Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/6/2015
09:50 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

What The Boardroom Thinks About Data Breach Liability

Most public companies subscribe to cybersecurity insurance of some sort, and 90% say third-party software vendors should be held liable for vulnerabilities in their code.

Most US publicly traded companies now employ cybersecurity insurance to protect them from liability fallout, and 90% believe regulators should hold companies liable for breaches if they didn't properly secure their data.

The heat is also on third-party software vendors: 90% of the companies say those suppliers should be held liable for vulnerabilities found in their software, and 65% have either already or are planning to include liability clauses in their contracts with their software suppliers.

Meanwhile, 91% of companies that have cybersecurity insurance have protection for business interruption and data restoration; 54% for expense reimbursement for fees such as PCI fines, breach notification, and extortion. Some 35% say they want coverage for software coding and human error causes for data loss, according to a survey of some 276 board directors or senior executives by New York Stock Exchange (NYSE) Governance Services and Veracode.

Some 52% say they are buying employee/insider threat liability coverage. Coding and human error are rising on their radar screens: "I was surprised that 35% already are [seeking] insurance for coding and human errors. That number will increase, when there's standardization around what that means," says Chris Wysopal, co-founder and CTO of Veracode. "The insurance industry will drive the standards."

Wysopal says cyber insurance is becoming the norm for recovering costs of rebuilding and cleaning up after a breach. "The really important thing about cybersecurity insurance is it's really going to [define] best practices. You have regulators like the FTC … and SEC … talking about what they think is best," he says, and cyber insurance policies will likely "piggyback" off of those recommendations and influence what gets covered.

Deborah Scally, who heads up NYSE research, says cyber insurance is more pervasive than you'd think. "There's always insurance in place. You may not even know if you're covered [for cybersecurity] under your larger policies," she says. "We're going to be interested in looking at where this goes. We're kind of at the beginning states of that right now."

Some 90% of execs believe the Federal Trade Commission and other regulatory bodies should indeed hold businesses liable if they don't practice due diligence in data protection. And more than half anticipate that their shareholders will expect more transparency about cybersecurity.

"Boards are concerned about brand damage," Wysopal says. 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
mumbles76
50%
50%
mumbles76,
User Rank: Apprentice
11/6/2015 | 4:02:14 PM
FTC? SEC?
I think Insurance underwriters will require standard security measures to be put in place. But this artcle mentions the FTC and SEC as moderators? Did i read that correctly? Hardly the governing bodies that should be entrusted with our corporate security, if so.
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Why AI Will Create Far More Jobs Than It Replaces
John DiLullo, CEO, Lastline,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Talk about vendor lock in...
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11816
PUBLISHED: 2019-05-20
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.
CVE-2019-10076
PUBLISHED: 2019-05-20
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10077
PUBLISHED: 2019-05-20
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
CVE-2019-10078
PUBLISHED: 2019-05-20
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
CVE-2019-12239
PUBLISHED: 2019-05-20
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.