Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
10 Costs Your Cyber Insurance Policy May Not Cover
Threaded  |  Newest First  |  Oldest First
BrianN060
100%
0%
BrianN060,
User Rank: Ninja
1/24/2018 | 9:27:16 AM
10 costs not covered
Fine article, Kelly.  If typical, what's actually covered, they could write on a post-it note (it's the exclusions that would fill the binder).  Being flippant; but the facts presented should have many reconsidering reliance on insurance, over effective cybersecurity and data management/governance policies.   
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
1/25/2018 | 11:53:35 PM
Re: 10 costs not covered
I think the key word here is "May". If you think of it and you ask or negotiate, you can probably get it (albeit, perhaps, not at the price you want).

There is a complaint that smaller companies have less bargaining power than large enterprises, which may sometimes be true, but more often smaller or midsize companies are simply not thinking to ask very specifically for the things that large enterprises might consider routine.
mcavanaugh1
100%
0%
mcavanaugh1,
User Rank: Strategist
1/24/2018 | 1:59:26 PM
10 costs potentially covered
All 10 of the points provided can be covered under a Cyber Insurance policy through multiple insurance companies.  The issue should not be the problems with the policy but the problems with the agents & brokers selling the coverage.  Finding a broker or agent that understands the questions to ask, the carriers in the marketplace and the coverage to be added is the most important part of obtaining this coverage. Most of the issues we hear about claims being denied arise from an insurance agent that does not understand the coverage and simply places the insurance with the cheapest carrier on the table.  If your agent does not know how to get you a comprehensive insurance policy they should know who can get you one otherwise it is time for a new insurance agent.

Cybersecurity is a risk to be managed not solved.  Any comprehensive risk management program should incorporate IT security, Internal Policies, etc... as well as an Insurance policy to transfer the risk that cannot be removed through spending money on security. 
BrianN060
100%
0%
BrianN060,
User Rank: Ninja
1/24/2018 | 9:44:15 PM
Re: 10 costs potentially covered
@MC: I like your comment.  Don't agree with all your points; but they should be voiced - in a serious consideration of the proper role of insurance in cybersecurity corporate policy; and beyond the interests of an organization or industry.  There are macro-economic implications, and broad public and social consequences to what boils down to the responsibilities of data governance.

I don't think those can be properly enumerated and assessed in a string of comments.  Maybe it's enough that the article and comments inspire a closer look at the issues involved.  
Volnut
50%
50%
Volnut,
User Rank: Apprentice
1/29/2018 | 8:41:17 AM
Re: 10 costs potentially covered
Thank you for your insights.
PaulWaite
100%
0%
PaulWaite,
User Rank: Strategist
1/24/2018 | 11:18:11 PM
Cyber Cover Available
The costs that you have outlined and can be covered by one insurer. As stated you just need a broker that understands the various layers of complexity between various other businesss covers as well

We have designed a cyber product for the Australian market which is tailored to an organisationa actual risk and risk transference appetite. Simply put is is "Cyber by Design".


Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5531
PUBLISHED: 2020-02-17
Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User Ethernet port (CH1, CH2): First 5 digits of serial number 21121 or before), MELSEC iQ-R Series C Controller Module / C Intelligent Function Module(R12CCPU-V Ethe...
CVE-2020-7252
PUBLISHED: 2020-02-17
Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.
CVE-2020-9024
PUBLISHED: 2020-02-17
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time) scripts.
CVE-2020-9025
PUBLISHED: 2020-02-17
Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
CVE-2020-9026
PUBLISHED: 2020-02-17
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.