19 ms·

Big Companies Thought Insurance Covered a Cyberattack

104 points by tysone 8y ago

gibolt 8y ago
If you are a large target many actors will be looking for your weaknesses. One bad actor will eventually find it, or just trick your employees to give them access. Companies should make a solid effort to prevent the possibility, but I'm torn on what ramifications should be.
- burtonator 8y ago
  > One bad actor will eventually find it, or just trick your employees to give them access. or do what the Russians do and use kompromat
  - Something1234 8y ago
    What is "kompromat"?
    - ealexhudson 8y ago
      It's where you do your dirty laundry.
    - genmon 8y ago
      Blackmail
    - sk5t 8y ago
      It's leverage over an individual--whether that's secrets that might be released, financial problems, or whatever.
    - jldugger 8y ago
      Materials for compromising someone. Blackmail material.
    - neilv 8y ago
      If you want a great fictional interpretation (I don't know how accurate it is): https://en.wikipedia.org/wiki/The_Americans_(2013_TV_series) https://en.wikipedia.org/wiki/The_Americans_(2013_TV_series)
- darkarmani 8y ago
  > Companies should make a solid effort to prevent the possibility Isn't this what they do and then hedge the risk by covering their potential losses with insurance? If companies are not doing a good enough job with security, why does the cyber insurance not cost more? Priced properly, companies can choose between buying more coverage versus throwing more money at the "security problem."
burtonator 8y ago
It might actually be a good thing in the long term as insurance companies may require 3rd party audits and that you comply with basic security practices.
- msla 8y ago
  It might well kill the use of open source and small-company software in business, in that the developers/management behind said code can't pay insurance companies to say that their code will pass audit. Microsoft and Oracle will pass with flying colors, of course.
  - bluejekyll 8y ago
    It could just as well lead to better support models for contributions to fix and audit open source. The open source model is benefiting too many businesses to just up and throw it out.
  - jabart 8y ago
    Doubt it, there are a lot of PCI Compliant businesses that get audited with open source software in their systems. I'm sure they have a node_modules somewhere on their build server. When you have an attack that moves from your servers to your desktop computers, you have a network issue, which would be covered in an audit to verify you properly segment your network instead of having it in one large broadcast domain.
- dontbenebby 8y ago
  But do audits show compliance with basic security practices, or compliance with PCI DSS and other standards which may be orthogonal to security?
  - wefarrell 8y ago
    In this case it would be the insurance company who requests the audit, so there would be incentives to ensure that the audits are meaningfully preventative.
krisrm 8y ago
This is messy. On one hand, how are insurers supposed to properly cost and be able to provide payouts for a "cyberattack", which might be anything from "our company website was DDoSed for 30 minutes and we lost 50 customers" to "our production lines were shut down and our company ground to a halt for two weeks"? On the other hand, if insurers know they can invoke a cyberwarfare clause and deny a claim, even if the attack may not have been state sponsored, the insurance is certainly worthless.
- admax88q 8y ago
  > On one hand, how are insurers supposed to properly cost... That's more or less the core competency of insurance providers...
  - krisrm 8y ago
    Well, no argument there, but I wrote more words in that sentence that you cut off. My point is, that a "cyber attack" is poorly constrained, compared to something like a fire or a flood... a company only has so many assets, valued at $X that are liable to be burned to the ground or ruined by a flood, and these constraints can be modeled and adjusted for. Perhaps I am mistaken, I don't see a cyberattack as being analagous to anything else in the insurance industry.
    - resoluteteeth 8y ago
      If it's so hard to model then why are these insurance companies offering "cyberinsurance" in the first place?
    - rolph 8y ago
      perhaps riot or vandalism [acts of civil disobedience]
    - sandworm101 8y ago
      >> compared to something like a fire or a flood Those are not easy things. People litigate the difference between fire and flood damage all the time. (Putting out a fire normally involves lots of water.) Sometimes flooding in building X even causes a fire in building Y. Is that covered by "fire" or "flood" insurance? The difference between various cyber attacks isn't substantively more complicated than any of the traditional insured risks. The issue is that insurers haven't invested in the experts needed to properly assess those risks. That is their problem to solve, not the customer's.
tedmcory77 8y ago
Wow, this is huge. If cyber insurance doesn't cover cyber attacks, then what does it cover? Having seen the process for cyber insurance paying out for an intrusion, I'd be super concerned if I were a CSO/Chief Risk Officer and there's a chance the cyber insurance wouldn't cover you.
- MiroF 8y ago
  Seems a very odd strategy for cyber-insurance companies to take... If I were a large company insured by Zurich right now, I would definitely be reconsidering giving them my money.
DontGiveTwoFlux 8y ago
Most insurers require customers to limit their risk in all kinds of ways. I’m curious if there are cyber mitigation’s that are out there, such as mandatory two factor authentication, requiring up to date software and OSes or other measures. It seems like any insurance company would Be highly Interested in forcing these best practices.
- blattimwind 8y ago
  Mandatory snake oil
- csours 8y ago
  You can do 1,000 things right, but one thing wrong may still sink you. With cybersecurity, there is an active adversary. I'm not sure insurance ever wants to take on that kind of risk. If they don't want that risk they shouldn't sell insurance.
- wvenable 8y ago
  This particular attack wouldn't have been mitigated by any of that. This is why you also have insurance in addition to doing everything you can to prevent an attack.
dontbenebby 8y ago
Sounds like a big "out" is claiming an attack was an act of war. But very few nations declare war nowadays. They have "police actions" or "peacekeeping missions. Maybe telling these companies "no war was declared, so you must pay out" would be a good thing. Insurance companies are powerful lobbyists both in the traditional K street sense, and the soft power sense. (For the soft power sense, picture a major insurance company telling a nation state their state owned businesses can self insure moving forward, since the business cannot handle the risks they generate.)
- OldHand2018 8y ago
  > Maybe telling these companies "no war was declared, so you must pay out" would be a good thing. That goes against centuries of precedence. The only difference now is that it was "on the Internet".
- southern_cross 8y ago
  Don't forget, though, that the U.S. and North Korea are officially still at war, since no peace treaty was ever signed. So pin a cyber attack against a U.S. entity on N.K. and there you are!
rolph 8y ago
how can in insurance company declare a state of cyberwar, or any other war in general. I thought that was exclusively a government function. By extension could we deny coverage when a bunch of crackheads raid someones home, simply chalking one up to the war on drugs?
Maven911 8y ago
Similar to not relying on cyberinsurance when things go awry, the field as a whole is in an interesting shape where on one hand there is a dearth of skilled employees (1 million globally supposedly, according to reports), and on the other hand companies that do not want to train IT works with the necessary cybersecurity skillsets to fill the gap, and in turn rely less and less on the red herring of cyberinsurance. Talking to my colleagues who are looking to break in, even after taking training/seminars, which can be quite pricey, employers will tend to hire for junior roles at best.
nimbius 8y ago
its pretty spectacular what major insurance does not cover in the digital context. For example, I work as an automotive engine mechanic for a small chain of midwestern shops. Recently we had a Tesla owner drive in for servicing a recalled suspension control arm. We were approved to do the work by Tesla and had the parts shipped directly from California. once the work was completed, we informed the customer in the waiting room, who immediately took it upon himself to "auto-pilot" the car out of the garage while it was still on the lift. The car happily obliged, and backed itself off a lift six and a half feet to the ground in a pretty spectacular display. No one was hurt thankfully, however our shop insurance refused coverage for our damaged lift, and the Tesla owners auto insurance refused coverage as well because he was technically not driving the car at the time. The customer had to pay out of pocket for repairing his car, as well as our lift.
- w8vY7ER 8y ago
  auto-pilot requires the driver to be in the vehicle, i'm guessing this was the summon feature activated from their app? what a complete waste
  - Wowfunhappy 8y ago
    If this is what happened, it's not that stupid on the part of the customer. Or perhaps better phrased, it's within the realm of what I would expect some users to do given this feature. Tesla should have accounted for this.
    - coredumperror 8y ago
      That feature (Advanced Summon) isn't even out yet. Only a tiny fraction of beta testers have it, so it's unlikely that this idiot has the feature. Secondly, Tesla specifically states that you must have the car in line of sight before you enable Summon (which only goes straight forward and backward by 25 feet), so this guy is absolutely a complete moron for doing that.
      - 8y ago
DevX101 8y ago
There's massive room in the market for a security-first company that offers insurance as a guarantee. This company would essentially operate as the security team for clients and put in contractually enforced policies and follow through on implementation. If a client decides to not implement required security practices, then their policy immediately gets dropped. This is the only scalable way I'd see to implement real insurance against cyber-attacks.
- bitjson 8y ago
  Our startup is working on this problem, initially for the javascript ecosystem. We’re offering insurance against vulnerabilities in javascript dependencies: https://bitauth.com/ https://bitauth.com/ We have open source developer tooling for signing and verifying signatures of javascript packages, and we’re offering security as a service, backed by up to $1M in insurance coverage. We’re still in beta, but we’d love feedback from HN!
gcbw2 8y ago
Interestingly, this might be the solution for digital security. Get a nany state (Hello California) to force companies to have Insurance for Cyberattack. Insurance companies will learn instantly how to do due diligence for-real (as opposed of for compliance certification) to decide if they get clients or not. Companies then, forced to have insurance, will have to implement minimal safeguards to be accepted in the insurer policy requirements. Problem solved.
- j88439h84 8y ago
  If the business lost $100M as claimed, they may want to pay for cyber-attack insurance without being required to do so.

104 points by tysone 8y ago

If you are a large target many actors will be looking for your weaknesses. One bad actor will eventually find it, or just trick your employees to give them access. Companies should make a solid effort to prevent the possibility, but I'm torn on what ramifications should be.

burtonator 8y ago
> One bad actor will eventually find it, or just trick your employees to give them access. or do what the Russians do and use kompromat
- Something1234 8y ago
  What is "kompromat"?
  - ealexhudson 8y ago
    It's where you do your dirty laundry.
  - genmon 8y ago
    Blackmail
  - sk5t 8y ago
    It's leverage over an individual--whether that's secrets that might be released, financial problems, or whatever.
  - jldugger 8y ago
    Materials for compromising someone. Blackmail material.
  - neilv 8y ago
    If you want a great fictional interpretation (I don't know how accurate it is): https://en.wikipedia.org/wiki/The_Americans_(2013_TV_series) https://en.wikipedia.org/wiki/The_Americans_(2013_TV_series)
darkarmani 8y ago
> Companies should make a solid effort to prevent the possibility Isn't this what they do and then hedge the risk by covering their potential losses with insurance? If companies are not doing a good enough job with security, why does the cyber insurance not cost more? Priced properly, companies can choose between buying more coverage versus throwing more money at the "security problem."

burtonator 8y ago

It might actually be a good thing in the long term as insurance companies may require 3rd party audits and that you comply with basic security practices.

msla 8y ago
It might well kill the use of open source and small-company software in business, in that the developers/management behind said code can't pay insurance companies to say that their code will pass audit. Microsoft and Oracle will pass with flying colors, of course.
- bluejekyll 8y ago
  It could just as well lead to better support models for contributions to fix and audit open source. The open source model is benefiting too many businesses to just up and throw it out.
- jabart 8y ago
  Doubt it, there are a lot of PCI Compliant businesses that get audited with open source software in their systems. I'm sure they have a node_modules somewhere on their build server. When you have an attack that moves from your servers to your desktop computers, you have a network issue, which would be covered in an audit to verify you properly segment your network instead of having it in one large broadcast domain.
dontbenebby 8y ago
But do audits show compliance with basic security practices, or compliance with PCI DSS and other standards which may be orthogonal to security?
- wefarrell 8y ago
  In this case it would be the insurance company who requests the audit, so there would be incentives to ensure that the audits are meaningfully preventative.

krisrm 8y ago

This is messy. On one hand, how are insurers supposed to properly cost and be able to provide payouts for a "cyberattack", which might be anything from "our company website was DDoSed for 30 minutes and we lost 50 customers" to "our production lines were shut down and our company ground to a halt for two weeks"? On the other hand, if insurers know they can invoke a cyberwarfare clause and deny a claim, even if the attack may not have been state sponsored, the insurance is certainly worthless.

admax88q 8y ago
> On one hand, how are insurers supposed to properly cost... That's more or less the core competency of insurance providers...
- krisrm 8y ago
  Well, no argument there, but I wrote more words in that sentence that you cut off. My point is, that a "cyber attack" is poorly constrained, compared to something like a fire or a flood... a company only has so many assets, valued at $X that are liable to be burned to the ground or ruined by a flood, and these constraints can be modeled and adjusted for. Perhaps I am mistaken, I don't see a cyberattack as being analagous to anything else in the insurance industry.
  - resoluteteeth 8y ago
    If it's so hard to model then why are these insurance companies offering "cyberinsurance" in the first place?
  - rolph 8y ago
    perhaps riot or vandalism [acts of civil disobedience]
  - sandworm101 8y ago
    >> compared to something like a fire or a flood Those are not easy things. People litigate the difference between fire and flood damage all the time. (Putting out a fire normally involves lots of water.) Sometimes flooding in building X even causes a fire in building Y. Is that covered by "fire" or "flood" insurance? The difference between various cyber attacks isn't substantively more complicated than any of the traditional insured risks. The issue is that insurers haven't invested in the experts needed to properly assess those risks. That is their problem to solve, not the customer's.

tedmcory77 8y ago

Wow, this is huge. If cyber insurance doesn't cover cyber attacks, then what does it cover? Having seen the process for cyber insurance paying out for an intrusion, I'd be super concerned if I were a CSO/Chief Risk Officer and there's a chance the cyber insurance wouldn't cover you.

MiroF 8y ago
Seems a very odd strategy for cyber-insurance companies to take... If I were a large company insured by Zurich right now, I would definitely be reconsidering giving them my money.

DontGiveTwoFlux 8y ago

Most insurers require customers to limit their risk in all kinds of ways. I’m curious if there are cyber mitigation’s that are out there, such as mandatory two factor authentication, requiring up to date software and OSes or other measures. It seems like any insurance company would Be highly Interested in forcing these best practices.

blattimwind 8y ago
Mandatory snake oil
csours 8y ago
You can do 1,000 things right, but one thing wrong may still sink you. With cybersecurity, there is an active adversary. I'm not sure insurance ever wants to take on that kind of risk. If they don't want that risk they shouldn't sell insurance.
wvenable 8y ago
This particular attack wouldn't have been mitigated by any of that. This is why you also have insurance in addition to doing everything you can to prevent an attack.

dontbenebby 8y ago

Sounds like a big "out" is claiming an attack was an act of war. But very few nations declare war nowadays. They have "police actions" or "peacekeeping missions. Maybe telling these companies "no war was declared, so you must pay out" would be a good thing. Insurance companies are powerful lobbyists both in the traditional K street sense, and the soft power sense. (For the soft power sense, picture a major insurance company telling a nation state their state owned businesses can self insure moving forward, since the business cannot handle the risks they generate.)

OldHand2018 8y ago
> Maybe telling these companies "no war was declared, so you must pay out" would be a good thing. That goes against centuries of precedence. The only difference now is that it was "on the Internet".
southern_cross 8y ago
Don't forget, though, that the U.S. and North Korea are officially still at war, since no peace treaty was ever signed. So pin a cyber attack against a U.S. entity on N.K. and there you are!

rolph 8y ago

how can in insurance company declare a state of cyberwar, or any other war in general. I thought that was exclusively a government function. By extension could we deny coverage when a bunch of crackheads raid someones home, simply chalking one up to the war on drugs?

Maven911 8y ago

Similar to not relying on cyberinsurance when things go awry, the field as a whole is in an interesting shape where on one hand there is a dearth of skilled employees (1 million globally supposedly, according to reports), and on the other hand companies that do not want to train IT works with the necessary cybersecurity skillsets to fill the gap, and in turn rely less and less on the red herring of cyberinsurance. Talking to my colleagues who are looking to break in, even after taking training/seminars, which can be quite pricey, employers will tend to hire for junior roles at best.

nimbius 8y ago

its pretty spectacular what major insurance does not cover in the digital context. For example, I work as an automotive engine mechanic for a small chain of midwestern shops. Recently we had a Tesla owner drive in for servicing a recalled suspension control arm. We were approved to do the work by Tesla and had the parts shipped directly from California. once the work was completed, we informed the customer in the waiting room, who immediately took it upon himself to "auto-pilot" the car out of the garage while it was still on the lift. The car happily obliged, and backed itself off a lift six and a half feet to the ground in a pretty spectacular display. No one was hurt thankfully, however our shop insurance refused coverage for our damaged lift, and the Tesla owners auto insurance refused coverage as well because he was technically not driving the car at the time. The customer had to pay out of pocket for repairing his car, as well as our lift.

w8vY7ER 8y ago
auto-pilot requires the driver to be in the vehicle, i'm guessing this was the summon feature activated from their app? what a complete waste
- Wowfunhappy 8y ago
  If this is what happened, it's not that stupid on the part of the customer. Or perhaps better phrased, it's within the realm of what I would expect some users to do given this feature. Tesla should have accounted for this.
  - coredumperror 8y ago
    That feature (Advanced Summon) isn't even out yet. Only a tiny fraction of beta testers have it, so it's unlikely that this idiot has the feature. Secondly, Tesla specifically states that you must have the car in line of sight before you enable Summon (which only goes straight forward and backward by 25 feet), so this guy is absolutely a complete moron for doing that.
    - 8y ago

DevX101 8y ago

There's massive room in the market for a security-first company that offers insurance as a guarantee. This company would essentially operate as the security team for clients and put in contractually enforced policies and follow through on implementation. If a client decides to not implement required security practices, then their policy immediately gets dropped. This is the only scalable way I'd see to implement real insurance against cyber-attacks.

bitjson 8y ago
Our startup is working on this problem, initially for the javascript ecosystem. We’re offering insurance against vulnerabilities in javascript dependencies: https://bitauth.com/ https://bitauth.com/ We have open source developer tooling for signing and verifying signatures of javascript packages, and we’re offering security as a service, backed by up to $1M in insurance coverage. We’re still in beta, but we’d love feedback from HN!

gcbw2 8y ago

Interestingly, this might be the solution for digital security. Get a nany state (Hello California) to force companies to have Insurance for Cyberattack. Insurance companies will learn instantly how to do due diligence for-real (as opposed of for compliance certification) to decide if they get clients or not. Companies then, forced to have insurance, will have to implement minimal safeguards to be accepted in the insurer policy requirements. Problem solved.

j88439h84 8y ago
If the business lost $100M as claimed, they may want to pay for cyber-attack insurance without being required to do so.