4 ms·

[secexec here with F500 company.] Over time every security executive learns that there’s only three important things in security: - How big is our cyber polic

[secexec here with F500 company.] Over time every security executive learns that there’s only three important things in security: - How big is our cyber policy? - How do we make sure the insurance company pays out? - Will our financial growth and policy offset the maximum potential losses if we decide not to roll out security tool X or patch Y? That’s really it. When growth and insurance won’t cover it then you’re plugging holes until the equation balances itself out. Everything else is theater. Doing anything other than the above ends your career...quickly.

someone3125 6y ago
So what do you think about the Garmin hack? How did their secexec fail? Did they not follow this model?
Kalium 6y ago
Naively, I would expect that an insurer is less likely to pay out if a basic pen-test suggests negligence on the part of the company.
- jollofricepeas 6y ago
  Sort of. Pentests are a joke - a compliance activity and nothing more. As the client I get to pick the vendor, determine scope and influence the criticality of findings in the final report. Insurers don’t care about anything until you have a breach and a claim. They look to see whether you have the controls mandated in the policy and... Whether your attacker used a nation-state toolkit if so then they don’t have to pay. Most cyber policies will not protect against “acts of god” or “acts of war” without paying top dollar and having a cap on damages.
  - user5994461 6y ago
    They will also look for gross negligence. The worm hit out-of-support Windows XP machines that the company couldn't bother to upgrade in the past 10 years. No compensation.
  - Kalium 6y ago
    > Whether your attacker used a nation-state toolkit if so then they don’t have to pay. Definitely seen that one. I'm curious as to why an insurer wouldn't look at a bottom-tier pen-test for signs of gross negligence. They'll readily turn up things like failing to have authentication on key file shares, no access controls on the network, or no MFA in use. The sort of stuff that's easily exploited and shows utter neglect on the part of the insured. Basically, it's been my experience that a tick-box pen-test exercise does a reasonable amount to check if the supposed controls are actually there.
    - jollofricepeas 6y ago
      Definitely agree. I just haven’t seen them (insurers) kick off an audit pro-actively without there being a breach. I’m sure insurers understand that if they are proactive in auditing then a company will stay vigilant and probably patch all those old systems.
nogbit 6y ago
Some companies care about their brand and how a breach can negatively impact that, add this to your list and now you have four things.

someone3125 6y ago

So what do you think about the Garmin hack? How did their secexec fail? Did they not follow this model?

Kalium 6y ago

Naively, I would expect that an insurer is less likely to pay out if a basic pen-test suggests negligence on the part of the company.

jollofricepeas 6y ago
Sort of. Pentests are a joke - a compliance activity and nothing more. As the client I get to pick the vendor, determine scope and influence the criticality of findings in the final report. Insurers don’t care about anything until you have a breach and a claim. They look to see whether you have the controls mandated in the policy and... Whether your attacker used a nation-state toolkit if so then they don’t have to pay. Most cyber policies will not protect against “acts of god” or “acts of war” without paying top dollar and having a cap on damages.
- user5994461 6y ago
  They will also look for gross negligence. The worm hit out-of-support Windows XP machines that the company couldn't bother to upgrade in the past 10 years. No compensation.
- Kalium 6y ago
  > Whether your attacker used a nation-state toolkit if so then they don’t have to pay. Definitely seen that one. I'm curious as to why an insurer wouldn't look at a bottom-tier pen-test for signs of gross negligence. They'll readily turn up things like failing to have authentication on key file shares, no access controls on the network, or no MFA in use. The sort of stuff that's easily exploited and shows utter neglect on the part of the insured. Basically, it's been my experience that a tick-box pen-test exercise does a reasonable amount to check if the supposed controls are actually there.
  - jollofricepeas 6y ago
    Definitely agree. I just haven’t seen them (insurers) kick off an audit pro-actively without there being a breach. I’m sure insurers understand that if they are proactive in auditing then a company will stay vigilant and probably patch all those old systems.

nogbit 6y ago

Some companies care about their brand and how a breach can negatively impact that, add this to your list and now you have four things.