Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

In Cybersecurity– A Good Offense is the Best Defense

Client Alert
November 16, 2021

2021 has been a watershed moment for cybersecurity incidents, as cybercrime has become a frequent headline, and cyber criminals have thrived on unsuspecting and/or unprepared businesses and institutions. For example, the Solar Winds attack exposed sensitive data from top companies like Microsoft as well government agencies[1], and the Colonial Pipeline attack substantially disrupted the petroleum supply chain[2]. We have seen an almost 20% increase in data breaches and attacks since last year.

Changing Laws and Expectations:

In response to these threats, President Biden issued an executive order in May 2021 to overhaul the federal regulations governing cybersecurity policies that are applicable to government agencies and federal contractors. This is only a first step; it is likely that states will implement similar policies.

In the private sector, larger companies such as financial firms and healthcare organizations have already implemented mechanisms to protect sensitive business, customer, and patient data, given compliance regulations and requirements. While large companies may be ahead of the curve, many are still unprepared given the sophisticated and ever-changing cyber security landscape.

For small and medium sized businesses (SMBs), the challenges are even greater. The U.S. National Cyber Security Alliance found that 60% of small businesses went out of business within six months of a data breach or cyber security attack. Moreover, many SMBs contract with the government and/or larger corporations, which are increasingly shifting the risks of data breaches and cyber security attacks onto smaller entities through indemnity provisions in their contracts. Therefore, SMBs often face significant first-party and third-party risks.

SMBs often believe they are not targets because of their size. A 2019 Cyberthreat Study found that 60% of senior SMB decision makers believed that they were unlikely to be attacked[3]. On the contrary, SMBs are easy marks for cybercriminals because their systems are data-rich and vulnerable. While 62% of cyberattacks hit SMBs in 2020, only 43% had any type of cybersecurity defense plans. It’s likely that these numbers only grew worse in the last few years given the number of employees working remotely.

Protect yourself and remain compliant:

So, the question is what can SMBs do to protect themselves? To begin with, SMBs should implement proactive solutions to prevent attacks and safeguard data such as:

  • initiating employee cybersecurity training;
  • preparing or updating policies and procedures governing information security practices;
  • instituting managed and monitored patching; and
  • implementing multi-factor authentication (MFA).

These are basic steps that can help minimize these risks. Additionally, SMBs should consider sitting down with legal counsel and their insurance broker to evaluate first-party and any third-party risks in the event of a data breach or cyberattack.

Get covered:

One of the most effective ways to mitigate your risk to a cyberattack is to obtain cyber insurance coverage. Cyber insurance is not one-size fits all. Cyber coverage needs to be tailored to your business and to the risks in your business. Otherwise, a cyber policy may provide little to no coverage for first-party or third-party harm in the event of a breach.

For SMBs with existing cyber coverage, you should expect to see premium increases of between 60-100% of your current premiums given the rising incidents. For SMBs that have no implemented MFA, monitored patching, or compliance and training programs, your premiums could go up even higher. Many underwriters may reduce coverage or even cancel existing coverages if technical and compliance policies, like those noted above, have not been implemented.

For SMBs without cyber coverage, you should consider discussing coverage with your broker before your upcoming renewal. Insurance companies are implementing stringent underwriting requirements for cyber coverage, which will require the implementation of technical and compliance policies.

As we move into 2022, SMBs should examine their existing systems, policies, and insurance coverages to ensure that they are protected if and when a cyberattack or data breach occurs.

If you have any questions about whether your cybersecurity risks, and whether your business is protected, please contact BMD’s Cybersecurity Practice Leaders, Kyle Johnson at kajohnson@bmdllc.com or Brandon Pauley at btpauley@bmdllc.com.

[1] https://www.businessinsider.com/solarwinds-hack-explained-government-agencies-cyber-security-2020-12

[2] https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-using-compromised-password

[3] https://www.keepersecurity.com/assets/pdf/2019-CybersecuritySMB-Infographic-branded.pdf

CybersecurityKyle A. Johnson
Client Alert

Your Workplace Under Biden

November 9, 2020This is my favorite recurring post – Predictions of How a New Administration Will Affect Your Workplace. Four years ago, we accurately called the emasculation of the 2016 proposed FLSA Overtime Rules (the salary exemption threshold was set at $35,568 in 2019, rather than $47,476 as proposed), we forecasted a conservative shift of the NLRB and its results (a roll-back of employee rights, social media policy evaluations, and joint employer rules), and we nailed the likelihood of multiple conservative appointments to the United States Supreme Court and its long-term effects (although I completely failed to predict that my ND classmate Amy Coney Barrett would fill the final vacancy during the Trump administration). This time, the L+E Practice of BMD has decided to make it a group effort at predicting what will happen, what probably happen, and what might happen under President Biden. As always, please save this in your important files and pull it out four (or eight) years from now to judge our accuracy.Client Alert

HHS Provider Relief Funds Reporting Requirements: Important Updates Every Provider Should Know

November 4, 2020HHS continues to revise its reporting requirements for the use of the Provider Relief Funds. Providers with more than $10,000 in Provider Relief Fund payments must report on the use of the funds through December 31, 2020. The reporting window will begin on January 15, 2021 and providers must complete reporting obligations for FY 2020 by February 15, 2021 through a portal designed by HHS. However, providers that have unexpended funds as of December 31, 2020, will have an additional 6 months to use the remaining funds through June 30, 2021. These providers must submit a second and final report no later than July 31, 2021.Client Alert

Should I Apply for Phase 3 Funds? Important Considerations Every Provider Should Know

November 2, 2020On October 1, 2020, the Department of Health and Human Services (“HHS”) announced an additional $20 billion in new funding for providers through a Phase 3 distribution. Importantly, providers that previously received HHS Provider Relief Funds or already received payments of approximately 2% of annual revenue from patient care are eligible to apply. Eligible providers have until November 6, 2020 to apply for these Phase 3 Funds. However, the question from providers continues to be: Should I Apply for Phase 3 Funds?Client Alert

CISA Ransomware Practices

October 29, 2020On October 28, 2020, the United States Cybersecurity and Infrastructure Security Agency (CISA) issued an alert warning of imminent threats to US hospitals and healthcare providers. The specific threat involves RYUK Ransomware attacks. RYUK is a novel ransomware that goes undetected by commercial anti-virus/malware detection programs. Once deployed, RYUK encrypts all data and disables systems. In short, it cripples all functionality down to phone systems and automated doors. Healthcare providers should alert their employees to remain hyper-vigilant and report any suspicious activity seen in email or on networks. It has been reported healthcare providers in New York, Pennsylvania and Oregon have been targeted in the last 48 hours. If your organization encounters issues, BMD can assist in mobilizing a response team and has contacts with forensic IT firms that are familiar with RYUK. It is advisable to engage professionals with experience dealing with this specific threat.Client Alert

HHS Announces an Additional $20 Billion In Provider Relief Grants

October 5, 2020The U.S. Department of Health and Human Services (“HHS”) announced an additional $20 billion in new funding for providers on October 1, 2020. Eligible providers include those that have already received Provider Relief Fund payments as well as previously ineligible providers, such as those who began practicing in 2020, and an expanded group of behavioral health providers confronting the emergence of increased mental health and substance use issues exacerbated by the pandemic. The new Phase 3 General Distribution is designed to balance an equitable payment of 2% of annual revenue from patient care for all applicants plus an add-on payment to account for revenue losses and expenses attributable to COVID-19.
Older posts
Newer posts