Network segmentation
Dividing a network into separate zones whose exchanges are filtered, which prevents an intrusion from reaching the whole system and thereby bounds the severity of a cyber loss.
Segmentation means dividing an organization's network into distinct zones, office IT, industrial production, payments, administration, backups, vendor access, and allowing only strictly necessary flows between them. Its finest form, microsegmentation, applies the same principle between applications or machines. The goal is not to prevent intrusion, which other measures address, but to contain it: an attacker who entered through a workstation must not be able to reach critical servers, controllers or backups. For insurance, segmentation is one of the measures acting most directly on severity, because the cost of ransomware depends on the number of systems hit and the time to restore. It also governs the separation between business IT and industrial systems, on which the shift from a cyber loss to physical damage or a production stoppage depends. The underwriter checks it through the application, and the forensic investigation often reveals its absence afterward, when a vendor with limited access served as the entry point to the entire system.
In the Target data breach in late 2013, the attackers entered with stolen credentials from a heating and air conditioning contractor, then reached the stores' payment terminals, because the network open to the contractor was not effectively separated from the checkout network: about 40 million cards were compromised.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.