Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
How Can I Ensure Cyber Insurers Will Pay My Claim?
Oldest First  |  Newest First  |  Threaded View
renglish98
50%
50%
renglish98,
User Rank: Apprentice
9/26/2019 | 9:21:25 AM
Cyber Insurance claim
The answer is not as striaghtforward as one would think. After notPetya, several firms had to sue their insurers who refused to pay the cyber claim as they argued that it was a state-sponsored attack and exempted via a force majeur clause.

Similarly, customers need to be constantly patching and remediating vulnerabiliies to demonstrate they are performing 'due care' and not unreasonably exposing their firm to cyber risk, which could be a claim denial justification.
mcavanaugh1
50%
50%
mcavanaugh1,
User Rank: Strategist
10/15/2019 | 7:57:37 AM
Re: Cyber Insurance claim
To confirm, most of the claims declined and firms that are suing their insurer attempted to file a claim under a non-cyber policy.  Mondelez is the case most reference however they tried to get coverage under their Property Insurance policy after refusing to purchase a Cyber policy for years.  Also, the declination was under the War Exclusion.

There is a lot of misconception as to what is covered, is not coverage, how it is covered, and what needs to be done to obtain coverage. This is partly the fault of the insurance industry as each Cyber policy is different with varying coverage, underwriting, and requirements. Most long-standing insurance companies writing Cyber Insurance do not require constant updating or any sort of updating outside of what an insured puts on an application.  The most important factor is to work with an agent/broker/carrier that is knowledgable in this space and up to date on the emerging risks to ensure that a policy is placed with the best carrier for the specific company.  There is no "best policy" or "best carrier" in the marketplace only the best carrier for the specific insured.
Richard F.
50%
50%
Richard F.,
User Rank: Apprentice
3/10/2020 | 1:31:40 PM
Cyber Insurance Uncertainties and Concealed Traps
Cyber insurance is fraught with serious problems.  There is no standard coverage language in the policies.  Buyers are required to understand arcane terms, sublimits and exclusions. Of course, you have actually read and fully understand every word and comma of your potential policy????? 

Worse, the policies have numerous concealed traps.  Many policies require expensive arbitration of coverage disputes.  Even if your states' law prohibits arbitration of insurance disputes, federal courts, law and treaties can override the McCarran-Furguson Act and force Buyers to have claims decided by foreign arbitrators in London, Geneva, Paris or Hamilton. If the Buyer is lucky, the surprise required arbitration may be in New York. All of those venues are at the expense of an already damaged company needing prompt payment.

Some insurers try to force insurance industry dominated arbitrators onto Insureds by policy provisions requiring specific arbitration administrators, of course to "ensure "quality" Neutrals." Those include by reference use of their associated over-restrictive, incestuous "repeat player" favoring arbitrator panels. 

Different federal circuits and state courts have interpreted the same language differently. Provisions that have been interpreted by courts as granting coverage in some circuits and states exclude coverage for the same risks in other circuits and states.   

It is critical that Buyers obtain expert advice from lawyers and brokers.  Or risk joining Mondelez and other companies fighting to obtain the coverage they thought they had purchased.

Richard Faulkner, J.D., LL.M., F.C.I.Arb.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/3/2020
Data Loss Spikes Under COVID-19 Lockdowns
Seth Rosenblatt, Contributing Writer,  5/28/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10548
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10549
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10546
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10547
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-11094
PUBLISHED: 2020-06-04
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as ...