4 ms·

I would kind of expect the argument about not paying out to be one of negligence on behalf of Mondelez. NotPetya uses the EternalBlue exploit which Microsoft pa

I would kind of expect the argument about not paying out to be one of negligence on behalf of Mondelez. NotPetya uses the EternalBlue exploit which Microsoft patched in March 2017, NotPetya was late June 2017. Don't install security patches on 1,700 servers and 24,000 laptops for four months? Don't get an insurance payout.

zapdrive 8y ago
I'm sure negligence is covered under insurance, that's why Zurich made a claim of "cyber war", which is harder to prove than negligence. Also if negligence wasn't covered, almost everything can be claimed as negligence. For example, fire started due to electric short circuit: negligence, you should have got everything inspected every x months/years. Theft: negligence, you should have x number of security guards. You see where I'm going?
- thaumasiotes 8y ago
  In my mind, the usual handling of negligence is that your insurance contract may specify steps that you're required to take in order for any eventual claim to be valid. For example, a policy insuring your car against theft may specify that you keep your car parked in the garage and not on the street. If your car is stolen off the street in front of your house, you're not going to get anything. Conceptually, such a clause represents you guaranteeing a particular standard of non-negligence in exchange for lower premiums.
- tomjen3 8y ago
  Sure, but not in the right direction. They wouldn't have an argument for negligence because of a short circuit if you followed the official rules for inspections.
cwilkes 8y ago
That’s an interesting point. Just as there are financial auditors for investors do cyber insurance companies actually do any auditing of their clients? It would be in both of their best interests to do so. Mondelez would see that they need to get their security house in order and Zurich would gain some expertise in what to look for in their clients.
deleted 8y ago
[deleted]

zapdrive 8y ago

I'm sure negligence is covered under insurance, that's why Zurich made a claim of "cyber war", which is harder to prove than negligence. Also if negligence wasn't covered, almost everything can be claimed as negligence. For example, fire started due to electric short circuit: negligence, you should have got everything inspected every x months/years. Theft: negligence, you should have x number of security guards. You see where I'm going?

thaumasiotes 8y ago
In my mind, the usual handling of negligence is that your insurance contract may specify steps that you're required to take in order for any eventual claim to be valid. For example, a policy insuring your car against theft may specify that you keep your car parked in the garage and not on the street. If your car is stolen off the street in front of your house, you're not going to get anything. Conceptually, such a clause represents you guaranteeing a particular standard of non-negligence in exchange for lower premiums.
tomjen3 8y ago
Sure, but not in the right direction. They wouldn't have an argument for negligence because of a short circuit if you followed the official rules for inspections.

cwilkes 8y ago

That’s an interesting point. Just as there are financial auditors for investors do cyber insurance companies actually do any auditing of their clients? It would be in both of their best interests to do so. Mondelez would see that they need to get their security house in order and Zurich would gain some expertise in what to look for in their clients.

deleted 8y ago

[deleted]