3 ms·
> Over the last few years insurers have aggressively been adding "no vulnerability patch, no claim" exclusion clauses. If you take an even closer look- what ex
by dns_snek 2mo ago
> Over the last few years insurers have aggressively been adding "no vulnerability patch, no claim" exclusion clauses.
If you take an even closer look- what exactly does that mean?
It should stipulate patching real vulnerabilities in your system and not "all CVEs in all dependencies irrespective of their usage or applicability to your system", that's madness. It's like voiding your health insurance policy because a smoker moved in across the street.
Most vulnerabilities in your dependencies don't become vulnerabilities in your system, and most vulnerabilities in your system (probably) don't originate from your dependencies.
- traceroute66 2mo ago> If you take an even closer look- what exactly does that mean? Here is one example: "Critical Vulnerability Exclusion We will not pay you under the cyber and data risks section of cover where your legal liability or any loss that you suffer arises from a cyber attack that exploits a critical vulnerability within your computer equipment. However this exclusion will only apply where a patch or fix for any critical vulnerability exploited has been available for 21 days prior to the date of the incident and has not been applied to your computer equipment. Critical Vulnerability means a common vulnerability and exposure (CVE) in the National Vulnerability Database operated by the National Institute of Standards and Technology which has a score of 8.0 or higher on the Common Vulnerability Scoring System (CVSS)"
- dns_snek 2mo agoThanks, this seems to confirm my train of thought. To lose coverage the attack had to exploit that particular vulnerability and a patch had to have been available for over 3 weeks. A false CVE can't be exploited so you can't lose coverage by not patching it (even if a purported patch existed).