost management plan can save your organization money while still benefiting from moving to the cloud.

Effective Governance

It starts with effective governance. Do you know the total amount you are spending on the cloud, or is it divided between different departments? Many MSEs do not understand their “total” spending. Cloud spending may even be recorded in cost centers unrelated to IT. These dispersed and often underutilized environments can rack up excessive monthly charges without governance. Implementing governance puts all of the data in one place, providing an overall view. 

Five Warning Signs that Your MSE has a Public Cloud Spending Problem

Below are common warning signs that may indicate your MSE is spending too much on the cloud.

Multiple Public Cloud Accounts

No one is accountable for the number of public cloud accounts you have open. The average enterprise is now maintaining multiple accounts at multiple cloud providers. Make sure your company has an inventory of these accounts and owners.

Lack of review or explanation of monthly cloud bills

The average monthly invoice from AWS, Azure, or Google cloud can run into thousands of lines and include different service names, instance types, and regions that are not self-explanatory. Although reviewing the bills can be tedious, it becomes a monthly comparison looking for unexpected entries once you have a baseline.

Spend on non-approved initiatives

Accounts may aggregate usage from different teams, projects, and budgets. Make sure your teams use the tagging mechanisms provided by the public cloud providers to track spending. If tagging is not in place and you identify regular expenditures that no one can explain, your tracking processes are insufficient.

Purchasing everything “on-demand”

This may not be the cheapest model if you purchase all of your compute capacity at on-demand prices. Although “pay as you go” capacity is the simplest to buy, it is also the easiest way to overspend. Implementing a blended purchasing model can save you money. 

Not reviewing consumption efficiency

Per studies, the average utilization level of a running virtual server instance in the public cloud is typically 55% to 65%. If you don’t know your resource utilization levels, you can’t spot where you are overprovisioned.

Dewpoint is here to help if you need assistance in reducing your cloud costs or rethinking your cloud strategy. Contact one of our pros today who understands the midsize enterprise market. 

Why the Human Factor is Still the Most Important Part of IT Security

The human factor weakness

Regardless of the number of tools, software, and processes you implement, cybersecurity has one major weakness  – the human factor. Per Gartner, recent industry research shows that “22% of all breaches involved phishing, attackers leveraging stolen credentials accounted for 37% of all breaches, human error accounted for 22% of all breaches, and 30% of all breaches involved insiders”. Continuous monitoring and improvement are the keys to ensuring your human factor is no longer the most significant challenge for an effective threat prevention strategy.  

Tips to reduce the human factor

 Below are some tips to change your weakest link into your most robust in the cybersecurity fight.   

Keep IT simple

The more complex you make IT security for your end-user, the more they will find workarounds. By now, most organizations have implemented a password protocol requiring 10+ characters with a combination of letters, symbols, and numbers. The longer and more complex the password, the more likely the employee writes it down or reuses a password from another system. Think about how you can make it easier. Deploying multi-factor authentication (MFA) or two-factor authentication (2FA) may enable your organization to simplify the password requirements and add a layer of security.  

Trust no-one

We are ‘like’ family – many organizations get caught up in the employee ‘loves’ us and would never do anything to harm the company. Due to financial stress, a change in politics, or unforeseen circumstances, even the ‘best’ employee can be tempted to divulge company secrets or allow a ‘hacker’ to gain access. You can reduce exposure by implementing a zero-trust policy, where you trust no one and limit all users to minimal access – only enough to perform their jobs. Another option is to employ a privileged access management (PAM) tool to restrict access to sensitive accounts. Finally, make sure your organization has auto-monitoring to alert you if your system is attacked from the inside. The sooner you find out about the attack, the more you can control the damage.

It’s All About Education

Security awareness training should be more than a yearly task that employees need to complete. It should be ingrained into their everyday routines. Think about increasing or changing the training. Although computerized classes have become the norm, your employees may just be “clicking through” to get to the end. A few in-person sessions with small groups to talk about the latest threats and reinforce how important they are as the frontline defense will make more of an impact. In addition, include testing as part of your overall IT security awareness education. Periodically send out “fake” emails to judge if employees apply what they learn. Finally, ensure your employees know who to contact in case of a ransomware attack, know the protocols to follow, and aren’t afraid of reporting an incident. Don’t assume they know what to do.

How to improve your Human Factor

Making your organization cybersecurity ‘human proof’ starts with understanding where you are today. Dewpoint can help by evaluating your current organization and making recommendations to improve your overall security posture. As a technology company, we understand the software and tools that may help take the “human factor” out of the equation. Furthermore, we are partners with cybersecurity leaders in training and also provide individual training sessions. Contact us today.

Five Steps to Lowering Your Cyber Insurance Premium

Increasing Attacks and Higher Premiums

Protecting your company’s assets in case of a cyber security breach is critical. Most organizations choose to buy cyber insurance to cover the cost of paying ransomware and recovering from an attack. With the continued threat of cyber-attacks, insurance premiums continue to rise, and coverage is decreasing. Per Gartner, “Less than one in five organizations spent the past 12 months without experiencing any phishing attack”.

Emerging Threats

Attackers are becoming more sophisticated, and new trends have emerged, such as:

  • Optimize ransomware delivery by using “known good” cloud applications, such as enterprise productivity software as a service (SaaS) suites, and using encryption to hide their activities.
  • Combine ransomware with other techniques, such as distributed denial of service (DDoS) attacks, to force public-facing services offline until organizations pay a ransom.
  • Target individual employees, particularly those working remotely using potentially vulnerable remote access services like Remote Desktop Protocol (RDP)
  • Use multichannel phishing approaches that combine social engineering, voice, text message, email, and web attacks in a single campaign.

With the evolution of cyber threats, insurance is becoming a vital part of protecting your company’s assets.

Controlling Your Insurance Costs

Insurers review specific standards to determine your cybersecurity risk. The better your company scores, the lower your insurance premium. Below are five typical areas the insurer examines and steps your company can take to improve your score.

Enhanced Employee Training

Although most organizations require regular phishing training- training alone is not adequate. In this area, “one size does not fit all.” Instead, it is best to use a mix of small-scale, targeted phishing tests based on employees’ roles, ages, and work-from-home practices. In addition, you must train users to use good judgment, particularly in the difficult task of detecting imposters who request work-related activity. 

Upgraded Multi-Factor Authentication (MFA)

Employees continue to reuse passwords, thus allowing account takeovers. A Harris Poll found that 78% of Gen Z users have the same password across multiple accounts. Hackers use “credential stuffing” (testing existing credentials gathered from public breaches) to access your systems. If MFA is not deployed in your organization, deploy immediately. Don’t allow MFA to be skipped based on a single signal if you have MFA. To further reduce risk and improve your cybersecurity insurance rating, implement a two-factor MFA (2FA) to provide an extra level of security.

Following Backup Processes and Procedures

Ransomware often corrupts the production environment and backups. Appropriate controls are needed to ensure backups remain viable after a ransomware or malware attack. Employing strict processes and procedures can help you quickly restore data from a cyberattack or natural disaster. Backups should be performed regularly, stored offsite, and tested to ensure validity. Although a company typically focuses on the network, they should consider if there are critical items stored on an executive’s phone that should be part of a backup procedure. Showing you are following written processes and procedures and updating when the environment changes will put insurers at ease.

Moving to End Point Detection and Response (EDR)

Although your company may have End Point Protection (EPP) as threats continue to become more sophisticated, is it important to also deploy EDR. EPP targets threats as they hit the perimeter of your network, while EDR aims to target advanced threats that have gotten inside your environment and prevent them from spreading. Since it is nearly impossible for an EPP to catch all threats and prevent them from penetrating your system, an effective endpoint security plan should include both EDR and EPP. 

Reducing Cloud Risk

Although the cloud has been around for more than twenty years, cloud security remains challenging. The most significant risk is from a company’s misconfiguration of cloud services, in large part, due to their extreme complexity. AWS, for example, has over 170 services and more than 7,000 identity principles. Managing all this is a daunting task. Adequate cloud security requires the use of automated tools. Your security team should prioritize investigating and acquiring appropriate tools. A few elements in reducing your cloud risk include:

  • Ensure that you maintain accountability for all the areas you control in all areas of the cloud, but particularly identity, data, and configuration.
  • Invest in tools to validate the security of your entire cloud estate. Don’t neglect SaaS applications that are increasingly supporting critical business processes.
  • Build contingency plans in case a critical cloud service becomes unavailable.
  • Federate cloud identity for all services with your primary identity provider and use robust identity validation techniques (such as MFA) for all users.
  • Be wary of trying to offset cloud consolidation risks by using multi-cloud strategies rather than creating resilience in a single cloud. Such efforts introduce complex and hard-to-determine dependency chains that are more likely to decrease availability than increase it.

What do I do now?

If you need help reducing your insurance costs or increasing your insurance protection, we can assist by evaluating your current security controls and recommending and implementing improvements. Learn more ways Dewpoint can help you ensure your company is Cyber Insurance Ready.