4 ms·

I was tasked a couple of years ago with obtaining cyber insurance cover for my previous employer. Their business was an in-house B2B web application, used by hu

by jw1224 7y ago

I was tasked a couple of years ago with obtaining cyber insurance cover for my previous employer. Their business was an in-house B2B web application, used by hundreds of their staff, thousands of their customers, and hundreds of thousands of their customers' clients. I looked in to 5 different insurers — these were all major, internationally-recognised financial juggernauts — before abandoning the project entirely. Every single insurer based their quotation and assessed our risk on some variant of the following: https://i.imgur.com/3pB2LSa.png https://i.imgur.com/3pB2LSa.png I had to go back to each one and ask them: — How do they define a "record"? — How do they define "transmitting" a record? — How do they define "processing" a record? — Which forms of "encryption-at-rest" do you consider acceptable? — Which forms of "encryption-in-transit" do you consider acceptable? — None of our data is "stored" on mobile devices, but it is "accessed" through them — so what does this mean for mobile device encryption? — None of our data is "stored" on portal storage media as standard, but nothing would stop a user saving a screenshot to their USB stick — so what does this mean for portal storage media encryption? Not a single insurer had any clue what I was talking about.

rlpb 7y ago
You might be interested in https://en.wikipedia.org/wiki/Contra_proferentem https://en.wikipedia.org/wiki/Contra_proferentem If they drafted the contract and they are ambiguous, legal questions raised later that fall into the ambiguity will generally be resolved in your favor. As long as, for example, you use a generally accepted standard for "encryption-at-rest", you should be fine, legally speaking. (I am not a lawyer)
- unmole 7y ago
  From the Wikipedia link you posted: "The doctrine is not, however, directly applicable to situations where the language at issue is mandated by law, as is often the case with insurance contracts and bills of lading."
Scarblac 7y ago
Also if the data is always encrypted on user devices like mobiles, then what's the point of having it there at all. At some point the data needs to be decrypted to be used.
heavenlyblue 7y ago
To be fair to them, the questions you had are mainly about the minute legal definitions of the text they had written. Our industry is too young to have them defined that well. On the other hand I think the questions are generally quite concrete and tangent to each other so there’s some clarity to their line of thought. What makes it a bit funny is the fact that “most probably”, your business loosing your data today has got nothing to do with the fact whether you encrypted it or not at all.
- pjc50 7y ago
  The meta-question they were asking was, "in the event of certain common attacks, will you actually pay out? Or are these definitions constructed deliberately to exclude that?"

by jw1224 7y ago

rlpb 7y ago

You might be interested in https://en.wikipedia.org/wiki/Contra_proferentem https://en.wikipedia.org/wiki/Contra_proferentem If they drafted the contract and they are ambiguous, legal questions raised later that fall into the ambiguity will generally be resolved in your favor. As long as, for example, you use a generally accepted standard for "encryption-at-rest", you should be fine, legally speaking. (I am not a lawyer)

unmole 7y ago
From the Wikipedia link you posted: "The doctrine is not, however, directly applicable to situations where the language at issue is mandated by law, as is often the case with insurance contracts and bills of lading."

Scarblac 7y ago

Also if the data is always encrypted on user devices like mobiles, then what's the point of having it there at all. At some point the data needs to be decrypted to be used.

heavenlyblue 7y ago

To be fair to them, the questions you had are mainly about the minute legal definitions of the text they had written. Our industry is too young to have them defined that well. On the other hand I think the questions are generally quite concrete and tangent to each other so there’s some clarity to their line of thought. What makes it a bit funny is the fact that “most probably”, your business loosing your data today has got nothing to do with the fact whether you encrypted it or not at all.

pjc50 7y ago
The meta-question they were asking was, "in the event of certain common attacks, will you actually pay out? Or are these definitions constructed deliberately to exclude that?"