-1.svg){kind=logo}
New Log4j tool, Corvus updates, and more in our Bird's Eye newsletter.
New year, same old inbox? Don’t worry, Bird’s Eye has returned to spruce up the place. If you’re nostalgic for 2021, you can read our last edition from November. But for the latest on cybersecurity trends, insights from the pros, and best practice recommendations, keep reading 👇
What's New at Corvus
As you may have heard, Corvus acquired Tarian Underwriting Limited, a Lloyd’s of London coverholder, allowing us to bring our technology and risk mitigation to a global market. You can read more about the acquisition in our recent post.
Even hotter off the presses? We’ve just released a Log4j vulnerability discovery solution in collaboration with our friends at CrowdStrike.
It’s challenging for many organizations to know with 100% certainty that every instance of the Log4j utility has been located and patched. Between Corvus’s in-house tool, which remotely scans external environments for the vulnerability, and the CrowdStrike Archive Scan Tool, your Corvus clients can be sure they are protected. Read more about the solution and share our form with your clients so they can request a scan. Note: we’ll be emailing policyholders later today to invite them to request a scan.
Not up to speed on Log4j? Keep reading for the roundup from our cyber experts.
Cybersecurity Tips
From VP of Risk + Response Lauren Winchester and CISO Jason Rebholz
In the first half of 2021, we had the Microsoft Exchange zero-day that wreaked havoc on Microsoft shops. Not to be outdone, the second half of 2021 brought the Log4j zero-day that impacted an untold number of systems.
- What is Log4j? Log4j is a software tool, written in Java, used by developers to track activities in their software applications or online services. This is known as logging. Essentially, if a developer wants to know what happened in an application, Log4j will facilitate the record. This supports troubleshooting or understanding the general usage of the application. On December 9, 2021, a security researcher disclosed a critical vulnerability in Log4j (and others have since been identified).
- Where is Log4j used? Log4j is open-source software, meaning the code doesn’t require any special licenses for end-users and developers to modify, use, and distribute it. Since the code is readily accessible, you are likely to find Log4j in a lot of software.
- Why am I hearing so much about these vulnerabilities? Unfortunately, vulnerabilities like Log4j are easy for attackers to scan for and exploit. When you couple the widespread use of Log4j with the ease of vulnerability exploitation, it’s a perfect storm. When a hacker exploits the first vulnerability, it allows them to execute code on a remote system which can serve as an entry point into your environment. Attackers will also try to leave a backdoor into an organization’s system, allowing for re-entry at a later time to launch other attacks, like ransomware.
For more on what is being referred to as “one of the greatest internet vulnerabilities in the last seven years,” and the next steps you need to take, read our blog post. And if you haven’t already, we strongly recommend your clients deploy an endpoint detection and response (EDR) tool, to help quickly identify threats and mitigate against attacks. Corvus offers a free 60 day trial for SentinelOne EDR.
Stay tuned: You can find all of our latest vulnerability and threat alerts on our Knowledge Nest.
On Your Radar
A roundup of recent commentary, analysis, and insights from our cyber experts
More Entry Points, More Risk
Written by Corvus’s Chief Underwriting Officer, Mike Karbassi, this article covers the tech industry’s evolving challenges when it comes to underwriting. You can read the full piece, as featured in Carrier Management.
How do Corvus Alerts work?
A key fixture of our Risk + Response team’s policyholder outreach includes vulnerability alerts, which we send in response to critical security advisories. We’ve tracked the timeline of the Palo Alto VPN vulnerability, from initial discovery to when the alert landed in policyholder’s inboxes. See how it played out.
What’s new with our Risk + Response and in-house Claims teams?
Discover first-hand from our team at Corvus how we’re helping to reduce business pain points. We’ll cover: policyholder outreach, appetite changes, and our approach to each book of business. Watch the webinar recording.
Your client has new subjectivities in their quote. Now what?
We’ve created a guide to common subjectivities, all that have been demonstrably proven to reduce cyber risk and make organizations safer. Naturally, our goal is to help policyholders meet these specifications and mitigate risk. From MFA to EDR, and everything in between, access resources and solutions to work through their subjectivities now.
Corvus in the News
- Insurance Business US: Corvus Insurance seals deal for Tarian Underwriting
- Insurance Insider: Corvus acquires London-based underwriting platform Tarian in move to expand globally
- Inc.: Best in Business 2021: The Most Inspiring Companies of the Year
Bird is the Word
If you’ve ever found yourself rooting for a certain little, shy underdog at your bird feeder, you’re not alone. Through crowdsourced data from Project FeederWatch, there’s a legitimate hierarchy to the feeder — and we’re not ashamed to admit our excitement — crows (part of the Corvid family) do come out on top. Sorry and good luck, Carolina chickadee.