How Coalition’s Incident Response Helps Reduce Risks During a Cyber Attack

By Leeann Nicolo with Coalition Inc.

Traditional cyber insurance protects businesses from the impact of a cyber breach after it occurs. However, what if cyber coverage could actually help reduce the risk of an attack before it happens? 

As cyber incidents increase across the globe — cyber claims severity rose 56% for small businesses last year — reducing the risk of an attack proactively is critical to reducing overall business risk. 

Enter: Coalition’s Incident Response (CIR)

Driven by a team of technical experts, incident responders, forensic specialists, and security engineers, Coalition provides security across the lifecycle of a business, elevating the ability to respond to bad actors, including a security support center to help prevent attacks before they happen — and respond more effectively if they do.

From ransomware to reputational impacts, CIR solved 46% of incidents reported to Coalition last year —  without additional costs or using up policyholder deductibles. Even more consequential, CIR helped many policyholders prevent cyber incidents last year, as Coalition’s insureds experience less than one-third the frequency of claims compared to the broader cyber insurance market (based on 2020 and 2021 National Association of Insurance Commissioners [NAIC] report data).

The incident timeline: investigate, remediate, communicate

When a cyber incident does occur, policyholders should be encouraged to report the incident to their insurance provider immediately. 

Reporting an incident gets the ball rolling and alerts all necessary vendors and experts to mobilize, with the goal of reducing the overall impact of the incident. Coalition’s Claims team responds immediately to help determine what services to activate, from forensics specialists to a breach coach, and/or a PR firm to manage crisis communications. 

The Coalition team will walk an insured through an investigation and remediation of the incident, while also working on all points of critical communication simultaneously. Here’s the Coalition Incident Response timeline as seen through an investigate-remediate-communicate lens: 

  1. Investigate what happened, to determine the tactics and techniques used by the threat actor during the incident. Building off of the insured’s Active Risk Assessment — a scan of how the insured’s network is seen on the dark web, so all vulnerabilities are visible — CIR collects and analyzes forensic artifacts and system logs to dive into what vulnerabilities may have enabled the incident and how the business can react to protect itself. This includes determining if the business has available backups and utilizing tools to have oversight and block the threat actors from gaining more access. Were any previous vulnerabilities noted and not patched? Were all the potential protections implemented in good time? While Coalition’s in-house team leads the investigation of the cyber incident, based on its complexity, third-party specialists could be also called in to supplement Coalition’s expertise. 
  1. Remediate for both the short- and long term. While remediation steps are informed by the investigation, this step happens alongside the investigation. The goal here is to act quickly in order to minimize the damage. CIR recommendations will be based on what is known and learned about the business, as well as on protection implementations recommended to them during earlier stages of the Active Insurance life cycle.  For example, if the business has viable backups in place for all of their critical data, CIR can guide the business through a process that avoids interacting with the bad actor and gets them back online more quickly. As a general rule of thumb, offline backups offer the greatest chance of survival during a cyber incident, because they’re unreachable to the threat actor. Online backups are often also seized or locked up by the threat actors along with your network. The CIR team guides insureds through the entire process of restoring from backup, from negotiation, to testing encrypted data, and finally (if necessary) paying the threat actors for a decryption key to regain control of the network. Remediation is also a time during which CIR will make network recommendations for the future. These may include: 
    • Multi-factor authentication (MFA), the electronic authentication of two or more pieces of evidence in order to be granted access to a website or application 
    • Endpoint detection response (EDR), software installed on all servers and endpoints, designed to stop ransomware and identify unusual behavior in an application
    • Network segmentation, a strategy that provides limited network access to employees, based on job qualifications, tasks or seniority. This helps businesses reduce network access. 
  1. Communicate the technical details. CIR will act as the business’s technical expert during the incident’s communication process. This includes communicating with the bad actors if necessary, but also providing the appropriate technical detail to include in internal and external communications about the incident.  For example, depending on the regulatory laws in effect in the states in which the business operates, CIR will provide guidance on what needs to be communicated to anyone with breached data. CIR can also work with the policyholder to provide an accurate understanding of how much the claim will cost based on the remediation necessary and forensic investigation that took place.

Very often during and after a cyber incident, it’s important to engage a special public relations firm that deals with cyber incidents and their crisis communications needs. Coalition’s cyber coverage includes this service, and such a team is engaged if necessary by the CIR team as well. 

Coalition Incident Response is active

Coalition’s Active Insurance goes beyond a cyber insurance standard, playing an integrated role in your business’ cybersecurity across its lifecycle. It’s like combining the safety features of a vehicle — reverse backup sensors or automatic braking — with the post-accident coverage. 

Coalition’s Active Insurance approach consists of Active Risk Assessment, which takes place before the policy is written, Active Protection during the policyholder period, and Active Response, a post-breach response. All three phases of this lifecycle provide a continuous feedback loop of the business’ current risk level and vulnerabilities.

To report a cyber incident, Coalition policyholders can reach CIR here.

To learn more about Active Insurance, download the Coalition Active Insurance eBook.

Reprinted from Coalition Inc. Visit coalitioninc.com/blog to view the rest of the content on Coalition’s blog.

4 Cybersecurity Awareness Tips

FDA Services (FDAS) has seen an alarming increase in cyberattacks on dental offices in the past few years. This year has especially had a sharp increase, which is why they’ve partnered with Coalition Insurance to bring our members cybersecurity and insurance. Even if you choose not to use Coalition Insurance as your cyber insurance provider, please make sure you have this coverage in place! They recommend, at the minimum, $250 per patient record in coverage. 

Below are four cybersecurity awareness tips from our friends at Coalition:


The FDAS experienced staff is ready to get to work for you — call or text 850.681.2996 or email insurance@fdaservices.com to connect to our agents today. 

4 Tips to Maximize Your Disability Benefits

By Scott Ruthstrom, FDA Services Chief Operating Officer

Dentists understand the importance of purchasing a quality disability income insurance policy, but are you ensuring you receive every dollar you’re eligible for? Not having enough disability income or saving a few bucks by passing on available options and riders can make a tremendous financial difference.  Should you fall victim to an accident or an extended illness, be sure you have your financial well-being fully protected.

1. Max out the total monthly amount you can financially qualify for.

Typically, disability insurance (DI) benefits are calculated as a percentage of your total gross income. One hundred percent of total gross income replacement is not available, so having the maximum benefit you are eligible for will help ensure that, in the event of a disability, you can maintain a lifestyle post-disability that is comparable to your pre-disability lifestyle. Even if you max out your benefits with one insurance company, you may be able to buy additional benefits through a second or even a third policy (depending on the amount of coverage in place already and your annual gross income).

2. Make sure your DI policy can grow with you.

Many carriers offer options/riders that allow you to increase your monthly benefit without having to retake medical exams or physicals; you only have to prove you qualify financially.

3. The fact is, one in three dentists will have a disability over the course of their career.

A dollar today is not what a dollar will be worth five, 10 or 20 years from now. A “cost-of-living adjustment” rider (COLA) is a great way to ensure your DI policy will be able to keep up with inflation. The COLA rider will adjust the monthly benefit each year while on a claim.

4. Since most disabilities are temporary in nature, purchasing a “residual disability” rider is vital.

This rider is designed to help offset the loss of income when returning to work following rehabilitation or recovery, as it could take months or even years to return to pre-disability income levels.


FDA Services is a wholly owned subsidiary of the Florida Dental Association (FDA). We strive to be the source for information about insurance for our member dentists. Revenue from insurance sales goes directly toward helping FDA programs and lobbying efforts that are important to members, and to keep dues at their lowest possible level.

Our experienced staff is ready to get to work for you — call or text 850.681.2996 or email insurance@fdaservices.com to connect to our agents today. Visit fdaservices.com/disability for more information.

Hurricane Practice Prep

We’ve all seen the dramatic effect hurricanes can have, both the initial wind and rain and the floods and devastation that follow. There are steps you can take to stay safe and reduce damage to your property in the event of a storm.

BEFORE A HURRICANE

  • Install storm shutters.
  • Remove yard debris, such as dead tree limbs, that could become flying missiles.
  • Make sure your practice communication plan is in place and ready to be put into effect.
  • Make sure you and/or employees know how to shut off utilities, including water main.
  • Look through your emergency kit to ensure it is fully stocked and up to date with necessities for preparing your practice.
  • Back up computer records and store them at least 50 miles off-site.
  • Gather important papers to take with you if you must evacuate, including inventory lists and insurance information.

DURING A HURRICANE

  • Know your community’s evacuation plan and, if asked to evacuate, do so immediately.
  • Stay inside and away from windows, skylights and glass doors. Avoid elevators.
  • Avoid washed out and wet roads that can hide downed electrical lines or underlying currents that can carry your vehicle away.

AFTER A HURRICANE

  • Water is a major cause of damage after hurricanes. The longer your house is exposed to water, the more damage you’ll see to your roof, ceiling, walls and floors, as well as any personal belongings inside. After the storm has passed, it’s important to dry out anything water damaged.
  • Open windows and doors to allow air to circulate and speed up the drying process.
  • Clean up any broken glass and remove debris.
  • Board up broken windows and doors.
  • Cover roof damage with tarps or plywood.
  • Save receipts for any temporary repair expenses.
  • Move any wet items to a dry place.
  • If possible, place any damaged items in a safe, secure area where they can be inspected later.


Content provided by Safeco Insurance.

This article was originally published in FDA Services’ Hurricane Guide, “Storm Proof.” Be prepared for the 2021 hurricane season with articles about how to prepare, loss and damage, and making a claim. Visit fdaservices.com for more information.