Cyber Catalyst; Dead Cert or Rank Outsider?


Disclaimer: The views in this article/blog posting are my own opinion based on the available data that Marsh has made public.

As mentioned in episode 3 of my OMG Cyber! podcast, a number of insurers/brokers have joined a new cyber ratings project known as “Cyber Catalyst”.

More details can be found here: https://www.darkreading.com/risk/insurers-collaborate-on-cybersecurity-ratings/d/d-id/1334258 and direct from Marsh here: https://www.marsh.com/us/campaigns/cyber-catalyst-by-marsh.html

Here are a few snippets from the article on the Marsh site:

In the Cyber CatalystSM program, leading cyber insurers evaluate and identify solutions they consider effective in reducing cyber risk. Participating insurers include Allianz; AXIS; AXA XL, a division of AXA; Beazley; CFC; Munich Re; Sompo International; and Zurich North America. Microsoft is a technical advisor to the program.

Cybersecurity products and services viewed as effective in reducing cyber risk will be designated as “Cyber CatalystSM”. Organizations that adopt Cyber Catalyst-designated solutions may qualify for enhanced terms and conditions on cyber insurance policies from participating insurers.

I applaud Marsh for doing something to try and address the lack of cyber risk analysis, profiling, etc. However, I do question the value of this initiative; I will outline below my concerns and thoughts on why this is, I believe, not a helpful offering.

I do not see the value of Insurers/brokers carrying out product/solution ratings, as:

1. They (the insurers/brokers) are not experts in this area, and
2. There are already plenty of other independent testing/rating organisations that have been doing this for many years, to a very high standard. These include ISCA, NIST, AV-Test, and so on… It would have been far more sensible to partner with one of these instead, and it would have added more credibility…

So, this seems to be a strange thing to attempt; a bit like reinventing the wheel and coming up with a different shape that is not as efficient as the one we already have which has served us rather well, so far.

The program is, by my understanding, stating that if a client/insured has product/service x, y or z from the list of “approved/recommended” ones, that the client will get better rates (such as higher limits/lower premiums) and so on.

1. Now, this is fine, apart from the perspective that just because the client/insured has purchased an “approved/recommended” product/solution, it does not mean that they have rolled it out or installed it.
2. Even if they have done so, where are the checks and balances to confirm this, that it is not only rolled out, but actually configured correctly?
3. Furthermore, where is the ongoing validation? Without that, this is pretty much just a box ticking exercise, and therefore no better than the existing risk rating mechanisms they already use.
4. They state that “Microsoft is a technical advisor to the program.”, this does not really help, as they are not a trusted independent review organisation/body. What happens when Microsoft review their own products and solutions?
5. Their disclaimer doesn’t exactly offer a ringing endorsement of the value of the program, read it for yourself and see if you agree?

I would say that this is little more than a “beauty contest” and it doesn’t really do anything to address cyber risk in a new way.

Now, just to be completely transparent, I used to work for AIG as a Cyber Risk Specialist (and so I understand Cyber Insurance quite well). I helped AIG design their Cyber rating solution known as “CyberMatics”. Let me be very clear, I have no axe to grind with any of the insurers, and receive no financial benefit from “CyberMatics” or AIG on this, or any other article/blog posting that covers cyber insurance.

The difference with “CyberMatics” is that is collects telemetry and/or meta data to validate that:

1. The insured has the solution/service installed correctly, and more importantly
2. That it is being used correctly; not just once, but on-going, and this is shared with the client/insured via a secure portal, to help them further improve their cyber defences and resilience.

That is a huge difference!

You can find out more about “CyberMatics” here: https://www.aig.com/business/insurance/cyber-insurance/cybermatics

What are your thoughts on this?  Please let me know…

“Cyber Catalyst” and “Cyber Catalyst by Marsh” are registered trademarks of Marsh LLC
“CyberMatics” is a registered trademark of AIG

Insurance, Silent Cyber, and Refused Claims, Oh My!

This is a companion blog posting to my Episode 1 Podcast about Insurance, etc. which can be found on the Podcast page of this site, or on all good podcasting platforms, including Google, Apple, Spotify, Pocket Casts, etc.

Disclaimer

I am not an insurance specialist, I am a techie with over 30 years of real-world experience in malware, over 15 years of ethical hacking experience and over 10 years of digital forensics (incident response) as well as working for a large cyber insurer for over 2 years (note past tense) where I worked hand-in-glove with underwriters, brokers and claims staff in helping them understand cyber risks, defences and remediation. I also used to meet with CISOs, IT Security Managers and Risk Managers/Legal Council to understand their risks and processes, procedures, technologies, business partners, supply chain and cloud/outsourced services.

I run my own business; I do not work for an insurer or sell insurance (of any type). However, when I did work for an insurer, along with being the cyber risk specialist assisting underwriters, brokers and claims adjusters. I also trained many cyber underwriters, helping them to understand the technology, the lingo (acronyms) and what are the right questions to ask (and what are good answers), when to ask them, and to who (so that they could have meaningful risk dialogue with CISOs, IT Managers, etc.) The underwriters then can understand the answers given and price the risk appropriately, rather than just fearing a worse case scenario, and pricing according to their fears/expectations (which is far better situation (both on cover/limits and pricing) for the insured/client too)!

“Silent” Cyber

For those of you that are not in the insurance industry, you may not be aware of this term and what the implications are to existing (non-Cyber) policies, such as Property, Casualty, D&O, Kidnap and Ransom or Crime.

In simple terms, Silent Cyber is used to describe the case where cover for Cyber threats is not explicitly mentioned in the policy wording/coverage. As the insurers would say, these non-Cyber policies do not have “affirmative” cover.

What this means to you as a policy holder is that the insurer may not honour a claim if it is Cyber related for a non-Cyber policy (even if you have a Cyber extension to that non-Cyber policy). Why, because the wording and terms and conditions in force will be those from the master policy (the non-Cyber one/the main policy). This can cause claims to be rejected, as can be seen in the next section of this article.

Refused Claims

There have been two recent cases reported where the insurer has declined to pay a claim in relation to the NotPetya attacks back in June 2017, these are Hiscox vs DLA Piper and Modelez vs Zurich.

Despite what the press and other media has claimed, in both cases that the policy was a cyber policy and the reason stated by the press or other media for the claim being declined was down to an “act of war, or hostile action”.

From what I have found out, neither of these claims are in relation to Cyber Insurance policies, in fact they both are related to Property policies (which are, even with a cyber extension added on, not the same as a dedicated Cyber Policy.   Very sloppy reporting, which doesn’t help anyone…

So, this has resulted in every person and their pet of choice making statements, such as “well, what is the point of buying insurance as the insurer will weasle their way out of having to pay” and “there is no point in buying cyber insurance, as I’ve seen what happened to the claims from Mondelez and DLA Piper”.

Expecting wide-ranging/expert Cyber coverage from a Property policy is like expecting wide-ranging/expert Health insurance from your House and Contents policy! Not surprisingly you will not get comprehensive health cover backed by experts in this area. It’s a bit like expecting your gardener to offer health screening (without them being a medical practitioner).

A few days a go a written statement was sent to SC Media UK (owner of the SC Magazine) in which Kylie O’Connor, the head of group communications at Hiscox stated “The dispute we are in with DLA Piper, is not about a cyber policy and has nothing to do with a war exclusion.” This just proves that the press and other media were (shock, horror) making things up so that they could publish (without little things like “facts” get in the way!

However, in the case of Norsk Hydro, they do have a dedicated Cyber policy, and therefore are covered under that policy (up to their limit, and after taking into account any excess, waiting period, and loss adjustment).

Why do companies invest in cyber insurance?

Well, for lots of reasons, including the ones listed below:

  • Hacking (external or internal misuse)
  • Physical loss of data (left on train, back of cab, accidents (sending data to the wrong person, etc.)
  • Data corruption or eraser (cost to recover or recreate), even paying for ransomware decryption keys.
  • Business Interruption, such as DDoS, Ransomware, etc. including loss of business
  • Costs for first response (forensics, legal, PR), etc. covered under the policy
  • PCI and other fines covered (where legally allowed)
  • Bricking (where a device becomes unusable due to a firmware or other update failing).
  • Legal or contractual requirements (from industry, business partners, etc.)
  • In some cases the insurer will offer services/solutions/products to help the insured improve their overall security posture/maturity for free (as part of the policy) or at a discounted price.

At the end of the day suffering a cyber breach has almost become “normal” and “expected” as not a day seems to go by when we don’t hear about yet another breach (new or historical); a good cyber insurance policy can help offset the risk and related costs for such breaches/incidents.

Then there are new risks/attacks such as CryptoJacking and Password Spraying (O365 and GSuite targeted via IMAP and even if 2FA or MFA is enabled they may be able to get in to your account).

What are  the ways that companies could avoid falling into this crevasse?

Check the policy you have is fit for purpose, check with your insurer or broker. I strongly suggest that you ask your insurer or broker which scenarios/risks you are covered for by the policy and if you identify gaps in your existing coverage decide if the cost of taking out extra insurance is a good risk/benefit trade-off or solution.

Check that the coverage includes first response (forensics, legal and PR services), that you have enough cover for business interruption, including lost business and remediation costs. Also consider the brand/reputational damage and knock-on customer effects, loss of trust, etc.

Check to see that the policy will cover financial fraud, such as BEC/Fake CEO, employee fraud, if not, find a crime policy that includes this. Crime policies are not the same as a Cyber policy as what they cover is different, or from a different perspective.

Make sure that the Limits, waiting period and excess is suitable for your business needs.

Don’t go for the cheapest, especially if the insurer/broker only ask 5-10 questions and doesn’t sit down with your CISO or IT Manager, etc. to discuss the answers afterwards (very few questions can be answered yes or no; they are usually a bit of both and the answer may vary across a typical organisation), as may the questions that should be asked by the Insurer or Broker.

The Future?

Even though a dedicated Cyber policy is a far better bet in today’s incident/breach strewn world, there are some things that they still don’t cover.

I want to see the Insurance industry step up and make Cyber policies more inclusive; it would be better if Crime cover was also included (including not only crime and fraud due to hacking, but also fraud due to social engineering or insiders/insider collusion). This should include BEC/Fake CEO and Invoices, etc. even when NO hacking or breach has occurred!

In Summary

Organisations need to ensure (no pun intended) that the existing Insurance policy or policies they have are fit for purpose and will actually pay-out when needed. You need to purchase the right policy type for the right risk, as otherwise you could end up in the same situation as DLA Piper and Mondelez… If in doubt check with your insurer or broker, before it is too late!

Update 15th April, 2019: It has come to my attention that Merck is also suing their insurer for refusing a claim; again it is NOT a Cyber policy, it is in relation to their Property policy.

The Curse of CryptoJacking!

Since around the end of 2017 there arose a new threat to organisations and individuals alike, cryptojacking; with Ransomware starting to become less favoured as a mass-attack method, the Bad Guys n Girls were looking at new ways to make money with the least amount of work and risk as possible.

So, in 2018 we saw a huge jump in a new tactic; this was the use of scripts and malware to “mine” cryptocurrency using your or your organisations systems (usually without your knowledge, or approval). We also saw the move towards targeted Ransomware attacks, often asking for huge ransoms to be paid to get access to your data, on your systems, or hosted/cloud based servers.

So, what is CryptoJacking, what is cryptocurrency “mining”, and what does it mean to you and your systems or organisation, do you need to be worried, and what can you do to help reduce the risk from this new threat?

Let me explain:

Hopefully you all know about cryptocurrencies, at least at the basic level? If not, or for those of you that know the basics, here’s a more in-depth look at it (but not too deep), it should also help those of you that don’t yet know about cryptocurrencies.

Cryptocurrencies

When most people are asked about what they know about cryptocurrencies, they will usually reply that they know of, or have heard of Bitcoin (and possibly they may also mention Blockchain, which is not a cryptocurency at all, it is the Distributed Ledger [transaction log] used by all cryptocurrencies, and it can be used for lots of other things too, but that’s another story).

In simplest terms a cryptocurrency (like Bitcoin) is a digital currency that unlike other currencies, is decentralised (no single person or entity has control over it), unlike real “phyiscal” currencies (British Pound, US Dollar, Euro, etc.). It is also, for most purposes anonymous (that’s why the cyber criminals like to use them). It instead relies on Blockchain and what you might call a democratic method of recording and approving all transactions.

Cryptocurrency Mining

“Mining” in the world of cryptocurrencies is the act of “approving or validating a transaction and adding it to the  blockchain” each validation or approval of a transaction earns new cryptocurrency for the miner.

To do this is a case of using huge amounts of processing power; unlike “physical” mining, where you have to expend manual effort, cryptocurency mining is all done on a computer. There are many crypto-mining groups and individuals, often with dedicated “rigs” to carry out this activity. One of the real-world concerns with crypto-mining, is that because the systems used are “maxed-out”, they require lots of power and as a by-product produce lots of heat; requiring extra power to cool the room they are housed in. This, it is suggested, may also affect (increase) global warming!

Cryptojacking

Cryptojacking is when your site, server or application has been compromised (hacked), either via a vulnerability (bug), weak or default credentials (maybe re-used credentials), poor security controls such as open ports (that shouldn’t be), social engineering (phishing, vishing or smishing, etc.) Once compromised an unauthorised script, binary or other file is uploaded and executed (run); this then starts to crypto-mine using your systems processor to carry out intensive processing to validate transactions (mine cryptocurrency).

So what, I hear you say?

Well, for one thing, if it is an end point (laptop, workstation, etc.) it will slow to a crawl, now image this happening on a webserver, database server, etc. Now throw in the scenario of Cloud (where you are often charged by the CPU cycle), imagine what your next bill from them will look like. It will be between hundreds and thousands of time more than your “normal” bills! All the while the Bad Guys n Girls are making money and slowing (and possibly damaging) your business…

Now there are Worms that perform cryptojacking! Worms are automated malicious code that can move from system to system without human help.

No real surprise there, as the technique is the same as we saw with many of the Ransomware Worms in 2017 and 2018 (such as WannaCry and NotPetya). It is an obvious evolutionary step. In fact the same exploit code is being used (EternalBlue, which was stolen from the NSA by the ShadowBrokers).

What do you need to do?

  • Harden and patch all systems, applications and cloud infrastructure.
  • Use unique passwords for all access; even better use two or multi-factor authentication (not SMS based).
  • Regularly check you systems for high or unusual CPU usage (beyond the normal range).
  • Install and run anti-malware, end-point/server protection, and on servers enable and configure the firewall and if it is a web server protect it via a Web Application Firewall too.
  • Remove all default accounts and sample content on web and database servers, etc.
  • Close off ports for remote administration, or put them behind a VPN.
  • Stay aware of new threats and countermeasures, both specific and generic.
  • Train and test your staff; they are often the first and last line of defence.
  • If you have cyber or crime insurance, check that cryptojacking is covered by the policy (most cyber insurance policies currently do NOT cover this)…

Until next time, stay safe out there!