Risk

1/23/2018
07:50 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail

10 Costs Your Cyber Insurance Policy May Not Cover

All the things you might think are covered but that don't actually fall under most policies.
1 of 11

(Image: LidiaLydia via Shutterstock)

(Image: LidiaLydia via Shutterstock)

1 of 11
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Volnut
50%
50%
Volnut,
User Rank: Apprentice
1/29/2018 | 8:41:17 AM
Re: 10 costs potentially covered
Thank you for your insights.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
1/25/2018 | 11:53:35 PM
Re: 10 costs not covered
I think the key word here is "May". If you think of it and you ask or negotiate, you can probably get it (albeit, perhaps, not at the price you want).

There is a complaint that smaller companies have less bargaining power than large enterprises, which may sometimes be true, but more often smaller or midsize companies are simply not thinking to ask very specifically for the things that large enterprises might consider routine.
PaulWaite
100%
0%
PaulWaite,
User Rank: Strategist
1/24/2018 | 11:18:11 PM
Cyber Cover Available
The costs that you have outlined and can be covered by one insurer. As stated you just need a broker that understands the various layers of complexity between various other businesss covers as well

We have designed a cyber product for the Australian market which is tailored to an organisationa actual risk and risk transference appetite. Simply put is is "Cyber by Design".
BrianN060
100%
0%
BrianN060,
User Rank: Ninja
1/24/2018 | 9:44:15 PM
Re: 10 costs potentially covered
@MC: I like your comment.  Don't agree with all your points; but they should be voiced - in a serious consideration of the proper role of insurance in cybersecurity corporate policy; and beyond the interests of an organization or industry.  There are macro-economic implications, and broad public and social consequences to what boils down to the responsibilities of data governance.

I don't think those can be properly enumerated and assessed in a string of comments.  Maybe it's enough that the article and comments inspire a closer look at the issues involved.  
mcavanaugh1
100%
0%
mcavanaugh1,
User Rank: Strategist
1/24/2018 | 1:59:26 PM
10 costs potentially covered
All 10 of the points provided can be covered under a Cyber Insurance policy through multiple insurance companies.  The issue should not be the problems with the policy but the problems with the agents & brokers selling the coverage.  Finding a broker or agent that understands the questions to ask, the carriers in the marketplace and the coverage to be added is the most important part of obtaining this coverage. Most of the issues we hear about claims being denied arise from an insurance agent that does not understand the coverage and simply places the insurance with the cheapest carrier on the table.  If your agent does not know how to get you a comprehensive insurance policy they should know who can get you one otherwise it is time for a new insurance agent.

Cybersecurity is a risk to be managed not solved.  Any comprehensive risk management program should incorporate IT security, Internal Policies, etc... as well as an Insurance policy to transfer the risk that cannot be removed through spending money on security. 
BrianN060
100%
0%
BrianN060,
User Rank: Ninja
1/24/2018 | 9:27:16 AM
10 costs not covered
Fine article, Kelly.  If typical, what's actually covered, they could write on a post-it note (it's the exclusions that would fill the binder).  Being flippant; but the facts presented should have many reconsidering reliance on insurance, over effective cybersecurity and data management/governance policies.   
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.