Businesses Need Cyber Insurance – Now!

The major risk to businesses victimised by cyber breaches is the reputational damage that can follow, damage that often comes from US government regulators out to make a name for themselves, according to a former FBI agent who works in the private sector now.

Reputational damage is also the area where businesses most need insurance protection, Jason Smolanoff, head of global cyber security at Kroll Associates, told insurance executives attending the Super Regional Property/Casualty Insurer Conference in Lake Geneva, Wis.

“These days, what’s going on is the federal government and local governments are now coming up with cyber security regulatory frameworks, which they are imposing upon companies that do business within their states,” he said.

He said after an incident, government officials will show up to perform an investigation, what he calls a “look-back,” to “see if the company performed reasonable data security measures on the information they had. If they didn’t have reasonable measures, they then get fined.”

He said the fines aren’t limited to just one state. “It’s not like if you have a problem in one state, it obviates, or negates, or cancels all the other states. They can all come after you, individually. The federal government can all come after you,” he said.

The Kroll security expert said he has clients dealing with breach lawsuits from seven different federal and state agencies.

“These are the things that people are going to be looking for coverage on from folks like you,” he told the audience of carrier executives.

“That I think is where the real risk lies. It’s not so much the computer intrusion. It’s not so much on the technical side. The major risk really is coming to a company from a reputational standpoint, from a financial standpoint, from a legal standpoint after the intrusion happens. It’s mostly by our governments who are going after these companies who are victims to begin with,” he said.

Make Their Mark

Smolanoff, whose FBI work encompassed cyber security and, before that, organized crime, maintains that regulators are trying to “make their mark so that they can then jump out into private industry.”

He cited California and Massachusetts as two of the most aggressive states vying to justify the heaviest fines against companies they determine lacked adequate security.

“Whatever side of the fence you’re on in the insurance industry, as you start to write more policies, this is ultimately going to become part of what those payouts are going to be and part of what the claims are going to be. You may not pay them out but they’ll be part of the claim at some point,” he told the insurance audience.

He offered what he acknowledged might be a cynical view of the trend.

“Most of these federal and state agencies are seeing this as a way to generate revenue because of the huge budget, true or false,” he said. “I have seen them staff up state AG offices for cyber compliance at a rate that’s just unbelievable. They’re doing that because they’re seeing there’s huge revenue to be generated here. It’s sad, in my opinion, because it’s after the fact and it’s a victim.”

Simply because a company has been audited or certified for cyber security does not mean it is a better risk, according to Smolanoff. He said most large companies that have suffered breaches have been ones that spent millions of dollars on information security and were audited or certified yet they still became victims.

Defending Against Government

He said his firm is working with clients and insurance underwriters on ways to minimize the risk posed by these government actions, developing questions that can help determine how good or how poor a particular insured’s cyber security posture is.

It comes down to companies being able to demonstrate “reasonable security” so that they can differentiate themselves from other similar firms.

Cyber Security Narrative

Smolanoff recommended that every company prepare a narrative outlining its cyber security, the steps it has taken, and what its response capabilities are.

“When you have a computer intrusion and you go before anybody, whether it’s an insurance company to file a claim, a state AG, a client, a business partner, what you want to be able to say is, ‘We as a company did a threat based analysis and we understand the data that we have would be interesting to the following threats. We took reasonable security measures to protect that data based upon the size of the company we are and the amount of revenue that we’re generating each year. If somebody came in and got to this data, they would have had to have taken extraordinary measures to do so.”

A statement like that can be “very powerful” in helping to “differentiate the company from about 90 percent of the other companies that are out there. It helps to minimise fines.”

He said while there are many theories about information security, the measure of a good information security strategy and program is a “company’s ability to rapidly detect and effectively respond” to an incident. It starts with assuming a breach will happen.

“It’s not really about stopping incidents anymore. It’s about how quickly can you identify when there’s anomalous behavior and do something about that anomalous behavior to stop it,” he said.

“It’s where you assume that an attacker is going to get into your network. They will get in but as a result of that attack, you will be able to detect them and stop them before they get to something that’s important.”

Thus, if an intruder gets into to the executive administrator’s computer but they can’t get any further, that’s fine. “We can deal with that. That’s not a big deal. That’s a low risk. We move on,” he said. However, “if they get in and they’re able to then move to your crown jewels within the network and get there and take the data without anyone knowing, that’s a big problem.”

Pay No Ransom

Should an insured or carrier become a victim of a ransomware attack, the former FBI agent strongly advises against paying any ransom money to the attackers.

“You have about 50 percent chance of getting your data back after you pay. Once you pay, then they know who you are and they know that you have money and they know that you pay. They keep coming after you even more. It’s a vicious cycle,” he warned.

He said Kroll has been asked but refuses to participate when an insurance company decides to pay a ransom on behalf of a client.

“Making the payment is almost assuredly going to some type of criminal organization. It would support anything from drug trafficking to human trafficking to more financial crimes, or something like that,” he said.

“I think it just puts us in a bad place and I think it puts, potentially your insured, and maybe even the insurance company, or anyone who’s in that chain with some type of risk. That’s just our company position that we will not be in escrow and we don’t advise that people make the payments.”

Insurance Journal:      Image: Nick Youngson:

You Might Also Read:

Making Sense Of Cyber Insurance:

Insurers Are Handling 'hundreds' Of Breach Claims:

 

« Trump's Top Cybersecurity Advisors Resign
Uber’s U-Turn On User Watching »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Baker McKenzie

Baker McKenzie

Baker & McKenzie is an international law firm. Practice areas include Data & Technology.

Cyber Security Academy - University of Southampton

Cyber Security Academy - University of Southampton

An industry/University partnership established to advance cyber security through world class research, teaching excellence, industrial expertise and training capacity.

LEXFO

LEXFO

LEXFO specializes in the security of information systems, assisting clients in protecting information assets using an offensive and innovative approach.

National Information Security & Safety Authority (NISSA) - Libya

National Information Security & Safety Authority (NISSA) - Libya

NISSA is responsible for safeguarding the integrity, availability and resilienceof ICT infrastructure, resources, services and data in Libya.

Echoworx

Echoworx

Echoworx primary and exclusive focus is providing organizations with secure email services.

Yaana Technologies

Yaana Technologies

Yaana is a leading provider of intelligent compliance solutions including lawful interception, data retention & disclosure, and advanced security analytics.

QuickLaunch

QuickLaunch

QuickLaunch transforms how cloud-savvy institutions and companies manage human and device authentication, authorization, access control and integration.

ITsMine

ITsMine

ITsMine’s Beyond DLP™? solution is a leading Data Loss Prevention (DLP) solution used by organizations to protect against internal and external threats automatically.

Security Weaver

Security Weaver

Security Weaver is a leading provider of governance, risk and compliance management (GRCM) software.

usecure

usecure

usecure is a global provider of computer-based cyber security awareness training, offering the market’s most time-efficient, cost-effective and admin-lite solution for reducing insider threats.

Infopercept Consulting

Infopercept Consulting

Infopercept is a leading cybersecurity company in India, providing a critical layer of security to protect business information, infrastructure & assets across the organization.

SecureData

SecureData

SecureData provide professional data recovery services, digital forensics, data recovery software and FIPS 140-2 Level 3 Validated hardware encrypted drives.

N-able

N-able

N-Able deliver simple and sophisticated monitoring, security, and business solutions that empower you to solve your toughest IT challenges.

Lumifi

Lumifi

Lumifi provide end-to-end cybersecurity resilience solutions with a specialty in managed detection and response (MDR) services.

HashDit

HashDit

HashDit products and services focus on helping build a safe ecosystem for both protocol users and smart contract developers on BNB Chain.

Hetz Ventures

Hetz Ventures

Hetz Ventures is a global-facing VC investing in highly talented and ambitious Israeli founders who operate at the cutting edge of deep technology.

BLOCX

BLOCX

BLOCX is designed to address the ever-growing challenges of managing and securing digital devices, from personal computers to corporate networks.