What are your thoughts on cyber insurance? Should people get it?
Sort by:
Yes cyber insurance is expensive and there's doubt about payouts however as a public entity it is a requirement. So much head bashing is required with the underwriters to try and figure out the quantum. And I'd agree with all the other comments on this as well.
Some pointers to consider:
> premiums are negotiable - don’t take the first quote
> how ‘perfect’ does operation of current controls need to be - is 95% ok for meeting patching targets?
> will the payout (assume no more than policy limit) be sufficient to cover investigation, remediation and PR/marketing costs to recover from a breach or compromise?
> how does the expected cost vs probability of compromise equate to a self-insured business case rather than annual premiums?
Cyber insurance is a good thing to have, but could be very expensive. The network should be properly segregated when designed. Some protection to take educate your users (security awareness), not to open emails from people you don't know (hard to do depending on your business), but most importantly do not click on links in emails you don't know. A process should be in place to keep systems current (security updates and patches). Monitor users and service accounts. You can also hash the systems files and any changes you would detect with the proper monitoring tools. Security today cost a lot of money, but you have to get the appropriate skills on the job.
As a public company we require that however the big argument is coverage never enough and evaluating of intangible assets
After WannaCry and NotPetya resulted in major operational disruptions in big companies, cyber insurance has become more sought after. Yes, I think cyber insurance is needed as a form of limited cyber risk transfer against the inevitability of a breach and in particular against black swan events. The scope of applicability is typically against events that your BCP plan does not already cover. Having said that, if you are a critical infrastructure at a national level, cyber insurance does nothing to lower that risk.