Re-Focusing Cyber Insurance with Security Validation

The rise in the costs of data breaches, ransomware, and other
cyber attacks leads to rising cyber insurance premiums and more
limited cyber insurance coverage. This cyber insurance situation
increases risks for organizations struggling to find coverage or
facing steep increases.

Some Akin Gump Strauss Hauer & Feld
LLP’s^[1] law firm clients, for
example, reported a three-fold increase in insurance rates, and
carriers are making “a huge pullback” on coverage limits in the
past two years. Their cybersecurity practice co-head, Michelle
Reed, adds, “The reduced coverage amount can no longer shield
policyholders from cyber losses. A $10 million policy can end up
with a $150,000 limit on cyber frauds.”

The cyber-insurance situation is so concerning that the U.S.
Treasury Department recently issued a request for public
input^[2] on a potential federal
cyber-insurance response program. This request is in addition to
the assessment led conjointly by the Federal Insurance Office (FIO)
and the Department of Homeland Security’s Cybersecurity and
Infrastructure Security Agency (CISA) to determine “the extent to
which risks to critical infrastructure from catastrophic cyber
incidents and potential financial exposures warrant a federal
insurance response.”

This is a direct result of the evolution of the nature of
cyber-attacks that mirrors the evolution of digital environments
and the cryptocurrency crime facilitation effect. On the
cybercriminal side, DIY malware kits and Malware-as-a-Service
platforms have removed the cybercrime barrier of entry and made
launching complex attacks affordable for wannabe criminals lacking
tech-savviness.

Cyber insurance coverage used to cover only business
interruption, data recovery, and infrastructure damage. Today, they
are also expected to cover cyber extorsion costs, reputational
risks, non-compliance fines, and third-party liability risks, a
growing field as interconnectivity between organizations keeps
expanding.

A cyber-insurance underwriter’s classical premium evaluation
tools are adherence to best practices assessment and penetration
testing. However, the limits inherent to these approaches are
problematic on multiple levels.

• Limits of best practices-based evaluation:
• Not all best practices are relevant to every organization.
• Even adherence to best practices provides limited protection^[3].
• Some best practices, such as comprehensive patching, are
  unattainable. Even limiting patching to vulnerabilities with a CVSS
  score above 9 is unrealistic. Of the 20184 new vulnerabilities uncovered in
  2021^[4], 1165 scored above
  9.
• Limits of penetration testing
• The validity of the results depends on the tester’s ability and
  tooling.
• It lacks continuousness. As a pinpoint test, it provides a
  snapshot of the organization at a single point in time: agile
  development, emerging threats, and interconnectedness limit
  penetration testing lifetime relevancy.

Continuous security validation techniques such as Breach and
Attack Simulation, Attack Surface Management, and Threat Exposure
Assessment that optimize security programs, minimize exposure and
provide quantified KPIs that can be monitored over time are game
changers. Switching from a defensive, reactive perspective of
evaluating the insured party’s threat exposure implies moving
toward assessing the actual damage attacks would cause across the
entire MITRE ATT&CK TTPs matrix.

When negotiating with a cyber-insurance
underwriter^[5], a company that can
provide quantified, documented assessments performed with security
validations technologies can lead the discussion by demonstrating
how it:

• Reduces risks beyond best practices –
  Comprehensive assessments measure the security posture of the
  organization based on its actual resilience to attacks instead of a
  theoretical projection of the security obtained through abidance to
  best practices.
• Quantifies risk – Quantified risk scores based
  on the percentage of attack emulation detected and prevented by the
  defensive tool stack provide an instantaneous evaluation of the
  actual cyber defense efficacy. Advanced security validation
  technologies include full kill chain assessments and lateral movement capabilities^[6] that provide an exact
  measure of the extent of the potential damage a successful breach
  would achieve.
• Prevents security drift – As attack simulation
  automation enables continuous re-assessment of in-context
  resilience, security gaps resulting from new deployments or
  emerging threats are flagged without delay and can be addressed
  before jeopardizing the security posture.
• Opens new cyber-insurance underwriting avenues
  – The continuous nature of security validation can be leveraged to
  define a policy post-binding phases. Offering continuous or
  periodic re-evaluation of the security posture health determined by
  the security score to measure the evolution of the security posture
  over time provides valid negotiation ammunitions to the insured
  party.

An insurance contract could include elements such as
requirements to correct variance from agreed-upon baselines within
a reasonable time frame, an obligation to regularly share
automatically generated assessment reports, or a linkage between
the coverage extent and abidance to baseline variance.

Security validation is becoming a compliance route for
compliance regulation, such as the recent PCI DSS v4.0 update.
Incorporating security validation in cyber-insurance underwriting
processes could go a long way to address the current
cyber-insurance situation and shore up the cyber-resilience of
organizations that would have an additional incentive to implement
such a proactive approach in their environments.

Note — This article is written and contributed by By
Andrew Barnett, chief strategy officer at Cymulate.