Risk

1/23/2018
07:50 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail

10 Costs Your Cyber Insurance Policy May Not Cover

All the things you might think are covered but that don't actually fall under most policies.
2 of 11

Sales loss during downtime
Business interruption coverage isn't meant to cover lost profit, explains Shah. Many organizations think they are covered for everything they would have sold during the time they lost access to systems, but in reality, they won't be covered for the profit they would have made.
'If you lose access for a day, whatever profit margin you would've lost in that day for not being able to access equipment, you will get coverage for ... it's a very small amount,' he says.
This is especially problematic during profitable times of the year, says Itskovich. For example, consider an ecommerce company with a business interruption on Cyber Monday. 'The clear net income could be ten times the annual average but no policy will cover that,' he explains.
(Image: Wong yu liang via Shutterstock)

Sales loss during downtime

Business interruption coverage isn't meant to cover lost profit, explains Shah. Many organizations think they are covered for everything they would have sold during the time they lost access to systems, but in reality, they won't be covered for the profit they would have made.

"If you lose access for a day, whatever profit margin you would've lost in that day for not being able to access equipment, you will get coverage for it's a very small amount," he says.

This is especially problematic during profitable times of the year, says Itskovich. For example, consider an ecommerce company with a business interruption on Cyber Monday. "The clear net income could be ten times the annual average but no policy will cover that," he explains.

(Image: Wong yu liang via Shutterstock)

2 of 11
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Volnut
50%
50%
Volnut,
User Rank: Apprentice
1/29/2018 | 8:41:17 AM
Re: 10 costs potentially covered
Thank you for your insights.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
1/25/2018 | 11:53:35 PM
Re: 10 costs not covered
I think the key word here is "May". If you think of it and you ask or negotiate, you can probably get it (albeit, perhaps, not at the price you want).

There is a complaint that smaller companies have less bargaining power than large enterprises, which may sometimes be true, but more often smaller or midsize companies are simply not thinking to ask very specifically for the things that large enterprises might consider routine.
PaulWaite
100%
0%
PaulWaite,
User Rank: Strategist
1/24/2018 | 11:18:11 PM
Cyber Cover Available
The costs that you have outlined and can be covered by one insurer. As stated you just need a broker that understands the various layers of complexity between various other businesss covers as well

We have designed a cyber product for the Australian market which is tailored to an organisationa actual risk and risk transference appetite. Simply put is is "Cyber by Design".
BrianN060
100%
0%
BrianN060,
User Rank: Ninja
1/24/2018 | 9:44:15 PM
Re: 10 costs potentially covered
@MC: I like your comment.  Don't agree with all your points; but they should be voiced - in a serious consideration of the proper role of insurance in cybersecurity corporate policy; and beyond the interests of an organization or industry.  There are macro-economic implications, and broad public and social consequences to what boils down to the responsibilities of data governance.

I don't think those can be properly enumerated and assessed in a string of comments.  Maybe it's enough that the article and comments inspire a closer look at the issues involved.  
mcavanaugh1
100%
0%
mcavanaugh1,
User Rank: Strategist
1/24/2018 | 1:59:26 PM
10 costs potentially covered
All 10 of the points provided can be covered under a Cyber Insurance policy through multiple insurance companies.  The issue should not be the problems with the policy but the problems with the agents & brokers selling the coverage.  Finding a broker or agent that understands the questions to ask, the carriers in the marketplace and the coverage to be added is the most important part of obtaining this coverage. Most of the issues we hear about claims being denied arise from an insurance agent that does not understand the coverage and simply places the insurance with the cheapest carrier on the table.  If your agent does not know how to get you a comprehensive insurance policy they should know who can get you one otherwise it is time for a new insurance agent.

Cybersecurity is a risk to be managed not solved.  Any comprehensive risk management program should incorporate IT security, Internal Policies, etc... as well as an Insurance policy to transfer the risk that cannot be removed through spending money on security. 
BrianN060
100%
0%
BrianN060,
User Rank: Ninja
1/24/2018 | 9:27:16 AM
10 costs not covered
Fine article, Kelly.  If typical, what's actually covered, they could write on a post-it note (it's the exclusions that would fill the binder).  Being flippant; but the facts presented should have many reconsidering reliance on insurance, over effective cybersecurity and data management/governance policies.   
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I'm not sure I like this top down management approach!"
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17358
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a ...
CVE-2018-17359
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
CVE-2018-17360
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executa...
CVE-2018-17361
PUBLISHED: 2018-09-23
Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled.
CVE-2018-17364
PUBLISHED: 2018-09-23
OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.