[Music]
all right welcome uh my name is Walt
Powell my title is a lead field ciso so
I am a recovering ceso who now uh talks
to other cesos about kind of high level
strategic and risk topics and uh helps
them be better seos when I can I lead a
team of guys just like myself and uh as
part of our mission we're constantly
trying to put together information and
write white papers and whatnot and I
started writing a white paper uh about
the Cyber Insurance space and
inadvertently stumbled across a a
framework basically a how to procure
cyber Insurance framework um that
evidently didn't exist before so I
wasn't set out to uh create a framework
for how to
procure cyber Insurance it just kind of
happened so what we're going to do
tonight um Sorry you drew the Short
Straw that is wonky sea level cyber
Insurance talks at 8:00 at night on a
Thursday we'll see if we can keep you
awake I'm not going to guarantee
anything because it's cyber Insurance
I'll do what I can so uh we'll take a
look at the space that is cyber
Insurance we'll talk about the problem a
little bit but if you're here you
probably know what the problem is we'll
dig a little bit into the things that
you can do to address it and we'll get
into some of the nuts and bolts and
we'll dig kind of deep into some of the
uh things that you will find inside of
policies and uh some of the GES around
uh some of the different uh things that
are going on around exceptions and
language and terms and stuff like that
so real real exciting stuff um so yeah
we're going to take a look at that
framework we're going to take a look at
uh how you can leverage uh Insurance to
buy down risk and use it for risk
transfer prop
uh uh reasons and and uh looking at it
from a risk lens as a way to buy down
your risk um we'll take a look at uh the
application process some of the policy
language we'll take a look at uh what
you can do to kind of drive down some of
your uh premiums a little bit because
that's one of the things that people
really care about and then ultimately
what we're trying to do is uh get to the
point where we can talk about that
making sure that you're getting what you
pay for and that your claims ready so if
the bad thing happens and your hair is
on fire that uh you are prepared to use
this so that you are getting away paid
for right so there are a few things that
are going on here historically right so
the Cyber Insurance Market has kind of
been in a rough spot and I have people
come up to me all the time and they say
hey in 2023 is it smart for me to even
get Cyber insurance is cyber insurance
going to continue to be a thing is this
Market going to fall on its face and I
don't know 60 days ago I might have
given you a different story than I'm
going to tell you now um I I'm hopeful
or more hopeful at least about the Cyber
Insurance Market than I was 60 days ago
so there are kind of a few things that
happened so when they started offering
cyber insurance they started offering it
for the kind of obvious stuff right like
hey this is breach insurance they didn't
really have enough risk information they
didn't have the Actuarial Table
information to understand the risk they
were just cutting policies because they
thought there was good money in it kind
of at the same time the Cyber threat
World got stupid so in 2017 we had not
pet you which looked like Grant
somewhere but was not decryptable and it
got out and uh caused a lot of damage
like major in the billions of dollar
damage to folks like mandes the Oreo
cookie people and the shipping magnets
and whatnot who then filed claims not
just on their cyber policies but on
their dno policies and on their property
policies and stuff and it really created
a problem for the insurers and we'll dig
into that more a little bit um and on
top of that following right behind that
we started to see the shift toward the
kind of new multi extortion ransomware
where that we see today right that we
steal your data before we encrypt your
data so we can Ransom you on multiple
fronts and it's everywhere and it's all
the time and that they weren't prepared
for either and created a situation where
there wasn't enough money in the market
to sustain the outlays that they were
paying right um however a few things
have happened so we've gotten to the
point where they're starting to have
enough data that they have enough risk
information now that they're starting to
be able to understand what their risk is
and they're starting to be able to write
policies
appropriately and just recently in that
National strategy that the Old
Government put out right uh there was a
bunch of stuff in here about they're
going to put back stops in place and
they're intending as part of the
national strategy to back stop cyber
Insurance however it's a little bit
weird the way that they've done it and
we'll talk about that more when we talk
about terrorism exclusions and stuff
like that um because they haven't been
very clear about how they're going to
back stop it but it feels to me more
like there's a good chance that this is
going to continue to be a market going
forward but maybe not for everybody and
maybe not for everything I think we've
seen the high Watermark of all the
things that will be covered so they've
gone kind of crazy with we're going to
cover absolutely every type of harm I
think you're going to see a reduction in
that they've also gone crazy with we're
going to cover everybody who wants it
and I think you're going to see a little
shrink there too and some of that's
going to happen naturally through
attrition and as we talk about the
application and the things that they
make you go through to get the policies
and the crazy application you have to
fill out like some of that's going to
fall off because you're not going to be
able to meet the standard and it's not
going to become uh it's not going to
make Financial sense for you to do this
and so you're going to fall off on your
own so I have a sneaking suspicion that
going forward into the future we're
going to see that the policies kind of
focus more on the big players who are
building towers and maybe is not such an
SMB play how however there are some
players who are focused in that space so
maybe we'll see that Shore up a little
bit um so they've been trying to figure
out what are the things that we can do
to reduce our risk um and a lot of the
really meanor things that they were
doing early on like subl limits and all
these things have actually kind of
fallen off a little bit um on the flip
side it's been difficult for folks to
buy cyber insurance so not only has it
been difficult for the Cyber insurance
insurers to provide cyber Insurance part
of the problem with the market is it's
been difficult for organizations to get
Cyber insurance so only uh 19% of
organizations have coverage over
$600,000 today and the average claim in
2021 was $900,000 so there's a
$300,000 gap for almost every
organization and you would think that is
probably because of cost cost tradeoffs
it does it make Financial sense to uh
transfer out these risks but that
doesn't seem to be the case at all um
pretty much all of these studies in this
particular study came from deoe uh says
that the big drivers for why folks don't
have cyber Insurance are uh they don't
understand the coverages they don't
understand the policies they don't
understand the application process they
don't understand why they need it they
don't understand their risks or the big
buckets of things that this fall into
and so one of the big reasons that we
don't have better coverage is because
folks struggle to
understand how to align the
coverages
so that's the problem kind of in a
nutshell right like i' said early on
people said hey should I continue to get
Cyber Insurance in 2023 and I said my
answer has changed my answer is still
yes so it continues to be one of the
best ways that you can buy down risk in
2023 if you take a look at your cyber
problem as a pure dollars and cents risk
problem and say you have a I don't
know x million doll exposure to risk and
you want to buy it down a certain amount
right your policy is $2 million $3
million $5 million whatever your policy
is right you're buying down your risk by
that $5 million for whatever your
premium is premiums I don't know even at
a crazy amount it's $100,000 it's
$200,000 would be a crazy premium for
that type of coverage what else could
you go buy is there any other vendor in
this hallway that you could go spend
$200,000 on and reduce your risk by $5
million and the answer is no like
there's not an amount of crowd strike or
Palo Alto you can go buy at that price
point that would reduce your risk that
amount so it continues to be a really
good investment and when I hear people
say like hey the prices have gotten out
of control really the prices have gotten
about right they used to be wildly
underpriced and we got used to that and
now when people say hey my premiums have
doubled and tripled they have but
they're
about right now whereas they were crazy
underpriced and we were getting insane
deals before um two and three years ago
I were see I was seeing people get uh5
And1 million policies for like $112,000
a year and that's an insanely low amount
of money for what we know the actual
risk is now people got spoiled on that a
little bit so yes I continue to think
that it's a smart thing to do however
there is a breakover point where it does
and doesn't make sense when you look at
it from that risk point of view so if
you're looking at it from that risk
point of view you have to figure out
does this investment make sense for me
does it make sense for me to take that
premium money and stick it in that kind
of risk reduction through cyber
insurance or does it make better sense
for me to take that same money and stick
it in controls or stick it in something
else to reduce my risk and that calculus
is different for everybody so you would
think that it might skew to the lower
end for who that would make more sense
for but like recently JP Morgan Chase
decided they're not paying for cyber
insurance anymore that they could better
spend their money on their own controls
they no longer pay for cyber insurance
they spend that money on other stuff
however they're JP Morgan Chase and they
have giant inhouse every kind of thing
you can ever imagine their own in-house
forensics and malware reverse and
investigations and you name it right so
they can do a lot of things that other
folks can't do they can also do a lot of
self-insurance they can also do a lot of
uh like Capital restructuring and
holding they can build their own
captives they can a bunch of stuff
because they're a financial organization
that a lot of people can't do but you
can make those same kind of calculus and
so as we look through like the framework
that I said I inadvertently made a
framework the framework is four parts so
the first part is that Discovery part
right understanding yourself
understanding what your risks are
understanding what your coverage needs
are understanding what your cage current
coverages are understanding what your
current situation is from a controls
point of view right we'll talk about
that a little bit more um the second
part then is I need to fill out the
application I need to take that
information from phase one and plug it
into the application and tell it to the
insurer in a way that tells the story
that I want to tell to drive down my
premiums to help my insurer understand
what the risk is because my insurer has
a tendency to ask the wrong questions
and I can help them by giving them the
answer they actually want but also I
need to be careful not to lie to them
because there's a trap right now where
it's very very easy for you to
inadvertently lie to them and give them
a reason to deny you later
uh then stage three is they're going to
give you a policy full of legali that
you don't understand and it is very easy
for you to sign on the dotted line to a
policy that is full of terms and
conditions and exclusions that undermine
the reason that you thought you were
buying Insurance in the first place that
are the key things that you thought you
were getting and you potentially didn't
realize were excluded or were not part
of your terms or did not cover the thing
you thought was covered and then the
last part is how do you make sure that
whatever is in the policy is the thing
you're doing so often when I talk to
cesos and whatnot and we're talking
about building their incident response
plans or the formal incident response
plans or whatever and I say have you
looked at your cyber policy what does
your cyber policy say you need to do
have we lined it up to your incident
response plan the answer is almost
always no I've never even bothered to
read the policy of course we didn't line
it up the plan well we got to be doing
the thing that the policy says so that
we get paid right so we'll talk through
that a little bit too so those are the
four phases so in Phase One often times
people in Phase One think like bit site
and they start and end there right like
I'm going to go out I'm going to look at
some external score monitoring folks and
that's a great place to start there's
nothing wrong with looking at your bit
site score or your uh security scorecard
or whoever it is you like and um some of
the different insurers have started to
build their own version of this and
getting an external view of you and your
score is a very good and smart thing to
do um the same way that you would go
check your own credit score before you
made a major house house purchase or
whatever and you would clean up your
credit before you went and applied for a
mortgage you should be doing the same
thing here you should be understanding
what your external view looks like and
you should be cleaning that up in
advance of going out and asking for the
policy however that's not the only thing
you should be doing and taking that
outside in look
is the thing we're always talking about
is hey we should be taking an inside out
look first right we need to understand
our risk and why we're doing this and
what we're trying to accomplish because
a the Cyber insur really wants to know
what our risk is we also want to know
what our risk is so we know that we're
doing the right thing and we're making
the right choices so this outside in
look is a great starting point but it is
not the end point right um also it's
very uh chucked full of I don't know
false positives and junk so it is very
common that you'll go out to the bit
site site and it'll just be full of just
like stupid crap you have to negotiate
away right and you're just talking you
call bit site and be like this is dumb
make this go away this is real you can
spin off parts of your business to make
it look better you can do all kinds of
stuff you'll find that bit site says one
thing and security scorecard says
something different and you got to get
them to Jive and you spend a bunch of
time trying to get all that worked out
also in this phase we should be looking
at the main controls that they're going
to ask for and they're going to ask for
a baseline of stuff Unfortunately they
have not gotten together into a like
real formal like hey this is the formal
bunch of stuff because it's a very
competitive industry and like
understanding risk and driving down risk
is the competitive Advantage so there's
not a formal framework for this yet but
there's stuff we know they're going to
want you to have they're going to want
you to have MFA they're going to want
you to have EDR they're going to want
you and this year's big thing has been
uh privileged access management and they
just say that like it's no big deal like
why don't you run out and get some
privilege access management real quick
during this procurement cycle like you
can just go do that in this next three
months like it doesn't take three years
to do or something right so that's been
the hot one we'll talk about that some
more in a minute um but if you know for
sure like hey I don't have the basics I
have no MFA I have no email Gateway I
have no like if you don't have the
basics there is no point in jumping
through the rest of these hoops do these
things first unless and the exception to
this would be for whatever reason you
can't get Budget Buy in and you need the
insurer telling you you have to do this
as the reason to get someone to give you
money to do these things if that's you
come back to my talk at 10 and I will
tell you how to make that not be you and
I'll teach you how to get real money
instead of having to get like fear money
but if that's the case for you and you
need fear money then jump through the
hoops and get your fear money or
whatever but for the most part do these
things first if you don't have these
things don't keep going it's a waste of
your time it's a waste of your money
it's a hassle like you know you're going
to have to do this and what's going to
end up happening is once you get through
the uh application process they're going
to want you to do it in a hurry to get
you underwriting and a lot of these
things take a long time right and you're
going to want a longer Runway and then
you're going to have to negotiate poems
and stuff and it's a whole thing
so um as you're figuring this out you
want to not just do the external stuff
you don't want to just look at your
controls you actually want to look at
your risk and start to try and
understand what your actual risk is and
this is a thing that used to be really
hard so when I talk to folks about hey
we should be doing risk quantification a
lot of the time people go oh my God risk
quantification is hard we tried that I
read Doug hubard how to measure
everything book and I don't have a PhD
in statistics or we tried fair and oh my
God like I don't have a guy who can
break down all the stats right um it
doesn't have to be like that anymore
like folks have productized this there
are companies cover with uh K2 vs and
two RS uh X analytics there are several
companies who have
productized uh risk quantification and
it's simple and cheap and easy now and I
can actually tie doar amounts to my risk
and all I have to do is basically a like
a critical 18 or an ssf and if you're
already doing that you can tie dollars
to it very very simply so it's not like
the old days where we had to go jump
through a bunch of fair Hoops to pull
off
quantification so we need to do some
quantification figure out what our money
is um so we can figure out what our
exposure is so we can figure out how
much coverage we want this this part
you're going to work with your CFO
you're going to work with your broker
and they're going to help you figure
this out you're going to have other
policies you're going to have other
types of coverage you're going to have
other ways that you can spend your money
right um your CFO is going to have other
goals potentially we talked about the JP
Morgan Chase model where like you can
set aside capital and New Capital
withholding you can do Self Insurance
you can insure through bonds you can set
up a captive where you insure yourself
and set up a company that insures you
that you pay into you can do any number
of things also nowadays like let's say
you need to get to I don't know $50
million worth of coverage no one
provider is going to give you $50
million worth of coverage you're going
to need three or four policies they're
going to have to build you a tower um
I've yet to see anybody get to a billion
dollars the biggest one I've seen so far
is $600 million but that's an enormous
Tower it takes a ton of providers it's a
whole thing you're going to need your
broker to kind of hold your hand through
this however I keep seeing people fall
into the Trap that is thinking your
insurance provider and your broker are
your friend and your insurance Pro
provider and your broker are not your
friend broker is in the business of
earning commissions and insurance
company is the same insurance company
they are when that's your car insurance
or your house insurance or anything else
and we'll talk about that more later
right like they're an insurance company
their job is not to pay you or be your
homeboy their job is to collect your
premium and not pay you out because
that's how they make money right because
it's an insurance company so we do need
to work with our Brokers we do need to
help have them help us figure out this
Tower we do need to be talking to our
CFOs to figure this out but we also have
to remember that broker is not
necessarily always your best friend in
this scenario so um there are pretty
much only a handful of companies that
are the main companies that are the
actual providers so there are a ton of
Brokers and a ton of subs and people who
kind of rewrite and reinsure and all
this kind of stuff but for the most part
the players have been the same for a
while um chub was the number one for a
long long time but they've actually
fallen down and they're no longer the
number one um his Cox uh has taken on a
lot of kind of SMB and so they moved
into the number one spot mostly I think
through quantity um axxl is really great
for like if you were a tech company who
has heavy Tech they like really
understand the like hard to understand
Tech stuff um CNA seems to be really
well balanced uh Beasley's been a big
player for a long time um there's
nothing wrong with any of these folks
but those are kind of the the big names
right consequently they're each kind of
have their own application situation and
we'll talk about applications a little
bit more here in a minute oh this minute
evidently um so when uh when you start
to figure out like hey it's time for me
to apply you're going to reach out to
your broker your broker's going to send
you the application the application is
going to depend on the provider right
the provider's going to send you back an
application it used to be they were like
four or five questions now they're like
four or five pages of questions the
questions have a tendency to be very
specific and detailed often times I
folks come to me and say we don't even
know how to interpret these questions
and there is nothing wrong with engaging
a third party to help you with the
interpretation of these questions um you
will be tempted to go back to your
broker and ask your broker to help you
interpret they're not qualified to help
you interpret because they don't
understand the security jargon any
better than you do your insurance
provider has no motivation really to
help you figure out these questions and
so they don't do a very good job of it
so really you want to be reaching out to
like whoever is the same folks that help
you with your cyber security program
right your your presidios optiv wwt cdws
Etc right um to help you try and figure
this out and you should have gotten the
answers in phase one and we should just
be applying them here in phase two if we
didn't have the answers in phase one and
you get here and you realize I don't
know the answers then you failed and you
need to go back to phase one and figure
out should I even be filling out this
app so the other thing is they're going
to send it to you in a form that seems
very yes and no like they're going to
send it to you in a form that like
there's a space they'll ask you some
question like do you have MFA all of the
places and they'll be spot for like a
yes or a no well if you say yes you're
lying because you don't have it all of
the places and all of the use cases
nobody does that's impossible and if you
say no then they're going to dock you
and not want to give you underwriting
right so the answer is some gray area in
between that you have to notate so there
is nothing wrong with not playing by
those rules cut and paste their
questionnaire out of their form and put
it in into a Word document and write the
whole story all of the details all of
the granularity everything you would
want to tell them put it in there
because what they want to understand is
your risk and the better you can
articulate it the happier they're going
to be so back in that first phase where
I said if you can understand your risk
and you can quantify your own risk and
you can say I understand my risk to I
don't know data exfiltration through
crime Weare is $34 million and I have X
controls that buy that down and I intend
to buy down the risk of that through
insurance by $7 million or whatever like
they love that story they eat that story
up because that's what they're trying to
figure out and that's what they're
trying to figure out from you they don't
know how to ask that story they only
know how to ask like do you have Pam do
you have a firewall and so they're kind
of asking the wrong questions because
they don't know how to ask the right
questions and you don't know how to
answer the right question for the most
part but if you can tell that story you
can kind of shortcut the whole problem
right so take their form put it in your
own Word document answer it the way you
want to answer it make sure you're
telling the truth other thing that
happens here is when you don't tell the
100% truth you're giving them a reason
to deny your claim when the bad thing
happens and this has been happening more
and more and more um I saw recently a
statistic and then I couldn't find it
again um it was somewhere in the
neighborhood of like almost one in four
claims in the last year were denied
based on
your answers didn't jive with your
application I tried to find it again
because I saw it and then I didn't
capture it and I couldn't find it and
I've been trying to find exactly where
that Source came from but um that number
is shocking to me and if that's anywhere
near true so um we need to make sure
that we are telling the truth so we're
not giving them a reason to deny us
because what's going to happen is the
bad thing's going to happen you're going
to do an forensic investigation the
forensic investigator is going to say
here's how the bad guy got in here's
what happened here was the kill chain
here was the chain of events and they're
going to go back and they're going to
look at your app and say well how did
that happen you said you have XYZ
controls that shouldn't have happened
and now you're left holding in the bag
and they don't want to pay
you
um after you do the application thing
they're going to come back at you and
there's going to be a negotiation that
happens here a lot of the time this is
when people pick up the phone and call
me and say hey the insurer called me and
told me I have to have XYZ to get
underwriting now the idea that they have
Mand to you that you have to have XYZ
already is not entirely correct they
have requested as part of a contract
negotiation that you do these things to
execute this contract you have options
here right like you have several options
here the first one being do the ma Roi
math to make sure that this even still
makes sense because just because the
math made sense initially that I was
going to pay x amount of Premium to buy
down my Risk by x amount of dollars and
that made sense
as soon as I throw in like well they
came back at me and told me I needed to
install privilege access management and
now I go do the math and I have to
install cyber Arc and cyber Arc is going
to be a million dollars and then a
million dollars to install and a million
dollars to run for the next three years
will do that extra $3 million change the
calculus well hell yeah it changes the
calculus does this still make sense at
all well maybe not right so what happens
a lot of the time is we feel pot
committed we already got this far into
the process they're telling us we have
to do it so now we have to go do it well
not necessarily the first thing we have
to do is figure out does this still make
sense we can tell them to kick rocks the
second thing we can do is not
necessarily decide yes no right away we
can tell them okay hey what you've asked
for is privilege access management
that's a lot that's like a three-year
project we need underwriting in the next
90 days here's our plan here's who we're
working with here's how we're executing
this here's our poem for how we're going
to get from point A to point B and A lot
of times that will get you where you
need to go and maybe even a negotiation
where it's like okay well then in year
one we'll do such and such and when you
can prove in year two that you hit X
Milestone we'll reduce your premium or
whatever right um will happen sometimes
um so when they come to you and say hey
they've told me I have to do all these
things what they've really told you is
hey we have a negotiation to be had
about understanding your risk and your
risk posture and fixing your R posture
in advance of giving you underwriting so
part of the question also then is how
good of a job did you do when you were
filling out your application telling
your risk story and do we you need to
retell your risk story better to paint
the picture that is is $3 million worth
of Pam really going to fix my risk
posture any and that's another story you
can go back to them too like hey if you
really understand and you've done the
risk quantification and you own a thing
like X analytics it's very easy to model
and go back and be like look you're
asking me to put in a $3 million control
that's going to buy down this risk to
this particular problem you're worried
about by this amount this control would
buy it down by this amount wouldn't we
rather do that and they'll be like heck
yeah thank you for understanding that
and they'll get on board right
[Music]
um phase three so what happens next is
they're going to send you a policy
you're going to get this quote you're
going to get this policy and it's a big
legal contract full of crazy legal terms
um and you got to read through it and
you got to parse it and it's kind of a
nightmare so there's a bunch of stuff in
here what we're going to find is a list
of all the coverages the kinds of
coverages the harms that are covered
what are things are covered what things
aren't what things are covered at what
level um what are the terms so when are
things covered and when are things not
covered um what are the exclusions um
and then what is the process if I want
to fill out a claim um and then
sometimes there's some extras and stuff
we'll talk about so the first thing is
what are the harms what stuff is covered
and we talked kind of at the beginning I
said I think we've hit the kind of high
Watermark of what things will and won't
be covered um in the early days cyber
insurance was like breach Insurance well
now it's all kinds of stuff there's all
kinds of harms that can be covered in
here outages are covered outages for uh
malicious reasons but also for just
accidental reasons your outages your
provider's outages you'll find uh fraud
stuff in here somebody tricked your uh
CFO into cutting a PO to somebody uh
you'll find all that kind of stuff in
here too you'll find uh social
engineering things in here fines for PCI
all kinds of stuff you'll find in here
um and what things are covered depends
on your policy also you will find that
sometimes they have different what are
known as sublimit which we'll talk about
in a minute so like just because all
these things are covered doesn't
necessarily mean they're all covered to
the same amount so you got first party
coverages and you got third party
coverages so first part party coverages
are the things that cover the direct
your direct costs if the bad thing
happens to you and you have to pay the
direct cost of it third party coverages
cover like things associated with like
damages legal claims stuff that you
would pay to other people if you got
like sued behind
it then you're going to find next to all
of your coverages all these other things
so the first thing is supplement so
let's say you have a 3 million doll
policy not all of your stuff is
necessarily covered to $3 million you
might have some stuff that's only
covered to $250,000 so you got a $3
million policy but maybe fraud is only
covered to
$250,000 or maybe some other thing has
some other reduced subl liit and you
have to look and see hey what things are
covered to what so in this particular
one uh PCI costs are C 50 brand uh
there's not a lot of other retention is
the same thing it's deductible um and
this happens in a couple different ways
sometimes these deductibles are one
deductible per claim sometimes they're
one per harm right so like in this
scenario that's could be potentially a
big difference because if you look at
this and say like hey we had a
ransomware event and it was a breach
with extortion that created data loss
and business Interruption right do I pay
a $10,000 deductible or do I pay a
$10,000 deductible five times that's a
big difference right um so we got to
figured that out too the other thing
that you'll find in here is for outages
there's this thing called waiting period
and period is how long do you have to be
out before they will pay you so if you
are down if they the ransomware people
knocked your network out or you
accidentally knocked your network out uh
eight hour waiting period means you have
to be down eight hours before you can
even start filing a claim so a work day
sometimes this is 12 hours sometimes
this is 24 hours so what are most of
your outages for most people most of
your outages are less than 8 12 24 hours
for sure right so most of your outages
probably aren't even covered you have to
be out for two days days or whatever
before you can even start filing a claim
so as you're trying trying to figure out
like hey does this policy fit my needs
well is this one of the things you're
worried about and what is the Bia of you
being down and how long can you be down
before this is a problem and what do you
really need for coverage is a
conversation that you need to have right
um also all in these terms are like when
does your coverage kick in and not so
there's this idea like hey it takes a
long time to find a breach so the breach
that you found today maybe happened a
year ago two years ago three years ago
did you have this policy a year ago two
years ago three years ago did you have
some other policy so um the idea that uh
there's a retroactive date or full prior
Act is the stuff that happened before is
it covered if it's covered is it covered
back to what date so full prior acts
would be everything that happened before
we're covering it then on the other end
of that there is once you stop paying
this policy what happens if you find
stuff that happened during this policy
there's an extension period usually you
can pay them some multiple of your
premium to get it extended in case the
next policy doesn't have full prior act
coverage or whatever um also you'll find
in here um duty to defend do they have
to defend you in court or do they have
to reimburse you for defense in court
we'll talk about that more here in
exclusions when we talk about making
sure that your coverage so that you
don't get uh Joe Sullivan from uh Uber
um also m&a coverage what happens if you
buy another company or another company
buys you you go out and buy another
company does your coverage carry over
right um the exclusions there's a bunch
of stuff to know in exclusions here so
um terrorism is not such a big deal one
every policy has a terrorism exclusion
for the most part um we know that's
going to happen and terrorists are not a
big threat
actor um we we don't have to worry about
Al-Qaeda hacking us really we have to
worry about the big like uh North Korea
Iran Russia China right um which will
fall more under acts of War so also we
have uh Tia which is the terrorism risk
uh Insurance act or something that says
basically we will back if like a
terrorist act happens you're backed
right even if your insurance isn't going
to cover it you would be backed however
the government's never really come out
and explicitly said like what would that
look like and what would be considered a
terrorist act and how much would they
cover you because they don't want to so
at the same time it leaves the insurers
being like hey it doesn't kind of leaves
us in a position where we don't know
what's going to happen but for the most
part if some terrible terrorist thing
happened you'd probably be covered even
though it's excluded from your uh
insurance on the flip side though acts
of war is a huge problem right now and
I'm going to tell you about a terrible
problem that I don't have any solution
for and I'm just going to tell you it's
terrible and scare you and then not give
you any solution sorry so uh back in
2017 we talked about the whole not pet
you Russia attacked Ukraine they
attacked their accounting software with
this thing that looked like ransomware
but it wasn't ransomware and it got out
and it got all these places and it hurt
all these businesses right so
they tried to file
claims against their insurers for these
damages to the tune of billions of
dollars the insurers were like whoa whoa
whoa no no no this was Russia attacked
the Ukraine that's obviously an active
War we have active War exclusions we're
not paying you for that so then ended up
in court Court's like well there's a few
things here is that an act of War there
was no like War like declared at the
time like is it is it not does Cyber
count as active War who knows they kind
of got around having to answer that
question because of the way that they
filed against the policies and there was
no cyber inside of the property policy
that they ended up filing against so
they ended up kind of winning a
settlement based on that but if that
were to happen again today all that's
fixed all the language is fixed they
would not win today and all that's stuff
is still going on today Russia Ukraine
happening again today war is actually
declared there is actually kinetic War
happening today all the same stuff they
are using like wipers that appear to uh
not be wipers they are using wipers that
are wormable so that dare but by the
grace of God go we that some wipable
wiper worm has not escaped and done the
same thing at which point it really
would be an act of War because War has
been declared you really wouldn't be
covered because everybody's got it baked
into their policy now behind the model
these cases so you would really be left
holding the bag and there's no tier of
back stop for that so like we could all
be in a real world of crap if that
happened which could happen tomorrow so
that's me telling you I don't know
what's happening like all of insurance
could go terrible all of corporate
America could really take a terrible
terrible hit who freaking knows this is
kind of sort of addressed in the
National strategy but not really so who
knows what they're going to do about
that
um other things to note in here in
exclusions uh breach of contract so
frequently you'll find an exclusion that
says like we're not going to cover your
cost for breach of contract but a lot of
the time you will have written into your
contracts uh that it would be a material
breach for you to disclose their data or
whatever if you have that in your
contracts that can be a real problem you
got to make sure that whatever you have
written in your contracts about like
data disclosures jives with whatever you
put in your policy that is a very easy
thing to fix if you knew to look for it
in advance it's also a very big problem
if you forgot to look for it in advance
um physical destruction is usually also
not covered in cyber it's usually
covered under property however with like
ransomware and tax OT and stuff now
there's a discussion you need to have
with your broker and with your CFO and
stuff about like hey do we want this
stuff covered under property do we want
it covered under cyber like especially
if you're like a manufacturer or a
healthc care or somebody who has like
massive OT infrastructure especially if
I was a healthcare where like The
ponymon Institute just this year for the
first time officially said out loud
ransomware is actually killing human
beings and nobody had ever said that out
loud before so like I would be real
worried about that kind of thing and be
like okay where does that fall like it
seems very callous for me to say like
where does the death of human beings
from ransomware fall in an insurance
point of view but like as a sister you
gotta worry about those kind of things
um and then the last one is Officer
liability So to avoid being Joe Sullivan
you need to be on the policy and this
has been a real kind of deal with Rec
for folks um officer exclusions are very
common uh dno usually is a separate
policy that you need to be on you need
to be named both named and positionally
so positionally says like you are
covered as the ceso but named says you
are covered by name Walt Powell even
after you leave and that was what joose
suan did not have so they had no duty to
defend he had nothing now he also had
criminal that would have helped him all
for the criminal side but at least for
the Civil side had he had been named
they' had a duty to defend he'd had like
lawyers from the insurance company and
he probably fared a whole lot better um
so you got to make sure like if you're
going to
sit yeah and probably in your dno policy
and it's a conversation you for sure
need to be having at least um hey are we
covered where are we covered how are we
covered um especially like SEC rules are
coming out and so so
far k Mark challenges and I'm not going
to get I'll get into that a little more
in the next talk if you want to get real
wonky on like law and junk but like
carart challenges have been a thing you
haven't really been able to get across
the Finish Line That's that I have a
duty to shareholders and that Duty
extends to cyber but like partly because
it's not against the law like once this
SEC thing gets across the Finish Line
like that's going to change the playing
field a little bit and the way that they
keep like the new McDonald's lawsuit
that now says like officers have the
same responsibility as board members as
far as like duty of care and stuff
like if I was still sitting in a CN
named seat I would be real anxious about
all those things and I would want to
make sure that my name was on
the
um we got to know how they want us to
file a claim so this is going to be as
we're figuring out the contract it's
going to have a bunch of information
about like how do we want to file the
claim and This falls into two buckets
sometimes people want this and some
sometimes people need to think through
it so when I talk to people and they say
hey part of the reason I'm buying cyber
insurance is because I'm want them to
lead the charge for me if the bad thing
happens I want them to be my incident
response I want to be able to call their
hotline and have them give me a forensic
firm and give me a lawyer and give me a
breach coach and lead the charge right
um that's part of what I'm paying for
that's the value I'm getting from it um
sometimes not I tend to be in the camp
of not so imagine heaven forbid that
your house burned down would you call
the insurance company and say hey
insurance company would you please
please call the fire marshal and then go
get me like an architect and a builder
and come to the table with us and help
me pick out all my finishes and stuff
like no you would never do that you
would go do all that stuff by yourself
and you would be like hey and sure give
me money but when it comes to cyber for
some reason we think they're our friend
and we want them to be part of our team
um and I get it if that's part of what
you think the value is great make sure
that's what you're getting and you
understand like how you call their
hotline and who's on their panel and
stuff we'll talk in the next phase about
like what you might do
instead
yeah
isalis no so actually very much not
because uh our ransomware is uh the
biggest thing they're covering right now
so yeah criminal organizations are
definitely not excluded the way that uh
state sponsored and terrorist is
now currently not currently you have to
be on the actual terrorism list from the
United States and that could get real
interesting because if you think about
these organized crime groups sometimes
they end up on the sanction list which
isn't the same as the terrorism list um
and so far that's not been an issue but
as we talk about like how are they going
to deal with ransomware from a national
strategy point of view like potentially
that could become a
problem um and then as you get to the
end of figuring out your policy just
remember everything is negotiable all of
the stuff that we talked about this is a
contract every part of a contract is red
lineable you can Redline all of these
things that doesn't mean they're going
to accept all your redlines work with
your broker your broker will help you
figure out what things they will
probably be amendable to and what things
they won't but for the most part a lot
of this stuff is real easy to redline
like hey if the subl limits don't meet
where you're aimed at if you need prior
x uh we didn't talk about subreg subreg
is the idea that like if you have a
problem like your provider uh fails and
your insurer has to pay you and they
have to go sue your provider uh they're
going to go sue your provider for that
outage or whatever well you might have
stuff in your contract that says you
can't sue them well that would put you
in a problem and so you got to get a
waiver of subreg blah blah blah you just
have to know that stuff in advance it's
not that big of a deal they will help
you work through it um but this
exclusion stuff getting your uh officers
on dno if need longer waiting periods
whatever it is all that stuff is usually
pretty easily negotiable if you knew to
negotiate it for it but you have to do
it before you sign on the dotted line
what ends up happening so often is I
talk to folks who don't figure this
stuff out until after they've signed on
the dotted line and they're trying to
put together their plan or they've had
the bad thing happen and they're like oh
we thought we bought X and we got
something else like this doesn't cover
the stuff we thought it covered because
we didn't read it right so make sure you
read it make sure you understand it make
sure that the policy is doing the things
you think it's doing
um then this one is going to be
unpopular because everybody GRS when I
say it and it sucks but it is what it is
so um one of the best ways that you can
kind of put some leverage on these
insurers because a lot of the times it's
people say to me like hey well this is
hard because the insurance companies
have all the power right like I go to
them and they send me the they send me
the application and they send me the
thing they want me to do and like the
balls in their Court they just tell me
what to do and if I want ured I to do
this one of the ways that you can kind
of shift some of the power is by
creating competition and I've seen a lot
of folks move toward like turning uh
procurement of insurance into like an
RFP process basically where you're
baking folks off against each other RFP
sucks doing RFP sucks nobody wants to do
an RFP but anything you can do to shift
to balance of power a little bit and
make them compete against each other and
kind of take some of that like one way
back and forth out is going to help
you do away with some of that like we're
trying to impose our will on you so the
last part is once you've signed on the
dotted line you've got your policy
you've agreed to it you're happy with it
blah blah blah blah blah now you got to
make sure that your claim ready if the
bad thing happens are we doing the stuff
that the claim wants us to do or that
the policy wants us to do so that we can
file a claim and the way that you do
that is by making sure that your in your
formal incident response plan is lined
up to your policy and that whatever the
things that your policy tells you to do
are written in your formal incident
response plan so so the first thing
you're going to find in your plan or in
your policy is a set of things known as
the panel and the panel sometimes is
written right in your policy sometimes
you got to go out to the provider's
website to find it but the panel is a
group of providers that are
pre-contracted with the provider um
there it's going to be lawyers and
forensic firms and breach coaches and
sometimes communication firms and any
number of other services that have
pre-contracted rates and are already
buddied up basically with the provider
that they can give you uh as a partner
to help you through problems or whatever
um when you call the hotline for
instance and say hey we had the bad
thing happen they're going to assign you
somebody off of the panel or they're
going to point you to the panel and say
pick somebody off of the panel which
would be fine um except oftentimes you
don't have any relationships with any of
these panel people you've never dealt
with them before you don't have any
paperwork in place you haven't done ndas
you haven't done contracts you haven't
done any of that so you're going to now
have to do all that stuff your hair is
on fire and the bad things happened
wouldn't have been better to get all
that stuff out of the way in advance
also you probably have Partnerships with
some folks you probably already have a
third party legal you probably already
have some forensic firm or some firm
that does your cyber Insurance who
understands you maybe an MSP who's
already in your sock or whatever who
would be better suited to do your
forensic investigation also maybe you
have I don't know Carbon black agents
everywhere and their panel partner is
Mandan and Mand is going to want to come
in and put the Mandan agent everywhere
you don't have the Mandan agent now you
have to pay for the Mandan agent you
have to wait for them to roll out the
Mandan agent to all of your millions of
endpoints or whatever when you already
had a perfectly good carbon black that
they can't use because Mand can't use
carbon black but Joe scho whoever else
Fric firm could have used it right but
they're not on panel so it makes a lot
of sense to try and figure those types
of things out in advance
so I often times suggest instead of
waiting until your hair is on fire to
just take whoever it is off of panel is
to figure out who your team ought to be
in advance right because when you're
trying to do an incident response you
don't want to it's like imagine trying
to go play a baseball game with a team
of folks who had never met each other
before and you're going to go try and
win a game just like R we have no plan
and we've never met let's go win right
um so you got to have an inet response
plan you have to have practiced that
with tabletops and you should be
bringing these Partners into that these
Partners should be helping you build
those plans they should be helping you
build those run books they should be
helping you practice those run books so
whoever is your forensics partner should
probably be on retainer those retainers
should probably uh include we'll talk
about that in a minute proactive stuff
um you don't have to have all of the
things on retainer right like so you
don't need to have your own breach coach
and your own PR and comms and whatever
but you probably should have whoever is
your incident responder and whoever is
your third party legal kind of planned
out in advance so you know who they are
now we talked about like are you trying
to do this because you think the value
of insurance is having them Marshall
this for you
or do you want to build these plans
yourself I tend to think building these
plans yourself is better if you're going
to do that you should put these folks on
retainer your retainer should have a
couple of Parts it should be a block of
hours like some hours to use
retroactively those hours should be
repurposable to proactive stuff so they
can come in and build your plan they can
come in and build your run books they
can come in and do
your uh incident response tabletops or
whatever it is it should also have an
SLA here's how quick we're going to show
up um and uh all the information about
here's how to contact them in case of
emergency and when to contact them so
that when your hair is on fire you're
not reaching out to the inur trying to
figure out like who should we talk to
and how do we contract with them and how
do we get our Nas in place like all that
stuff should be done and it should all
be written in your playbooks and you
should know exactly who to call when and
what how that aligns to what your
expectation is for uh not just recovery
time but for claim Readiness and whatnot
you need to coordinate all that with
your internal legal but especially third
party legal there is is uh there is a
benefit of uh attorney client privilege
that comes from leveraging your third
party legal so if you can do what's
known as a third as a tri-party
agreement where your third third party
legal actually contracts with the
forensic firm and the forensic firm is
actually contracted to your legal who's
then contracted back to you on your
behalf right so then all the
communications to them are protected
through a attorney client privilege now
that's only kind of sort of true because
the capital one case now dictates what
things are and aren't attorney client
privilege and they've decided that like
cyber facts are not necessarily
privileged but the actual like fact
facts aren't but the all the advice is
so uh however you would interpret those
facts is all covered so making sure that
you're doing Tri party agreements and
using attorney client privilege to
execute anytime that you're
involving forensic type folks also
you'll find in these policies a lot of
the time extras like freebies um just
value ad content that people aren't
taking advantage of I have seen almost
every policy comes with at least some
kind of portal access that's full of
like tools for building incident
response plans and all risk exercises
and all kinds of just freebie tools you
can go get but I've even seen them and
this one's the example where they will
actually give you a kickback to make
improvements to your POS posture this
one says we'll give you back 10% of your
premium every year to make improvements
to your posture that you can use toward
new controls in junk and when I found
this in this particular company's policy
they had had this policy for five years
and they had left five years of 10% on
the table before we found it because
nobody bothered to read it and catch it
like this is in there you could have
been using it this whole time so
uh make sure that you're finding all the
value ad stuff as you're writing down
your plans though one of the reasons
that you might be taking on insurance is
for ransomware purposes and extortion
stuff you have to be careful about what
you write in your plans do not write in
your plans that your intention is to pay
ransoms do not write in your plan that
your intention is to leverage a
ransomware broker or anything like that
do not keep uh crypto wallets do not
write crypto wallet stuff in your
incident response plan because all this
stuff is discoverable and what you don't
want to do is go to court and explain in
court why your plan to protect your your
clients your customers data was to pay
the ransom and here was your Ransom plan
like that's going to look real bad right
so do not write that stuff down even if
that is your plan don't write it down so
as you're writing this stuff down it is
important to write stuff down but don't
write it down my official guidance is
don't make Ransom payments and on
official guidance is that's a caseby
casee basis you your insurer your
forensic firm your broker your
ransomware uh broker who's going to
understand the ATT haer is going to be
able to help walk you through that
sometimes it makes sense to pay them but
it never makes sense to write it down
then the last thing is your policy and
your plan are huge targets make sure
that you hide them so put them not just
in whatever is your uh backup indelible
backup but they need to be encrypted
because if they go into your V rubric
whatever where they're indelible that's
great but the bad guys are in for a long
time they're in for months and when they
own your active directory they own the
keys to everything that means they own
your VH and just because they can't go
in and erase your backups doesn't mean
they can't read them and they love to go
into your rubric and read all your
backups they will read your policy and
they will read your plan and find out
exactly how much money to ask for and
exactly what you were going to do in
response because you wrote it all down
so make sure that you hide it and uh
don't tell the bad guys what you're
going to do so right to the wire
questions thoughts concerns are you
bored to tears about cyber
Insurance you you have a look on your
face like you really want to ask a
question there that's where you start um
so that's your framework um when in
doubt call me uh Walt pow at uh CDW
we will walk you through the framework
um I have a a pre-made thing for pretty
much all of these steps so I have a doc
where we can come in and do all your
comparisons for you and compare your
policies to each other we can come in
and do your risk assessment we can
figure out your scorecard score for free
basically we can you name it we can help
you along the path so like where do you
start that's the easy part the an to the
hard
part it
say that one more time
how
stuck so the legal fees are actually
usually part of the coverage and when we
talked about the harms like you can
claim them separately so honestly um
it's up to your cap so generally your
thought that like your thought is a good
thought that like Hey we're probably
losing a good chunk of what we're
getting back in legal costs yes legal
costs are one of the biggest parts of
what we're paying out but basically it's
covered as part of your policy up to
your
cap that
rain in addition to the Cyber insurance
policy I do yes I am a big believer in
that now you have to ask yourself like
are you getting into cyber Insurance
because of the value ad of having them
be that champion for you but if you are
are there things that you could do even
for their like can you pick off their
panel in advance can you get that
Contracting done in advance can you do
any of this stuff in advance so that
you're not playing the baseball game
with strangers right you see for
so there's a thing that's real popular
in the industry right now called a zero
doll retainer um they're usually garbage
and they're usually not worth the paper
they're written on um but if you pay
good attention it can be worth doing so
generally the only purpose of the zll
retainer is to have the paperwork done
in advance so if
you understand that you're doing it with
someone who's on panel who is
pre-approved and whatnot then it can
make sense but what happens a lot of the
time is whoever is your cyber Insurance
folks will come in and say hey let's
sign a zero do retainer you're like Zer
do why not well then when the bad thing
happens they're not on panel they
haven't pre-negotiated with your
provider they're not the rates aren't
aligned blah blah blah blah blah and now
you can't use this thing and you end up
using somebody else and then they look
stupid and you still have to go do the
other thing um it's usually really easy
to get whoever you want on panel as long
as you do it before you sign on the
dotted line so in almost every policy
there is going to be a line that says
whoever you want as your provider as
long as they agree to our terms and you
provide X written notice to X address or
whatever then we'll put them on panel
and it's usually not a big deal at all
as long as you do it before you sign on
the dotted line after you sign on the
dotted line usually they're not as
amiable to those kind of changes
but um so I'm not sure I understand the
question they you want to you want to
add
entities
[Music]
or oh they your customer wants to be
named on your
policy obviously that's what we
got we see more and more of it
[Music]
yeah that it's generally a non-starter
and I generally tell people who are
having clients or customers come back
and ask them give them specific cyber
insurance requirements to push back
super hard and tell them to kick rocks
because even though things have looked
up the whole industry is still real
shaky and that idea that like will this
even still continue to be an option will
you be able to get insurance in your
size for the harms that you're talking
about for the levels that you're talking
about is still up in the air right like
there are lots of bad things that can
happen to you in life that you can't buy
insurance for and there are going to be
portions of the Cyber landscape that
that is true for um and we don't know
what they are yet and so we're painting
ourselves in this corner where uh I
started off saying people ask me all the
time hey Walt do I even still have cyber
Insurance in 2023 should I drop it well
a lot of people can't drop it because
they have regulatory or contract
obligations to tell them they have to
have it well what's going to end up
happening is you're going to end up in a
situation where you can't get it or it
doesn't make Financial sense to get it
and now you've painted yourself into
this corner because some you're going to
be in violation of some customer
contract there was a BS contract in the
first place so I would push back on all
of that because there's a good chance
that you're going to find yourself in
two or three years in a scenario where
you're not going to be able to support
that contract clause that you could
support today I I would push back super
hard even if the insurance company
wasn't pushing back super
hard guys we got to wrap up so I can get
the yeah yeah we're over we're yeah
we're no yeah we're
over
thanks