Since before the pandemic, there was talk about the importance of both companies and individuals having antivirus protection installed on their servers, to defend devices against hackers - particularly businesses, which are a growing target for cybercrime due to the volume of sensitive data and money they handle.
One major impact of the pandemic has been the acceleration of technology adoption and digitisation within businesses, which in turn has increased the risk of cyber attacks. For individuals, this could mean identity theft, forgery of electronic signatures, or card cloning. For businesses, it could be data theft, ransoming of classified or business-critical information, and the corresponding business interruption that this would create.
According to the International Telecommunications Union, Mexico and Brazil compete to be the country in Latin America facing the most cyber attacks.
In situations that are beyond the ability of companies to avoid, such as a global pandemic or a war, Marsh has put together a listof recommendations to help mitigate the risk of cyber threats for companies.
1. IT teams should revisit basic controls such as:
Enabling two-factor authentication (MFA) mechanisms for remote access to the organization, as well as to the organization's systems exposed to the Internet.
Implementing anti-malware solutions, and assessing whether they are properly deployed and working properly.
Making a backup of the most business-critical information. In addition, it is recommended that these backups are isolated from the network, encrypted and tested.
Applying security updates to systems, with the aim of reducing existing vulnerabilities.
Training staff on latent threats such as phishing, and conducting controlled phishing exercises.
Defining a response plan for cyber incidents, as well as operating procedures or playbooks indicating how to react to one of the main cybersecurity incidents that may affect the company.
2. Carry out desk exercises and/or attack simulations with key stakeholders.
3. Review any potential cybersecurity risks associated with the company's critical third parties.
4. Establish a 'chain of command' to keep people within the company prepared before, during and after a cyberattack.
5. It is important not to take sides about the nature of the attack or those responsible, unless necessary.
6. Validate any existing temporary limitations or restrictions in insurance coverage for these claims. In addition to keeping records of any damage incurred as a result of the attack, consider consulting with legal counsel if necessary.
