Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cyber Security Practices Insurance Underwriters Demand
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/8/2015 | 5:15:20 PM
Re: Cyber Insurance
Good article, many thanks. In addition to this good advice, I would like to make security professionals aware that actually they are unlikely to be anything other than important influencers in the evaluation of cyber insurance cover for their organisations and in some cases (although wrongly) they might not even be consulted. This is because if their organisation is large enough to warrant the valuable risk assessment advice given here, it will also be very likely to have a senior executive e.g. Chief Risk Officer, Company Secretary, CFO, General Counsel etc. , often on the Board, who is responsible for the insurance portfolio of cover for the business and the decision to purchase; and oftentimes the decision to even consider cyber insurance in the first place will be taken by them and heavily influenced by their insurance broker. Underwriters are of course a key part of the puzzle and many will be happy to speak to the client directly but usually always under the watchful eye of the intermediary. When it comes to cyber insurance, underwriters have historically been more involved because brokers have been slow to skill up to help the clients assess and provide the necessary information for the insurance cover to be agreed. This situation is gradually changing as brokers tune into the business potential but the complexities of cyber risk mitigation often leaves them less than confident when advising their clients. In order to become part of the process it is vitally important that Infosec professionals first understand how their organisations insurance cover is managed if they are to intervene in, or even initiate/preempt the process of evaluating and potentially acquiring suitable cyber insurance. Remember that just as Boards have often (unfortunately) paid little heed to their IT departments and Infosec team before, it is likely not to be messages from their own staff that eventually get cyber risk to their attention! Instead it will be the rising trend of breaches reported in the media, advice and discussions with their fellow executives and non-executives and interactions with their incumbent brokers chatting informally about the new 'cyber products' they have on offer over drinks at the 19th hole. Nevertheless, once politics and process are understood and navigated, the good news is that, for those Infosec professionals who are often frustrated that they don't get listened to at suitably high levels (and cyber risk is right up there now) then this truly is an opportunity to have their voice heard and surely it is one which is very worthwhile pursuing. There are a few truly independent cyber risk insurance specialists who are not brokers and who have a strong background in Infosec and I could not recommend Infosec professionals to seek such advice more highly given that many are (rightly or wrongly) a bit sceptical of insurance brokers. Such advice would also be vital if the Infosec professionals are to be able to understand both the risk profile(s) and response capability of their organisation and be able to speak with reasonable authority when informing their executives decisions on the ideal cyber insurance cover for their organisation.
User Rank: Author
12/15/2014 | 5:26:47 PM
Re: Cyber Insurance
Thanks for your comment, Joe. 

I agree that cyber coverage should be comprehensive and multifaceted. Good policies do more than merely transfer asset value risk; they should also include coverage related to expenses and services that enable a speedy recovery. Asset value is one way of determining the value of coverage, but it should equally defend intangible assets. 

Cyber resiliency is a function of holistic business investments that together reduce the probability of compromise and accelerate a company's safe return to normal operations. Cyber assessments - as part of risk informed planning - help companies and underwriters identify areas of potential risk. Underwriters recognize they can create additional value for their clients by enabling more proactive security planning coverage in advance of a breach. Coverage dialogue can then center on obtaining the right product relative to their clients' specific security posture. 
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
12/15/2014 | 12:34:52 AM
Cyber Insurance
Of course, what you want covered can play a big part -- which is where this self-assessment can really help.  Retroactive coverage for as-of-yet-unknown breaches comes to mind.  Ditto for content injury liability.

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-10-21
Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot...
PUBLISHED: 2021-10-21
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
PUBLISHED: 2021-10-21
"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"
PUBLISHED: 2021-10-21
Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.
PUBLISHED: 2021-10-21
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrat...