Insurers can't use 'act of war' excuse to avoid Merck's $1.4B NotPetya payout Merck's insurers can't use an "act of war" clause to deny the pharmaceutical giant an enormous payout to clean up its NotPetya infection, a court has ruled. A New Jersey appellate court this week upheld [PDF] an earlier decision that a group of insurers could not use the war exclusion in their insurance policies — despite the …
I have mixed feelings about this outcome; on the one hand I want the insurance companies to pay out from their fat wallets and huge profits, but on the other hand, if a company has shit IT security and hasn't funded it sufficiently, they don't deserve a payout, and should be made to suffer financially.
That's why insurance should be more expensive if you don't do things correctly. That way, a place can still get some degree of protection from an attack, but they have an incentive to secure themselves properly to minimize the risk. Insurance companies should, if they intend to cover people for computer security events, audit their clients' security and use the results of that audit to set premiums. I think this process will work much better if the insurance companies have to do that for their own profit motive, and that is less common if they always find some excuse why they never have to pay a claim. So, in a complex chain, I think making the act of war provision more difficult for insurance companies to use will probably improve security of companies that choose to buy insurance.
I think that's the main driver of compliance business, from companies like CyberArk selling you a lot of words and a checkbox to scorecards and certifications from the likes of MITRE.
The actual value of those things is somewhat limited. E.g. CyberArk will say a lot about preventing another Snowden but in practice their methodology would be unworkable in any organization and what they really sell is a checkbox (I got this admission from a pushed-to-a-corner employee, who shall remain anonymous, at one of their customer conferences). MITRE will gladly take your money (for their non-profit purposes, of course, a.k.a. drive compensation up enough and you won't have any profits) for testing you, but they generally tell you in advance what they will test. Etc., etc.
However, to qualify for cyber insurance you need some acceptable - to insurance companies who are not cyber experts themselves - and independent benchmarks that will let you qualify for sane premium rates, and this is where compliance companies and organizations like MITRE come handy. You will pay through the nose to the former and you will demand the latter's scores from security vendors (who will pass their MITRE costs to you) to get lower insurance rates and mitigate risks if something bad happens. Just cost of doing business.
With this decision, consider buying compliance stock?
That's all true, and it's certainly no panacea. However, I hope that, if insurance companies decide they're still going to insure cyber risk, they'll eventually put some effort into figuring out which certifications of security policies are good at proving real benefit and which are not. That will only happen if there's a cost to them of not checking, and that will only happen if they have to pay a lot of claims from companies they've insufficiently checked so they fix that process. Maybe some insurance companies will decide that it's still a lucrative market and they'll hire some people to make a better method of auditing and certifying security practices. Or they'll decide it's not and they'll stop selling the insurance, which is also fine with me because then it goes back to being the companies' responsibility to pay for the results of their mistakes.
to insurance companies who are not cyber experts themselves
As I've written before, insurance companies would do themselves a world of self-favors to become computer-security experts, or to perhaps set up an Underwriters' Laboratory-type organization expert in computer security which provides advice to the insurance companies.
Our cyber insurance provider required a security audit before they would renew our cyber policy. They also offered some prepaid consultation hours with a cybersecurity consultancy as a benefit with our policy.
In this case it looks like they are at least trying to improve things for themselves and their clients. There was a definite feeling that they wanted to help us improve our security (and to protect themselves in the process).
Some insurance companies' "security audits" are just a series of checklists with no thinking involved on the part of the auditor. Thus, by checklist rule #188, "Passwords shall be at least eight characters with at least one numeric and one special character", the audited company can pass if their authentication system (AD, NDS, etc.) enforces those minimums, but the root-password-taped-to-the-bottom-of-the-keyboard problem isn't recognized as a problem as it's not in the checklist, and the company will "pass" the "audit".
That your insurance company offered some prepaid consultation hours with a (presumably-) expert computer security company indicates your insurance company is thinking outside of the checklist-security box, which is all to the good.
If the insurance company had argued that the company's IT department had been woefully negligent, they'd have won it. The fact that they didn't shows it's probably a loss adjuster tactic to try to avoid paying out.
Because that's what loss adjusters do: try and avoid paying out at all costs. That's literally their entire business model. If they can find a reason not to pay out on a claim, or at least, to lower the value of it, they will. You might have paid £800 for that TV when it was new, but if it's now in the Argos catalogue* for £400, guess how much you're getting to replace it?
* do they even do the Argos catalogue any more? You get the idea, anyway.
Which is not as pleasant, but at least they'll have to make things clear when you sign the contract rather than trying to slip it in. If a contract makes it clear that I'm not buying something, at least that means I can compare it to other clear contracts. The worst situation is when it looks like I'm buying something but I'm actually not.
But then deciding a pipe that passes about 80% of the legal minimum is not blocked, because some water comes out.
They did eventually fix it - around about the time they would have got the letter from the ombudsman. Funny that.
But it took nine months, and meant my new boiler cost me 15-20% more due to inflation (and who knows how much gas in the meantime) as nobody would quote until the water supply was fixed. Impossible to recover that loss as nobody would quote...
Don't buy their plumbing cover, it's useless.
"Protecting our insureds is the reason they buy insurance. Unfortunately, when that means paying a ransom that funds a hostile state-backed adversary it's not in the interest of our country"
Is the next coming lawsuit about insurance companies only paying the ransom amount if that is lower than the insured costs to clean up the damage after the ransom was not paid?
In the first place, the Geneva conventions were updated after NotPetya to certify that these sorts of things are Acts of War. If the court ruled that the release of NotPetya was not an act of war, the value of this decision as precedence of this appears to be at best limited.
If the court has taken the position that collateral damage, not being intended, is not an Act of War, that is an interesting theory, but contrary to the Geneva Convention. Collateral damage is a major subject of the convention, and parties at war most certainly be held responsible for it. It is not clear why insurance law would deviate from international law on this subject. (Imagine a bomb dropped on a government building that also destroyed a civilian building next to it. Is the destruction of the civilian building not also an Act of War? !?)
If the court has taken the position that the intent of the Russians when releasing NotPetya was to only cause damage in the Ukraine, that is an interesting theory, but contrary to the behavior of Russia under Putin both before and after the incident. The team who created NotPetya was certainly highly professional. They were well aware that such virus always spread beyond their nominative targets. This was not, however, an "unfortunate side effect". It was intended to terrorize Western populations into allowing Russia to do as it pleased. "See what happens when we don't get our way? Do you want more?" Russia's behavior towards Ukraine has not been an undeclared war against Ukraine alone, but against the entire Western system. This was an attack on the West generally, with Ukraine being the immediate target.
I have long hoped that the insurance industry would spur companies to clean up their act. As I have said before, it has sadly become clear that this is not likely to go anywhere. As it stands, almost nobody is any good against an attacker capable of researching their own zero days, and almost every commonly used software has turned up serious security bugs when the adults have dug hard. The reason for this is that the customer does not want to pay for security. No amount of box-checking (SOC II) is going to fix that.
Security surveys & audits are now part of my job. The entire exercise has been quite the letdown. On the other hand, it is extremely clear that a serious audit would involve full access to the code by a team of expert white hats. No one is going to pay for that.
The industry is uninsurable. When the insurance industry fully digests that, we might get a start of some useful change.
For an operation the size of Merck's, with the amount of geographically-distributed legacy technology they have, I would not want to bet that "60 or 70 highly trained security professionals", assuming they could be found and would be willing to work for "$100k/yr" (I certainly wouldn't!) could fix the problem in time.
There are some details about Merck's adventure with NotPetya in Sandworm. It's worth noting that ETERNALBLUE was only patched in 2017 – the same year it was used in NotPetya. That's not a long time to respond, particularly in the context of the continual stream of attacks against any organization of any significant size.
is if this could be twisted around to put liability on the software writers, regardless of their T&Cs, that if their code allows a virus and it's found to be due to the code being sloppy. If the insurance companies could reclaim some of the money paid out from, say, M$ or the other major offenders, perhaps we'd start getting OSs that aren't festering piles of malware.
In most jurisdictions you should already be able to sue for damages if you can prove that the damage was directly (1) caused by a specific piece of software that contains flaws that were introduced willfully or by (gross) negligence while the program was used for its intended purpose. Of course if you are responsible for the system you will need to demonstrate that you did your due diligence (backups, installing security patches, monitoring the system, anti virus, running the software with minimal necessary permissions, ...) to avoid the damage or you might be held liable as well.
Proving that negligence is not as easy as it sounds, especially when defenders can point out that there are dozens of CVE's proving the same vulnerabilities are regularly produced by the biggest software vendors.
(1)Do you expect the producer of the immobilizer in your car to be liable when someone unauthorized manages to start your car and damages other cars in your neighborhood?
An Act of Extreme Snuggles??
Someone has attacked this company with the intent of putting it out of business, harming their customers and employees, and causing untold damage, delay, lack of earnings etc. In addition they've done it against a medical company so that's patients as well. I'd consider that an act of war against the company and against the state wherein that company resides for one simple reason. *PATIENTS*. This by extension is an attack on the population of the country concerned which will likely cause harm and death and that, by definition, is an act of war. If it was Ford, or FCA, or a company that makes greetings cards? Not so much, but this is an act against a state albeit indirectly.
Given the hospital I'm being treated at was recently hit by the same situation I'd happily hunt these people down if I was a government and publically execute them on national daytime TV, because this situation can, and probably already has, cause(d) deaths and it needs to be stopped, stone dead if you'll excuse the pun. They're should be a law, you attack any health, water, power, or infrastructure related business and get caught and its a headshot on daytime TV.
And considering the business Merck is in, they need to be up and running as soon as possible because they're a MAJOR player in their market. But they won't because "probably communism" to help a fundamental health business keeping your citizens alive...
PS. Mods. Getting kinda tired of cretins hunting down three month plus old comments to down vote them because in my opinion the sun doesn't shine out of #Retardistans arse, you know the country that bankrolled the Soviets, Nazis (not fascists), bin Laden, Hussein, Gaddafi and the IRA... And have an unhealthy relationship with #Kiddiepizza...
Seems fair. I mean, to me it seems clear the "act of war" exemption is meant so, if some city got a nuclear bomb dropped on it, it wouldn't immediately bankrupt every insurance company in the country (that did any significant underwriting in that city). Not so an insurance company can insure for ransomware, and then weasel out of paying for it. (That said, $1.4B? Merck must have bought pretty good insurance!)
Insuring against hacking/malware threats may not be commercially viable. if I ran an insurance company, I wouldn't offer it.
Although insurers have a poor reputation - often deserved - they have a risk model and if something is too great a risk, they can't insure it.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
