LAST UPDATED Jan 19, 2022
Our customers often ask us for help addressing the requirements of insurers. It’s clear that securing APIs and web apps is increasingly top of mind for insurers; our customers tell us that these are the 10 most common controls insurers are looking at:
- Managed vulnerabilities
- Patched systems and applications
- Protected privileged accounts
- Prepared and tested incident response
- Protected network
- MFA controlled access
- Hardened device configuration
- Secured endpoints
- Phishing-aware workforce
- Logged and monitored network
Of those, ThreatX is helping our customers address five:
- Managed vulnerabilities
- Patched systems and applications
- Protected network
- Secured endpoints
- Logged and monitored network
Managed vulnerabilities and patched systems and applications
ThreatX’s 24/7 Managed SOC continuously monitors for new and existing vulnerabilities that can affect customer applications. When new, relevant CVEs are published, ThreatX notifies customers and provides short- and long-term patching recommendations, including patching of applications and web services. ThreatX also provides virtual patching of zero-day vulnerabilities — as was the case when the Log4j2 vulnerability was publicized — to ensure assets stay protected until a permanent patch can be delivered.
Protected network
Most organizations that have been breached use web application firewalls (WAFs) to protect their networks. Legacy WAF technology is often outdated, underutilized, not properly configured, and extremely difficult to scale.
ThreatX takes a true platform approach to Layer 7 by providing WAF, API, Layer 7 DDoS, and Bot protection via a single risk engine. This approach provides an integrated view for full visibility into each threat entity, regardless of the attacker’s combination of techniques or time scale. ThreatX automatically correlates this data and applies automated prevention to the customer’s environment, resulting in full-spectrum protection, unrivaled blocking efficacy, fewer false positives, and little to no tuning.
Secured endpoints
Cyber insurers place heavy emphasis on having advanced anti-malware solutions on servers, mobile devices, and individual workstations to identify malicious programs and contain their spread. Indeed, solutions that enable organizations to identify attacks on their endpoints and mitigate data leakage are critical to a sound risk management program.
Today, more and more insurers are beginning to address API endpoints, which are running rampant in today’s enterprise due to the proliferation and speed at which new applications and microservices are being developed.
Thus, it is critical for organizations to catalog, monitor, detect, and respond to attacks on these assets just as they would on workstations, servers, and mobile devices. ThreatX’s API Attack Protection capability analyzes and profiles legitimate, suspicious, and malicious API use to discover and enumerate the API endpoints deployed in the service of ThreatX-protected applications.
Logged and monitored network
Logging and monitoring network activities empower organizations to understand whether something nefarious may be happening and to ensure an attacker’s actions are identified and blocked early in the kill chain. Doing this at scale and in a timely manner requires visibility, automation, and operator expertise, which many vendors and cybersecurity teams lack – simply due to labor shortages. When organizations partner with ThreatX, not only are they leveraging a best-of-breed technology, but they also receive the benefit of adding world-class application security expertise to their organization via ThreatX’s managed service. This lets organizations offload work to ThreatX’s highly skilled security experts for around-the-clock proactive monitoring as well as streamlined threat response support.
Conclusion
Ultimately, it’s important to note that “compliance is not security.” Just because your organization receives a favorable cyber insurance policy does not mean your company is secure. That said, companies that partner with ThreatX put themselves in a favorable position to strongly address some of the key controls insurers consider when rendering a policy. Get more details in our cyber insurance datasheet.
