How Workspace ONE can mitigate Cyber Insurance Premium Requirements
Overview
In this post, find out how Omnissa Workspace ONE and Horizon can mitigate Cyber insurance premium requirements, as the blog aims to help customers understand & implement modern security solutions to meet Cyber Insurance validation audits & self-attestation, in order to help customers to understand & Implement Modern Security Solutions to meet Cyber Insurance Validation Audits & Self-Attestation.
Cyber Incident Coverage from an Insurance Landscape
Cyber Insurance (aka Cyber Liability Insurance (CLI)) provides a general line of coverage for mitigating losses, or the costs associated from cyber incidents, including data breaches, network and server infrastructure damage, as well as the potential business interruptions from things such as ‘Ransomware’. And, in order to determine what coverage is necessary, cyber liability insurers calculate those costs based on several key risk-factors, including what industry the insured customer resides within, the data being covered (Regulated e.g. PII / PCI / HIPAA / GDPR) etc... but most importantly, what security measures and controls are already in place prior to being insured?
Figure 1: NIST CIA Triad
These providers want to ensure that their clients are taking fundamental safety measures to protect their systems, users, and the data. For example, in order to satisfy the common basic requirements of the National Institute of Standards & Technology (NIST) Confidentiality, Integrity & Availability (CIA) triad (shown above), as it’s known in the industry, by which providers leverage solutions that can ensure those pillars are secured. One such tool is Multi-factor Authentication (MFA) for secure access and to better validate the integrity of the user’s identity and defend against account compromise and assurance of the partners making the data connection/exchange.
Also, another key element is Data-at-Rest (DaR) and in-Transit (DiT) encryption of the data, for example in Omnissa’s use of TLS 1.3 for https/web based communication, as well as using sound, accredited standards ex. NIST FIPS 140-2, Advanced Encryption Standard (AES) 256-bit in strength to harden against those attempts further protecting the confidentiality of the data being exchanged. Lastly, moving the cloud or having a sound ‘Disaster Recovery Plan’ and service in place, including backups to protect user availability to the data and services. Other US-based agencies, such as Cybersecurity Information Sharing Act (CISA) and numerous other global resources (ex. Nat'l Cyber Security Centre (NCSC) / EU Agency for Cybersecurity (ENISA) or Australian Cyber Security Centre (ACSC)) exist and provide sound guidance on the matter, but in reality, aside from small differences amongst them, most agree on these basic elements of the triad.
However, even with these basic CIA protection steps or the use of solicited services from the CLI providers, the increasing cost of ransomware remediations are pushing premiums up, as the increase in the number of attacks, as well as the number of ‘successful beachheads into organizations’, mean insurance is getting harder to get and more expensive to maintain. In some cases, providers have eliminated ransom reimbursement benefits altogether and many others have introduced strict underwriting guidelines, which can drag out application and renewal processes from what previously took days to weeks or even months. Considering this, both Managed Security Providers (MSPs) and their clients need to be addressing their cyber risk in order to efficiently check off boxes on the cyber insurance checklist to keep costs reasonable.
Figure 2: Verizon DBIR 2022 Report Findings – (4) key factors leading to breaches & the highest element increase
Thus, these factors have also helped push significant premium increases in cyber-insurance policies, both the EU and US have seen the rise of service offerings as a consequence. Many of those SPs of cyber protection services are the same insurance providers in order to gain not only revenue but to also attest to the security, controls and measures in place by those same insured customers and help mitigate those costs, both in premiums and also in the risks and amounts later that might be paid out in the case of a breach (much like buying an extended service & warranty package from the same auto dealership as the vehicle being warrantied and having their service dept take care of the vehicle’s maintenance along the way).
Typical Cyber Insurance Service Provider Offerings:
For other insurers, they get a measure of assurance that those looking to get or renew policies are taking basic or moderate precautions to defend themselves prior to the enforcement of a policy. But even if an organization doesn’t buy into the CLI offerings above, the real option of either requiring a documented self or a 3rd party audit of these enterprise measures as due diligence will increasingly be required of those being or wishing to be insured. So, as it stands to reason, in order to validate that a certain level of security controls, standards and cybersecurity measures have been taken by the insured prior to issuing a policy, these audits will be required and can go even further, as seen in the next example.
Recently in the news as reported in Dark Reading, Travelers Property Casualty Company of America took a customer to court after learning that the company, International Control Services, Inc. (ICS), provided false information on its insurance policy application. Specifically, ICS claimed to have implemented MFA, but when they filed a claim following a ransomware attack, a forensic investigation instigated by Travelers discovered that ICS had not done so; thus, the contract was voided. As argued earlier, with the growing cases of cyber-related damages throughout the industry, many insurers are likely to insist on third-party verification for applicants’ self-attestations, or at a minimum more granular reports and details of implementations of security measures and controls prior to the acceptance of the policy.
Some CLI agencies use a ‘Factor Rating System’ to index contributing factors in their evaluation of an organization’s cyber risk and, therefore, appropriate insurance coverage they are offered and the premium they’ll pay can provide guidance in a selection for how much coverage a policy will be required to match an org’s insurable security threats. Unlike traditional insurance methods, these factors are often required to be updated and monitored on a continuous basis to map exposure and impact levels for current deployment and implementation of areas.
Typical Cyber Insurance Provider Factor Rating Categories:
The intent is to capture a potential client’s security posture in these different environments, as each has a different effect on the client’s security risk score. But the cost of doing so often can be close to or equal the prices of some small contracts and has been hampering the cybersecurity industry growth projections for the last decade. CXOs of insured organizations should not expect a payout for poor cybersecurity policies or practices and this is in line with other insurance-related products that often require some form of inspection / audit before a policy is issued or may void a policy if, after an incident, undisclosed deficiencies are found.
There are basic guidelines that are typically looked for when establishing good corporate or organizational Cyber-hygiene that can assist in greatly reducing the scoring and factor along the lines of the CIA triad.
Typical Organizational Mitigation Measures for Reducing Factor Rating Scores:
Regardless of your industry, if you’re self-attesting, most analysts will advise an organization that in order to be best prepared for both the incident, as well as the prequel attestation or audit, be brutally honest and have detailed supporting documentation to support your agency’s conclusion. Although you could still be confronted by the insurance agency or challenged about the breadth or depth of coverage or costs, you will be in a much stronger position to gain ground in either case.
If doing so, control the instinct to deny the results completely and embrace the opportunity to learn from the report(s). Explain how these may be false positives and use the results to strengthen the relationship for the future audits within your organizations and the teams responsible. For example, when taking back the lessons learned to your respective Security Operations Center / Information & Technology and other support teams to enhance or make improvements where necessary; start with the easiest on the list and move up the ladder.
Also, taking guidance from well-established framework, control guidance, such as National Institute of Standards & Technology (NIST) and their Special Publications ex. SP 800-171 Controlled Unclassified Information security controls are a gold mine for tips and areas to focus, both before and after an audit. It is also very likely that for self-attestation or audit, a Cyber insurance group may leverage those very controls as a blueprint or ‘exam template’ for your grading?! Some providers can even deliver a deeper assessment of that cyber risk when connectors or Application Programming Interfaces (APIs) to other service providers or security solutions are integrated. These integrations offer additional risk rating evaluation and can provide the additional benefit of cost savings, much in the same way a typical auto insurance firm à la Geiko or Progressive can do by getting access to your vehicles On-Board Diagnostics (OBD) module to send driver stats back to them for constant evaluation of your driving habits and thus the risks you pose for payouts.
Security Control & Framework Alignment
Figure 3: NIST Guidance for Security Controls with Forrester’s ZT Model
Many firms also provide initial risk scoring and policy acceptance, terms, and rates based on a company’s ability to show detailed documentation on their adherence to certain industry best-practices. Two key areas for this are from the NIST) Special Publication groups, such as SP 800-171 <and> the Zero Trust Architecture guidance within 800-207. These controls can be used for securing all devices and services within an organization; however, this is only the first step. The larger, more important, aspect today is the identification of the new protection paradigm, the ‘Data’.
Other top resources for guidance on cybersecurity fundamentals for the global industry are the Center for Internet Security (CIS) Benchmarks, which are highly regarded and corroborate NIST’s framework guidance, providing more than 100 configuration guidelines across 25+ vendor product families to safeguard systems against today’s evolving cyber threats and can be implemented and managed through Omnissa tools, such as “Baselines”. Although not specifically aimed at customer’s compliance, the Open Web Application Security Project (OWASP) Top 10 is an outstanding list of areas your software and service providers need to ensure they are accounting for and executing towards during the development of their solution offerings, prior to a client’s use of them, in order to provide additional end-user protection.
Whether it is an organization’s own, or the customers they serve, ‘the Data’ is the single most important asset and ultimately ‘target’ of any breach. And whether that’s in the form of a ‘Ransomware’ attack, whereby that ‘data’ is denied access <or> it is the theft of said data, the damage and exposure is still the organizations to manage and protect. And whether an organization relies on NIST, or cloud-hosted services that attest to following the controls of SP 800-171 or it’s bigger brother, 800-53 FISMA (which FedRAMP for FedGov cloud security attestation is based on and Omnissa adheres to for its Public Sector customers); there are still requirements for the end-agency / organization.
So, it’s simply not a migrate or ‘subscribe and forget’. AWS & Azure both explicitly outline that there are several overlying areas of customer ‘responsibility’ for their specific enclave or domain of operation on top of their Infrastructure-as-a-Service cloud-hosting. So, moving to the cloud, although highly recommended and a part of the journey for enhanced security under both Cyber insurance qualification, as it is for Zero Trust, there are higher level areas of controls and security needed above and beyond simply the hosting controls; this is where Omnissa can assist!
Figure 4: Security Alignment to Security Control Groups
Omnissa Solution Mitigation Overview
Workspace ONE Suite
Workspace ONE can be a key foundation for meeting the needs of the necessary controls and security an organization needs to perform its own self-attestation or full-blown audit by a 3rd party. It is built on Omnissa's Workspace ONE UEM technology that provides for the standard aspects of Mobile Device Management (MDM) and Mobile App Management (MAM) including Unified Application Catalog. Workspace ONE integrates with virtual desktop application delivery and secure connectivity via Horizon on a common identity framework with Workspace ONE Assist to complete a full End-User-Computing (EUC) Suite that can leverage Baselines as a key feature of enrollment, onboarding, and compliance.
Additionally, on traditional endpoints and within the cloud, by integrating Workspace ONE, you can enhance EDR/IR/XDR capabilities to provide a comprehensive protection story. Combined with additional partnered solutions, such as NSX can provide an integration into Network Detection & Response (NDR) and employ real-time, continuous monitoring of systems to detect and investigate potential threats before using automation to contain and remove them and provide true XDR with NGFW / IPS & other advanced network-based security measures.
Figure 5: EUC Portfolio Logical View of Zero Trust Functional Support
Lastly, you can improve your cloud protection stance by leveraging CloudHealth to protect against threats to modern cloud-native applications and workloads that enterprises use is on the rise. Meanwhile, attacker groups are becoming more effective and dangerous, leaving many organizations stuck between a rock and a hard place when it comes to cybersecurity. CloudHealth can also help your organization or service providers secure against the MITRE ATT&CK Cloud Matrix, which is solely focused on cloud attack vectors.
Each of the components, brings together the foundation for a Zero Trust Architecture that can be partnered and integrated together within Omnissa Anywhere Workspace solution, building trust to empower organizations’ anywhere workforce with secure and frictionless experiences by:
- Delivering unique integrations enabling tailored experiences and higher productivity for frontline, hybrid, and remote users, across heterogeneous environments including physical and virtual devices and multiple OS’s.
- Enabling Zero Trust Network Access (ZTNA) with remote support for any device (BYO, 3rd party or Omnissa-managed) in a true hybrid workforce and provide a Security Operations Center (SOC) / Information & Technology support team the tools and telemetry for Indicator of Compromise (IoC) on mobile.
- Facilitating flexible deployment options to obtain immediate value for prioritized use cases, so you can scale at your own pace to harness the full potential of an integrate d platform.
- Optimizing security and experience through an integrated approach that combines market-leading technologies essential for hybrid work. This integrated approach provides connected visibility and context, ensuring broader security coverage, including Workspace ONE Mobile Threat Defense (MTD) to enhance the end-user / end-device compliance and endpoint security model alongside traditional endpoint security solutions, such as Omnissa ’s Carbon Black EPS, including GSA FedRAMP High Authorized solutions.
Zero Trust Deployment First Steps & Instances:
In order to satisfy the ZT requirements at the end-user level, strong requirements are needed, including:
- Modern Management — Devices are enrolled, configured and managed, while guaranteeing the health and security of the device while accessing Corp. / Agency resources, such as servers / cloud / data etc...
- Device Health — Applications and services have the mechanisms to validate MFA and device status prior to and during access to those org resources.
- Identity Management — provide for MFA and passwordless authentication, as well as Single Sign-On (SSO) to secure access to both devices, applications and communications with organizational resources on-prem or in the cloud.
- Anywhere Workspace — ability to access corporate / agency resources when not on a managed device.
- Least Privilege Access (LPA) — Access to resources is limited to the minimum required for a specific role.
- Data Loss Prevention (DLP) — Ability to ensure that data leakage or extraction is detected and stopped.
Figure 6: EUC & Omnissa ’s Endpoint Security Logical Alignment to ZT elements
As the industry progresses and matures, changes and standardization are likely to be outcomes. And since these threats such as extortion, deepfakes, and ransomware will continue, your organization will need up-to-date intelligence, best practices, and a modern security infrastructure to guard your valuable assets and to meet the likely ever-growing requirements of Cyber Liability Insurance under-writers, Omnissa will be here to assist!
Industry Accolades
For more in-depth details regarding Omnissa’s most recent industry accolades and reviews, see the following blogs & external links:
Additional Resources
- Tech Zone: Compliance for NIST SP 800-171 Controls & CMMC with EUC
- Tech Zone Security Portal
- Tech Zone: Zero Trust Portal
- Tech Zone: Public Sector Portal
Related Resources