1

Hello Spiceworks do you all have anyone or a company that can do a video event talking about cyber insurance for Small Business

Pros and Cons

Cost

etc…

@sean-spiceworks

5 Spice ups
2

I don’t know of one off-hand that does this.

I do have one piece of advice, however. Read the terms carefully, and then read them again. Think of scenarios and ask for clarification. Many have found that coverage was denied for various reasons. Not the least of which was “failure to maintain a base security posture”.

3 Spice ups
3

You are correct its like getting flood insurance real pain in the arse

4

Not sure if they have that for SMBs…but do read the T&Cs very very carefully with a “technical” lawyer present.

Most have a clause that if it is the customer negligence, no coverage. Things like protection (AV, firewall) not updated can be considered. Some consider “known patches for OS & software” not installed into consideration as well.

2 Spice ups
5

Run a tabletop exercise and include the insurance provider. This helps get all parties involved and people will have a better understanding of their roles on these happenings. The old adage, it’s not if this happens, but when. You will find the open issues and have time to address. Also be wary that some providers are essentially middlemen and will just negotiate the ransom.

1 Spice up
6

I’ve fought this battle pretty recently. I’ll throw out a few:

Pro:
If/when you get hit you have the option to call in the big boys for help at no additional cost. The insurance underwriter may even put you in contact with a company their other clients have used to track down where the intrusion occurred and insure everything is shored up.

Con:
You will need to meet their minimum security requirements as they have written them for you to even be considered as a client. They will ask for MFA on everything, everything to be encrypted, an EDR solution, 3-2-1 backups, etc. If you don’t meet the minimum requirements you must present a plan to get there and follow through on it. As they don’t understand the requirements themselves they tend to be pretty inflexible on other security mitigations you may have in place. Either you check off the boxes or you don’t. If you don’t already have all of these in place your company will incur significant implementation cost on top of the high premiums. This could also be considered a Pro from IT’s point of view as it gives justification to improve the company’s security stance.

Con:
If the insurance underwriter believes paying the ransom is the cheapest option to get the company going again they will absolutely advise you to pay. They don’t care about wrong or right; they will go with whatever is cheapest.

Con:
Even with the best possible response the company will still have significant downtime. One week is pretty much the minimum. This is because even if you can instantly spin up good clean backups you still have to track down the intrusion’s source and insure there have been no back-doors added. One week is better than two or a month but cyber insurance doesn’t equal zero downtime.

Pricing:
From what I’ve heard, $10K per million of coverage is the best possible price you can expect. If your company is deemed higher risk the premium will likely be higher.

1 Spice up