Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
5 Things to Know About Cyber Insurance
Newest First  |  Oldest First  |  Threaded View
Richard F.
50%
50%
Richard F.,
User Rank: Strategist
8/16/2019 | 1:03:05 PM
Great Article - But There Are Dangerous Traps for Unwary
This is a very useful and timely article by a very knowledgible reporter who has done excellent work in this ever changing and confusing field.

Unfortunately there are often even greater surprises concealed within Cyber Insurance Policies and endorsements.

 

First, Cyber Insurance in NOT standardized.  These are "Manuscript" policies with each insurer using its own custom language and provisions.  The "meaning" of the language is NOT uniform.  The same provisions can be interpreted in contrasting ways in different federal circuits and state courts.  Whether your company has "collectible" insurance often depends on what state(s) you are located in.  Of course, that is unless a "Choice of Law" clause specifies the insurance law of a particular state, like New York.

Second, Cyber Insurance is often a "tower" of distinct layers and levels. That means there are separate insurers for different amounts of coverage.  Higher layers often mean foreign insurers with unexpected language and restrictions.  What you may think the Declarations page says you have in insurance is NOT necessarily what your company actually has.  

Third, "Insured" companies are frequently shocked to learn choice of law and arbitration clauses mean no litigation in local courts, no state judges familiar with their domestic insurance law, and no jury trials. Even when local state law appears to clearly prohibit arbitration, such as Louisiana etc., the New York Convention as a U. S. International Treaty overrides state law. That allows foreign insurers like Lloyds, Zurich, Swiss Re etc. to require arbitration in London, U.K., Hamilton, Bermuda etc.

Fourth, many American companies are unaware that where there are foreign insurers in an insurance tower, mandatory foreign arbitration is almost guaranteed. Typically that means any disputes will be decided by 3 arbitrators unfamiliar with technology issues, focused on contract language, sitting in London, and applying New York or English insurance law under the English Arbitration Act. If there is a "Nationality" clause, at least 2 of the 3 arbitrators will NOT be U.S. citizens, or well versed in U.S. state insurance laws.

Finally, "Insured" companies being required to make six figure deposits to simply start an arbitration are common. I have seen clients required to post USD $200,000.00 to file their Hurricane Katrina claims for each arbitration in London.  That meant separate individual arbitrations for each distinct insurer denying coverage. I won't even beging to address the joys of dealing with English High Court "Anti-Suit" injunctions prohibiting the "insured" from commencing or continuing U.S. litigation.

I have decided insurance coverage disputes as an arbitrator or Federal Court Special Master and also represented companies against insurers as policyholder counsel in arbitration and litigation. It is CRITICAL that any company purchasing Cyber coverage in any form read, know and ACTUALLY UNDERSTAND all of the policy language, every endorsement and every exclusion. That rrequires you do that for each separate layer of coverage.  If you see these common traps, negotiate them out!!!!  

Cooperation between the CIO, CFO and company insurance counsel is absolutely essential. Good Insurance Brokers try to help their customers. BUT customers need to remember that their Brokers business ultimately depends on remaining on good terms with those same insurance companies.

Richard Faulkner, J.D., LL.M., F.C.I.Arb.



Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-36749
PUBLISHED: 2021-09-24
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an e...
CVE-2021-31923
PUBLISHED: 2021-09-24
Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.
CVE-2021-41581
PUBLISHED: 2021-09-24
x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination.
CVE-2021-41583
PUBLISHED: 2021-09-24
vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional VP...
CVE-2021-41584
PUBLISHED: 2021-09-24
Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header.