The Strange Case of the Covid-19 Tracing Tool…

There are currently lots of people posting garbage, etc. about the Covid-19 Tracing Tool that they have only just become aware of on their iPhone or Android smartphone, and there are also lots of conspiracy theories, misinformation and fake news about this so-called COVID-19 Tracing tool added to most Android and iPhones in the last month, or so.

Let’s get a few thing straight:

1. It isn’t an app, it is a framework and doesn’t do anything on its own.

2. It isn’t switched on by default, and won’t be unless you enable it or a COVID-19 tracking app that does.

3. If you don’t want it to work, just turn off Bluetooth.

4. If you are using a smartphone and use most apps (Facebook, WhatsApp, Google apps, etc.) you are already being tracked and many of your rights to privacy have already been given away (by you when installing most apps or just having a smartphone, you have read the EULAs and Terms and Conditions, right?). So it is a bit late to get upset now (the horse has not just bolted, it has already been around the globe several times, and had great adventures along the way, and you hadn’t even realised that it had got out).

If you don’t want to be tracked or have you privacy eroded:

  • Don’t have a mobile phone (or any smart technology),
  • Don’t use the internet, don’t use credit or debit cards,
  • Don’t have a vehicle and don’t drive,
  • Live in the middle of nowhere and live below ground, and in a Faraday cage…never go out (if you do don’t forget your tin-foil hat ;-))!

In other words in this modern world it is almost impossible to not be tracked or not have our privacy eroded; we have all agreed to defer our rights to privacy by wanting ‘cool technology and apps, etc. and for our safety and security’.

No, I haven’t gone gaga, I am not a Luddite or technophobe (as anyone that knows me will confirm, quite the opposite). I’m just telling you all what most of us in technology and security have known for over two decades (actually longer, but who’s counting?)…

Links to more details:
USA Today:

The Current Pandemic: What it Can Teach Us…

It is interesting to see how both the medical professionals and the general public are reacting to the current pandemic; the results are much the same as we in the anti-malware research and protection arena found out, far too many times, the hard way, over the last 3+ decades…

Having personally worked in anti-malware research and protection/remediation (battling digital virus, worms, trojans, etc.) for over three decades it seems that the rest of the world is starting to see what we (anti-malware specialists, and medical practitioners) already know (or should know) that:

  • Whatever action you take or don’t take the result will be criticised (so get used to it); act too quickly and defeat (or seriously reduce) the impact of a threat, and “you made this out to be a BIG problem, it was a storm in a teacup/non-event“, if you acted too slowly “why didn’t you act sooner to protect us!” Have you noticed that there are always plenty of instant experts* when you don’t need them! *Those that think they know better than those that have been dealing with these things professionally for year, decades, etc.
  • With any new threat you are often fighting mis-information and “learning as you go“; unless it is a new variant of an existing threat. Sharing of good/validated information is a “Good Thing” (TM). Mis-information causes more damage and doesn’t help anyone.
  • You need to think outside of the box (what other tools/methodologies can I leverage to give us a fighting chance in restricting the impact?).
  • Simple hygiene and good epidemiological practices (both physical and digital) reduce the likelihood of infection/spread and allow us to get ahead of the threat, stopping it spiraling out of control. You can immunise (patch or put defensive tools/methodologies in place) or quarantine (discrete unconnected networks, or disconnected devices for digital risks). Similar things can be done (and has been for Covid-19, social distancing, hand-washing, masks, anti-viral drugs, antibodies).
  • Doing nothing (ignoring or underplaying the risk) is not an option.
  • Expect and plan for new variants (mutations), as they will occur and you need to be ready for them.
  • We need to learn from this crisis (just like in cyber threat/attacks), we need to carry out a post-mortem (I hate to use that term as I recently lost my mother to Covid-19, it is very emotive); what went well, where we could have done better, where things need to change or we need to add/improve our capabilities.

Let me be very clear the current situation is far from simple, we have to look at the impact beyond our own, and loved ones health, there has been and will continue to be a vast impact on both our own and our nations finances (many governments are racking up huge debt trying to keep the nation afloat). We will have to adapt to the situation; changing our behaviours and expectations (at least in the short term). The alternative is too frightening to contemplate, another wave, more deaths, more health issues for those that survive the disease, but have a lasting impact on their health for months, years or the rest of their lives.

A suitable solution is always a trade-off between security (protection/defence) and functionality (access, freedom, capability), both in the case of digital threats and physical threats, such as Covid-19!

Plan for the worst, hope for the best, in other-words, in the case of cyber risks/incidents as well as physical risks (fire/flood/earthquake,alien invasion, etc.) you need to have all of the following in place, and you should test them regularly:

  • Incident Response Plan (IRP)
  • Business Continuity Plan (BCP)
  • Disaster Recovery Plan (DRP)

If you don’t have all of these, how are you going to respond when “the fecal matter hits the rotary air circulation device“?

You are going to run around like a headless chicken, with little or no idea how to respond, who to involve, where to get help, etc. You will probably make things worse; because you don’t have a suitable plan (or haven’t tested it recently); unless you are very, very lucky!

So, in summary, we will beat Covid-19 eventually, but things will (probably) be forever changed;

  • Less travel (until we get a viable and safe vaccine); this will result in lower emissions and be good for us all, nature and the planet as a whole.
  • Increased use of home working (where feasible); many organisations have seen the benefit of this and have already put in place the infrastructure to support this. However, those organisations that haven’t invested in security (both physical and logical and the supporting technical expertise/management) will become targets of the Bad Guys n Girls (Cyber Criminals, State Actors, etc.)
  • Increased distributed working (less physical teams); this will have a knock-on benefit (if done correctly) of offering 24/7/365 follow the sun capabilities to all relevant business or other functions.
  • Virtual classrooms/events will become far more normal and acceptable to many of us.

I may update this with other material as I think of it, any feedback, etc. is, as always, most welcome.

Stay safe!

What Does Climbing Mountains Have in Common with Cyber Security?

Carrauntoohil and the Hag's Tooth

Picture of Carrauntoohil and the Hag’s Tooth (the Reeks mountain range in County Kerry, Ireland)

Why am I writing about mountains? Well I have just come back from Ireland after climbing the highest peaks in both Northern Ireland (Slieve Donard) and the Republic of Ireland (Carrauntoohil) with my son.

Yes we climbed the infamous Devil’s Ladder on Carrauntoohil on Saturday the 31st of August, 2019 (it was more like the Devil’s Waterfall or Stream that day, as it had rained extensively for the last week).

The path to the base of the Devil’s Ladder – The bottom of the Devil’s Ladder – My Son about a quarter way up the Devil’s Ladder

So, this meant that we had to adapt our risk models, our strategy, our plans to conquer it and to get back down safely after summiting the mountain…

This may seem to be a silly analogy, but you’d be surprised how much they have in common:

In fact, they both require:

  • Extensive preparation, including testing that your plans/equipment/tools and your skills are relevant and fit for purpose, and that they work (as expected) before you need them for real.
  • The ability to be adaptable to changing conditions/threats/risks, etc.
  • Risk analysis/rating and to be able to classify risks as low (acceptable), neutral or high (unacceptable, or unwise).
  • Stamina (staying power), perseverance and digging deep (at times) to ensure success or when dealing with an incident (or potential incident) or the immediate workload.
  • Teamwork (in an ideal world) to be really successful; both mentally and physically. Also understand that you may need different perspectives (both in knowledge and risk) and skill sets.
  • That you need to have experts (or at least people with more knowledge than you) available if things go wrong; for small incidents you may be able to deal with it yourself, or with limited assistance, but when things go badly wrong you need ‘real expertise’ on call.
  • Suitable insurance; so that you have a way to offset risk and associated costs with an incident (just in case; worst case scenario).
  • That you understand you haven’t succeeded when you’re at the peak, but when you have returned to BaseCamp (normal business operations aka steady state).

Yes, we successfully summited the mountain which we did with nothing more than getting wet (several downpours, and even hail on the last push to the summit) and cold; it was about 20c at the bottom, but close to 0c at the top, when we were over 1,039m (3,409 feet) up, and a complete white-out, and my son slipped and twisted his ankle (slightly) when climbing up the Devil’s Ladder.

As it was a complete white-out  at the summit (well actually the top third of the mountain for most of the day), it can be easy to lose your way as visibility is very limited (a matter of a few meters at best), so veering off the path is easy and can be lethal, as there are cliffs around the summit on most sides of the mountain. I however had two GPS devices (with maps on and the route pre-planned) so that this was not an issue for us. I also had a compass and a paper map (as well as two smartphones with the 1:30,000 Harvey’s map on); so I had multiple backups in case one or more of the technical solutions failed!

Does this sound familiar to cyber security best practice?

Start of the Devil's LadderTop of the Devil's LadderAt the top (honest!)
Left to Right: Bottom of Devil’s Ladder – Top of Devil’s Ladder (looking down) – At the summit of Carrauntoohil
Please Note: The photos of the Devil’s Ladder do not show just how steep and technical it is in reality!
We also summited a second mountain in the Reeks range that day (Cnoc na Toinne), as we decided not to risk coming back down the Devil’s Ladder (the risk was high/unacceptable that day, going up was an acceptable risk), we decided to take the lower risk (but not risk free) route down via the second peak via the Zig-Zags*.

Most of the experienced hikers/climbers that day also decided against going down the Devil’s Ladder; like us deciding on a safer way down, either using the Zig Zags or the Heavenly Gates and/or Brother O’Shea’s Gully route instead!

As we were descending via this route, ironically a very experienced hill/fell/mountain walker just ahead of me tripped and almost fell over the edge, so this shows that things can still go wrong, even to the most experienced. Luckily that day, if he had fallen over the edge there were members of the Irish Mountain Rescue on the mountain (just below him, in fact), so help was at hand, had it been required, luckily he was fine, with just a few bruises to his body and his pride!

Why not broaden your risk appetite and knowledge, go on I know you want to, it will expand your knowledge and maybe get you out of your chair 😉

If you want to read more about our mountain climbing adventures (we have done all of the 5 highest peaks in the British Isles), you can find far more details on my other site, here:

*The Zig-Zags is often described as the ‘easy route’ up and down the mountain, however that same week there had been two accidents where the victim underestimated or didn’t respect the path (which although easier is not without challenge and risk). One wrong or missed step can see you falling down the side of the mountain (with nothing to stop you) until you get near to the bottom. This is a potential fall of over 800m (or over 2,500 feet)! To put this in perspective, the Shard in London is 310m (just over 1,000 feet) tall, so it would be the equivalent of falling over 2.5 times the height of the Shard (ouch)!

All photographs used in this article are Copyright, 2019 by Martin Overton, All Rights Reserved.

Public Speaking, Loathe it or Love it? Top Tips to Help You Shine!

I’ve been public speaking for almost 25 years now and I’m often asked how I look so comfortable and as engaging/passionate as I am, this isn’t how I’ve always been…

I was a very shy and nervous child, teenager and even in to my early career in retail; although working in retail helped me immensely in getting over the shyness. I was fine talking one to one, but the very though of having to speak to a group filled me with complete and utter dread. I was paralysed at the thought.

When I moved in to IT I was sent on the Dale Carnegie course in the early 90’s, this included having to do a two minute talk to the rest of the class every week for the length of the course….scary wasn’t the word! However, it did help me to overcome my initial panic (panic was the correct word), and even some of my anxiety/nerves. But, it was a small group, no more than 20 people, not hundreds or thousands!

The first time I did a conference, back in 1996 (to several hundred delegates) I couldn’t stand up because I was so nervous (my legs would not support me; luckily the lectern microphone was faulty, so I got to sit down at the moderators desk, phew!) The following year I presented at the same conference and I actually stood up to deliver my talk; I was still very nervous, however, since then it has become easier (less stressful) & now I actually enjoy presenting at conferences, events and training sessions all over the world.

“I was a very anxious and shy person, I am not an extrovert; although many people believe I am, they often tell me that I am a very engaging and passionate and that I come across as a very natural and confident speaker.’

So, what can you learn from my personal experiences, so that you can tame the nerves and shine when you next have to present?

Here are my top tips to make it as painless for you, and engaging for your audience:

1. Use stories, real world stories help to bring a subject to life, and help to engage your audience (everyone likes a story).

2. Know your stuff, it may sound obvious, but if you don’t know your material (topic) then it will show and be more stressful for you and uncomfortable for your audience. I love sharing the knowledge, tricks and tips that I’ve acquired over the last 31 years…

3a. Never do a live demo (record it instead). Also, any videos or other material you use, make sure you have a local copy (internet connectivity may be patchy or non-existent).

3b.Try and use your own laptop as relying on the organisers one may prove problematic. Issues could include; lack of the correct codecs (meaning your videos won’t play, or won’t play correctly), the laptop the organiser is using may use a different language or Operating System that you don’t know. If you must use the organisers laptop, etc. test that it works as expected with your material, don’t just wing it!

3c. Pictures really do help, (as the old saying goes “A picture is worth a thousand words” by all means use text on your slides, but make it clear that this is for reference, as you will share the slides with the audience afterwards.

4. Rehearse (especially if it is new material, or not your slide deck/talk). If you don’t know your material intimately, then it will show, practice, practice, practice and know your stuff! Speak clearly, and use a measured pace (don’t talk too fast; I’m still guilty of doing this at times). But equally don’t talk too slow, and definitely use a varying tone (it is better for the audience, believe me). Breathe, leave space after you have made a point (to let it sink in).

5. Make it personal, Talk to your audience, ask them questions, ask for feedback/confirmation during the talk (not just at the end).

6. Make it fun (memorable), use humour to make a point and to raise the interest level, especially if it is a rather dry or scary subject. Cartoons can help raise the interest level, as can jokes (but be careful not to offend).

7. Give actionable takeaways (no not food or gifts ;-)) Give your audience things (useful tricks/techniques/best practice, etc.) they can use both at home (in their personal life) and at work.

8. If you are nervous use the nerves to your advantage. Nerves can help give you energy to make your talk sparkle. Be passionate about your subject, you will feel less anxious as a result.

9. Move about, don’t hide behind the lectern/podium, use the stage/floor; this helps you to engage with more of the audience than you could otherwise do. Look as many in the eye as you can (not just those at the front).

10. Enjoy yourself, when you follow the above, you can actually enjoy the experience; this makes it more engaging/comfortable for the audience. Go on, do it, if I can then you can too…

I now present all over the world at event and conferences to audiences from 30 up to over 5,000!

There are probably others that have slipped my mind at this moment, what are your top tips?

OMG Cyber! Episode 5 – The one about The Curious Case of Conficker (aka Downadup) – Interview with Ken Bechtel

The latest episode of my podcast is now available, hope you enjoy it…

Episode 5 – The one about The Curious Case of Conficker (aka Downadup) – Interview with Ken Bechtel

This episode is mainly an interview and discussion with Ken Bechtel, who like me has been in Cyber Security for over three decades. We discuss “the Curious Case of Conficker (aka Downadup), the Botnet that Never Bit..”

This includes what we (as an industry, as a victims) learnt from it. We also discuss AVIEN, Intelligence Sharing, SNORT signatures (for new malware) as well as honeypots, Opaserv (where I was, jokingly, accused of writing new variants of this family of share crawling worms), AutoRun risks, and various other things.

You can find out more about us on our website, including how to contact us, here: You will also find show notes there…

You can subscribe to it via Apple,, Google, Pocket Casts, Spotify, Breaker, PodBeam, RadioPublic and Overcast (others to follow)

Question of the Day: How do I become a security specialist (ethical hacker, malware researcher, digital forensics, etc.)

First things, do you like solving puzzles, do you like a challenge, can you stare at a screen for many hours, poring through code, logs, etc?

Were you the sort of child that liked to take things apart to understand how they worked, and more importantly could you put them back together again, without having left over pieces, and did the thing still work at least as well as it did before?

Do you look at things and think, well that should work as expected if I follow the logic, but, if I do this instead, it will bypass that logic and let me access another part of the site/code or infrastructure?

Or, maybe when hearing about a new threat, you quickly see how it works and how you can either slow it down, or stop it dead in its tracks using simple techniques or processes, or by using an existing security control in a different way?

If you answered yes to several or more of the above, then you might have the right mindset for a career in cyber security as an ethical hacker, social engineer, malware analyst or in digital forensics and incident response. If you didn’t answer yes to one or more of the above, don’t worry, you can still work very successfully in other areas of cyber security, just probably not as an ethical hacker or in incident response or malware research.

“If you have the right mindset, you can be taught the skills,
but it is very hard to teach a mindset…”

So, if you do have the right mindset, how should you develop the required skills to get into cyber security?

First, decide, do you like technology or the human side of the problem. That will be your first step. If you are lucky you might be able to do both…

The next step is dependant on the answer to the first question. If technology, then you need to become very familiar with as many operating system, applications, programming languages as you can (you don’t have to be proficient in all of them to start off, just pick one or two for starters).

If the human side is more your bag, then learn about cons, social engineering, and psychology in as much depth as you can. Then try some of the techniques on friends and family (without breaking the law).

After that, find a mentor, someone that is skilled in the discipline you want to learn, soak up as much knowledge from them as you can.

Read everything you can on the subjects, if available, go on courses, go to events, conferences, local meets to meet likeminded people, be they newbies like you, or security professionals with a decade or more of real world experience to mine for tips and tricks, etc.

If you are looking at doing malware research, ethical hacking or forensics, you will find lots of CTF and analysis challenges that are freely available, do as many as you can; when you fail (and you will) learn from the failure, it won’t be the last time. Even the best fail often, but they always learn as much (if not more)  from the setbacks ass the successes. Often doing security work is hard and even boring, but when you solve a problem (reverse a malware and understand how it works and how to stop it, or gain access to a system or network, or identify how a bad guy or girl got in, the rush is amazing).

Expect to have to start in a junior role, maybe even working on an IT Helpdesk, doing patching, hardening, server/system builds, etc. We all have to start somewhere.

I started by building and configuring PC’s (building them and installing the OS and applications, configuring them, etc.) Then I moved on to reviewing hardware and software for the same company (doing research, etc.), then I got involved with security (malware at first), worked on the IT Helpdesk, did AIX support (a Unix flavour), and finally I built and ran the Internet Security team (defence, as well as ethical hacking). It takes 5-10 years to become proficient enough with a wide range of operating systems, applications, hardware, networking, security tooling, attack methods, malware analysis, and so on. Be patient, don’t take shortcuts, as it will not help you in the long run.

You don’t need degrees or certificates to do well in this area, you do need the right mindset, be willing to learn and experiment, and work long and odd hours, as the job will not be your usual 9-5 one. I left school at 16 and have no degrees or diplomas and have only been on two cyber security courses in over 31 years of working in this field. (One on advanced hacking and the other on advanced digital forensics, both of which I attended to confirm that what I had learnt and been doing for over 20 years (at that time), being mainly self-taught, was right after all, it was! In fact I taught the course instructors a few things that they didn’t know)

Be very wary of the problem of stress; this is a major risk when working in cyber security, especially in Incident Response. Burn out is quite common, if you don’t manage stress correctly.

One thing I will strongly recommend is to look back in history, see what has happened in the past, both from breaches, attack methods, malware types and tricks, etc. There is very little that is “new”, most of the things you will encounter will build on old (tried and trusted) tricks and methodology; usually just updated to the latest OS versions, applications, etc. or re-used to take advantage of the new victim pool (ones that were not around or didn’t take notice the first, second or third time that technique was used).

If you want to learn about web application testing, then there a several training VMs out there, such as SecurityShepherd that will test your skills in a safe and secure environment quite legally.

On the subject of legality, whatever you do, do not be tempted to step over the line and do something illegal with your skills, as you will constantly be looking over your shoulder waiting for law enforcement to apprehend you. It will also make you less employable in the cyber security world.

You don’t have to be a black hat to be a skilled hacker or to understand how an attack is done or how malware works. As I said earlier in this episode, good ethical hackers may be able to think like a bad guy or girl, they just don’t act like one, in other words you don’t need to break the law to be very skilled in any security field.

After that, expect a lifetime of learning, building on and refining you existing skills, and as things are right now, you will have a long and productive, well paid career helping to counter the bad guys and girls, rather than being one of them…

Anyone that states that you “need to be a thief to catch a thief” or that you “need to be a poacher to be a gamekeeper” or any of the other examples, I say to them, rubbish! There are very few real world cases where being an ex-criminal has made a difference that hasn’t or couldn’t have been made, more effectively by a good researcher that can think like a bad guy or girl, but hasn’t gone over to the dark side to prove their skills.. In fact many of those that were caught, even though the press made them out to be some form of Uber hacker or malware writer, the vast majority had very poor skills, they often used other criminals code/techniques to carry out the attack… what most of us in cyber security would call “script kiddies”…

You can make a difference, be on the right side, help defend and protect those in society that are often the victims of the many cyber crimes that happen each and every minute of every hour or every day…

To quote Del Boy Trotter, from Only Fools and Horses, You know it makes sense, don’t be a plonker

If you think I have missed anything important, or I should add something to this article, please let me know.

OMG Cyber! Episode 4 – The one about End User Education and Testing, What it takes to work in Cyber Security, and what BYOD means, and more!

The latest episode of my podcast is now available, hope you enjoy it…

Episode 4 – The one about End User Education and Testing, What it takes to work in Cyber Security, and what BYOD means, and more!

This episode does a fairly deep dive on End User Education and Testing and why everyone should be a part of any organisations security defences.

I also talk about the latest news around the Wipro and Microsoft breaches, MalwareTech’s guilty plea, and the Docker breach, etc….

This episodes Question of the Day discusses what it takes to be a cyber security specialist, especially around ethical hacking, forensics or malware research.

here are a number of companion blog postings, these can be found here:

You can find out more about us on our website, including how to contact us, here: You will also find show notes there…

You can subscribe to it via Apple,, Google, Pocket Casts, Spotify, Breaker, PodBeam, RadioPublic and Overcast (others to follow)

Cyber Catalyst; Dead Cert or Rank Outsider?

Disclaimer: The views in this article/blog posting are my own opinion based on the available data that Marsh has made public.

As mentioned in episode 3 of my OMG Cyber! podcast, a number of insurers/brokers have joined a new cyber ratings project known as “Cyber Catalyst”.

More details can be found here: and direct from Marsh here:

Here are a few snippets from the article on the Marsh site:

In the Cyber CatalystSM program, leading cyber insurers evaluate and identify solutions they consider effective in reducing cyber risk. Participating insurers include Allianz; AXIS; AXA XL, a division of AXA; Beazley; CFC; Munich Re; Sompo International; and Zurich North America. Microsoft is a technical advisor to the program.

Cybersecurity products and services viewed as effective in reducing cyber risk will be designated as “Cyber CatalystSM”. Organizations that adopt Cyber Catalyst-designated solutions may qualify for enhanced terms and conditions on cyber insurance policies from participating insurers.

I applaud Marsh for doing something to try and address the lack of cyber risk analysis, profiling, etc. However, I do question the value of this initiative; I will outline below my concerns and thoughts on why this is, I believe, not a helpful offering.

I do not see the value of Insurers/brokers carrying out product/solution ratings, as:

1. They (the insurers/brokers) are not experts in this area, and
2. There are already plenty of other independent testing/rating organisations that have been doing this for many years, to a very high standard. These include ISCA, NIST, AV-Test, and so on… It would have been far more sensible to partner with one of these instead, and it would have added more credibility…

So, this seems to be a strange thing to attempt; a bit like reinventing the wheel and coming up with a different shape that is not as efficient as the one we already have which has served us rather well, so far.

The program is, by my understanding, stating that if a client/insured has product/service x, y or z from the list of “approved/recommended” ones, that the client will get better rates (such as higher limits/lower premiums) and so on.

1. Now, this is fine, apart from the perspective that just because the client/insured has purchased an “approved/recommended” product/solution, it does not mean that they have rolled it out or installed it.
2. Even if they have done so, where are the checks and balances to confirm this, that it is not only rolled out, but actually configured correctly?
3. Furthermore, where is the ongoing validation? Without that, this is pretty much just a box ticking exercise, and therefore no better than the existing risk rating mechanisms they already use.
4. They state that “Microsoft is a technical advisor to the program.”, this does not really help, as they are not a trusted independent review organisation/body. What happens when Microsoft review their own products and solutions?
5. Their disclaimer doesn’t exactly offer a ringing endorsement of the value of the program, read it for yourself and see if you agree?

I would say that this is little more than a “beauty contest” and it doesn’t really do anything to address cyber risk in a new way.

Now, just to be completely transparent, I used to work for AIG as a Cyber Risk Specialist (and so I understand Cyber Insurance quite well). I helped AIG design their Cyber rating solution known as “CyberMatics”. Let me be very clear, I have no axe to grind with any of the insurers, and receive no financial benefit from “CyberMatics” or AIG on this, or any other article/blog posting that covers cyber insurance.

The difference with “CyberMatics” is that is collects telemetry and/or meta data to validate that:

1. The insured has the solution/service installed correctly, and more importantly
2. That it is being used correctly; not just once, but on-going, and this is shared with the client/insured via a secure portal, to help them further improve their cyber defences and resilience.

That is a huge difference!

You can find out more about “CyberMatics” here:

What are your thoughts on this?  Please let me know…

“Cyber Catalyst” and “Cyber Catalyst by Marsh” are registered trademarks of Marsh LLC
“CyberMatics” is a registered trademark of AIG

OMG Cyber! Episode 3 The one about Sextortion, Social Engineering, SIEM and SOAR

The latest episode of my podcast is now available, hope you enjoy it…

Episode 3- The one about Sextortion, Social Engineering, SIEM and SOAR

This episode does a fairly deep dive on Sextortion scams and Social Engineering.

I also talk about the latest news around the FIN6 Cyber Crime gang, Credential Stuffing attacks and a new Insurance initiative…

This episode uses a new microphone, improved workflow and  post-production tools, this has hopefully produced better (more consistent/levelled) final audio. As usual, all feedback is most welcome.

There are a number of companion blog postings, these can be found here:

You can find out more about us on our website, including how to contact us, here: You will also find show notes there…

You can subscribe to it via Apple,, Google, Pocket Casts, Spotify, Breaker, PodBeam, RadioPublic and Overcast (others to follow)

Insurance, Silent Cyber, and Refused Claims, Oh My!

This is a companion blog posting to my Episode 1 Podcast about Insurance, etc. which can be found on the Podcast page of this site, or on all good podcasting platforms, including Google, Apple, Spotify, Pocket Casts, etc.


I am not an insurance specialist, I am a techie with over 30 years of real-world experience in malware, over 15 years of ethical hacking experience and over 10 years of digital forensics (incident response) as well as working for a large cyber insurer for over 2 years (note past tense) where I worked hand-in-glove with underwriters, brokers and claims staff in helping them understand cyber risks, defences and remediation. I also used to meet with CISOs, IT Security Managers and Risk Managers/Legal Council to understand their risks and processes, procedures, technologies, business partners, supply chain and cloud/outsourced services.

I run my own business; I do not work for an insurer or sell insurance (of any type). However, when I did work for an insurer, along with being the cyber risk specialist assisting underwriters, brokers and claims adjusters. I also trained many cyber underwriters, helping them to understand the technology, the lingo (acronyms) and what are the right questions to ask (and what are good answers), when to ask them, and to who (so that they could have meaningful risk dialogue with CISOs, IT Managers, etc.) The underwriters then can understand the answers given and price the risk appropriately, rather than just fearing a worse case scenario, and pricing according to their fears/expectations (which is far better situation (both on cover/limits and pricing) for the insured/client too)!

“Silent” Cyber

For those of you that are not in the insurance industry, you may not be aware of this term and what the implications are to existing (non-Cyber) policies, such as Property, Casualty, D&O, Kidnap and Ransom or Crime.

In simple terms, Silent Cyber is used to describe the case where cover for Cyber threats is not explicitly mentioned in the policy wording/coverage. As the insurers would say, these non-Cyber policies do not have “affirmative” cover.

What this means to you as a policy holder is that the insurer may not honour a claim if it is Cyber related for a non-Cyber policy (even if you have a Cyber extension to that non-Cyber policy). Why, because the wording and terms and conditions in force will be those from the master policy (the non-Cyber one/the main policy). This can cause claims to be rejected, as can be seen in the next section of this article.

Refused Claims

There have been two recent cases reported where the insurer has declined to pay a claim in relation to the NotPetya attacks back in June 2017, these are Hiscox vs DLA Piper and Modelez vs Zurich.

Despite what the press and other media has claimed, in both cases that the policy was a cyber policy and the reason stated by the press or other media for the claim being declined was down to an “act of war, or hostile action”.

From what I have found out, neither of these claims are in relation to Cyber Insurance policies, in fact they both are related to Property policies (which are, even with a cyber extension added on, not the same as a dedicated Cyber Policy.   Very sloppy reporting, which doesn’t help anyone…

So, this has resulted in every person and their pet of choice making statements, such as “well, what is the point of buying insurance as the insurer will weasle their way out of having to pay” and “there is no point in buying cyber insurance, as I’ve seen what happened to the claims from Mondelez and DLA Piper”.

Expecting wide-ranging/expert Cyber coverage from a Property policy is like expecting wide-ranging/expert Health insurance from your House and Contents policy! Not surprisingly you will not get comprehensive health cover backed by experts in this area. It’s a bit like expecting your gardener to offer health screening (without them being a medical practitioner).

A few days a go a written statement was sent to SC Media UK (owner of the SC Magazine) in which Kylie O’Connor, the head of group communications at Hiscox stated “The dispute we are in with DLA Piper, is not about a cyber policy and has nothing to do with a war exclusion.” This just proves that the press and other media were (shock, horror) making things up so that they could publish (without little things like “facts” get in the way!

However, in the case of Norsk Hydro, they do have a dedicated Cyber policy, and therefore are covered under that policy (up to their limit, and after taking into account any excess, waiting period, and loss adjustment).

Why do companies invest in cyber insurance?

Well, for lots of reasons, including the ones listed below:

  • Hacking (external or internal misuse)
  • Physical loss of data (left on train, back of cab, accidents (sending data to the wrong person, etc.)
  • Data corruption or eraser (cost to recover or recreate), even paying for ransomware decryption keys.
  • Business Interruption, such as DDoS, Ransomware, etc. including loss of business
  • Costs for first response (forensics, legal, PR), etc. covered under the policy
  • PCI and other fines covered (where legally allowed)
  • Bricking (where a device becomes unusable due to a firmware or other update failing).
  • Legal or contractual requirements (from industry, business partners, etc.)
  • In some cases the insurer will offer services/solutions/products to help the insured improve their overall security posture/maturity for free (as part of the policy) or at a discounted price.

At the end of the day suffering a cyber breach has almost become “normal” and “expected” as not a day seems to go by when we don’t hear about yet another breach (new or historical); a good cyber insurance policy can help offset the risk and related costs for such breaches/incidents.

Then there are new risks/attacks such as CryptoJacking and Password Spraying (O365 and GSuite targeted via IMAP and even if 2FA or MFA is enabled they may be able to get in to your account).

What are  the ways that companies could avoid falling into this crevasse?

Check the policy you have is fit for purpose, check with your insurer or broker. I strongly suggest that you ask your insurer or broker which scenarios/risks you are covered for by the policy and if you identify gaps in your existing coverage decide if the cost of taking out extra insurance is a good risk/benefit trade-off or solution.

Check that the coverage includes first response (forensics, legal and PR services), that you have enough cover for business interruption, including lost business and remediation costs. Also consider the brand/reputational damage and knock-on customer effects, loss of trust, etc.

Check to see that the policy will cover financial fraud, such as BEC/Fake CEO, employee fraud, if not, find a crime policy that includes this. Crime policies are not the same as a Cyber policy as what they cover is different, or from a different perspective.

Make sure that the Limits, waiting period and excess is suitable for your business needs.

Don’t go for the cheapest, especially if the insurer/broker only ask 5-10 questions and doesn’t sit down with your CISO or IT Manager, etc. to discuss the answers afterwards (very few questions can be answered yes or no; they are usually a bit of both and the answer may vary across a typical organisation), as may the questions that should be asked by the Insurer or Broker.

The Future?

Even though a dedicated Cyber policy is a far better bet in today’s incident/breach strewn world, there are some things that they still don’t cover.

I want to see the Insurance industry step up and make Cyber policies more inclusive; it would be better if Crime cover was also included (including not only crime and fraud due to hacking, but also fraud due to social engineering or insiders/insider collusion). This should include BEC/Fake CEO and Invoices, etc. even when NO hacking or breach has occurred!

In Summary

Organisations need to ensure (no pun intended) that the existing Insurance policy or policies they have are fit for purpose and will actually pay-out when needed. You need to purchase the right policy type for the right risk, as otherwise you could end up in the same situation as DLA Piper and Mondelez… If in doubt check with your insurer or broker, before it is too late!

Update 15th April, 2019: It has come to my attention that Merck is also suing their insurer for refusing a claim; again it is NOT a Cyber policy, it is in relation to their Property policy.