Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cyber Security Practices Insurance Underwriters Demand
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/8/2015 | 5:15:20 PM
Re: Cyber Insurance
Good article, many thanks. In addition to this good advice, I would like to make security professionals aware that actually they are unlikely to be anything other than important influencers in the evaluation of cyber insurance cover for their organisations and in some cases (although wrongly) they might not even be consulted. This is because if their organisation is large enough to warrant the valuable risk assessment advice given here, it will also be very likely to have a senior executive e.g. Chief Risk Officer, Company Secretary, CFO, General Counsel etc. , often on the Board, who is responsible for the insurance portfolio of cover for the business and the decision to purchase; and oftentimes the decision to even consider cyber insurance in the first place will be taken by them and heavily influenced by their insurance broker. Underwriters are of course a key part of the puzzle and many will be happy to speak to the client directly but usually always under the watchful eye of the intermediary. When it comes to cyber insurance, underwriters have historically been more involved because brokers have been slow to skill up to help the clients assess and provide the necessary information for the insurance cover to be agreed. This situation is gradually changing as brokers tune into the business potential but the complexities of cyber risk mitigation often leaves them less than confident when advising their clients. In order to become part of the process it is vitally important that Infosec professionals first understand how their organisations insurance cover is managed if they are to intervene in, or even initiate/preempt the process of evaluating and potentially acquiring suitable cyber insurance. Remember that just as Boards have often (unfortunately) paid little heed to their IT departments and Infosec team before, it is likely not to be messages from their own staff that eventually get cyber risk to their attention! Instead it will be the rising trend of breaches reported in the media, advice and discussions with their fellow executives and non-executives and interactions with their incumbent brokers chatting informally about the new 'cyber products' they have on offer over drinks at the 19th hole. Nevertheless, once politics and process are understood and navigated, the good news is that, for those Infosec professionals who are often frustrated that they don't get listened to at suitably high levels (and cyber risk is right up there now) then this truly is an opportunity to have their voice heard and surely it is one which is very worthwhile pursuing. There are a few truly independent cyber risk insurance specialists who are not brokers and who have a strong background in Infosec and I could not recommend Infosec professionals to seek such advice more highly given that many are (rightly or wrongly) a bit sceptical of insurance brokers. Such advice would also be vital if the Infosec professionals are to be able to understand both the risk profile(s) and response capability of their organisation and be able to speak with reasonable authority when informing their executives decisions on the ideal cyber insurance cover for their organisation.
User Rank: Author
12/15/2014 | 5:26:47 PM
Re: Cyber Insurance
Thanks for your comment, Joe. 

I agree that cyber coverage should be comprehensive and multifaceted. Good policies do more than merely transfer asset value risk; they should also include coverage related to expenses and services that enable a speedy recovery. Asset value is one way of determining the value of coverage, but it should equally defend intangible assets. 

Cyber resiliency is a function of holistic business investments that together reduce the probability of compromise and accelerate a company's safe return to normal operations. Cyber assessments - as part of risk informed planning - help companies and underwriters identify areas of potential risk. Underwriters recognize they can create additional value for their clients by enabling more proactive security planning coverage in advance of a breach. Coverage dialogue can then center on obtaining the right product relative to their clients' specific security posture. 
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
12/15/2014 | 12:34:52 AM
Cyber Insurance
Of course, what you want covered can play a big part -- which is where this self-assessment can really help.  Retroactive coverage for as-of-yet-unknown breaches comes to mind.  Ditto for content injury liability.

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Data Breaches Affect the Enterprise
Data breaches continue to cause negative outcomes for companies worldwide. However, many organizations report that major impacts have declined significantly compared with a year ago, suggesting that many have gotten better at containing breach fallout. Download Dark Reading's Report "How Data Breaches Affect the Enterprise" to delve more into this timely topic.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-11-28
A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell
PUBLISHED: 2021-11-28
ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file
PUBLISHED: 2021-11-27
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
PUBLISHED: 2021-11-26
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via C...
PUBLISHED: 2021-11-26
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious...