On Tuesday, November 10, we hosted the webinar "Get your security house in order before the new year." The replay is available on demand.

Cyber insurance applications now ask detailed questions about your security controls. The answers draw on the same risk assessment results and training records the HHS Office for Civil Rights (OCR) asks for after a breach.

Paul Murphy (Chief Growth Officer, Black Talon Security) covered risk assessments, training, and AI. Jody Loyd (Senior Insurance Agent, Cornerstone Licensing) covered cyber insurance. Dawn Halpin hosted for Paubox and walked through Paubox Security Awareness Training.

What we heard

  • Treat a risk assessment as a starting point. Take the top five or 10 findings, give each one an owner and a deadline, and keep the plan where anyone can follow it after staff turnover.
  • Multi-factor authentication (MFA) costs little or nothing. No one, including your IT provider, should have unrestricted remote access to your network.
  • Security tools only send alerts, so someone has to answer them. "An alert coming from a tool is the tool asking for help," Paul said, and that includes 2 a.m. on a Sunday.
  • Training has to leave records. After a reportable breach, OCR will ask who completed training, when, and how they scored. Ongoing phishing simulations build the habit, with an instant correction after every click and more practice for the people who keep clicking.
  • AI speeds up attacks attackers already ran. Phishing emails no longer carry typos, and Paul said attackers now go from finding a firewall vulnerability to exploiting it in one to two days, down from about 90.
  • Check that your cyber policy covers both first-party losses, like downtime and data restoration, and third-party liability, including vendors you depend on, like a cloud-based electronic health record (EHR) system.
  • Answer the insurance application as things stand today. If a control is only planned, mark it "no" and note the date it goes live, because a mismatch can limit your coverage after a claim.
  • Call your carrier or agent as soon as you suspect an incident. Jody said late notice is where she sees claims go wrong most often.

Read more: What HIPAA actually requires for security awareness training