Insurance companies are coming for the infosec industry

Jeremiah Grossman, the Chief of Security Strategy for California-based endpoint protection company SentinelOne, spoke Wednesday on how he sees insurance companies finding the current flaws in security companies’ business models to the point where they could start to dictate how the industry operates.

LAS VEGAS — Insurance giants are becoming more sophisticated with their cyber insurance packages, which could soon put them in a position to dictate how cybersecurity companies operate, one cybersecurity expert said Wednesday.

“I think it’s only a matter of time before information security’s masters change,” said Jeremiah Grossman, the chief of security strategy for California-based endpoint protection firm SentinelOne, at the 2016 Black Hat security conference. “We’re not going to kowtow to PCI,” or other standards bodies, but be “dictated to by the insurance industry and that is going to change everything about what we do.”

A big reason for that shift is some companies find buying the cyber insurance a better investment than paying for security technology and services that may not prevent hacks to begin with, he said.

“Companies are equally as likely to buy insurance as they are to give it to us to prevent a hack,” he said. “That’s an indictment of our industry, they don’t want to give us any more money to prevent hacks. They would just rather insure the downside and be done with it.”

[Sign up for CyberScoop, our new newsletter focused on cybersecurity’s cutting edge.]

Companies have had cyber insurance for a while, but the policies aren’t covering the full damages from the breaches. For Target’s $250 million loss, the company’s policy paid them back around $90 million. A similar breach at Home Depot cost $43 million, yet the hardware retail company only received $15 million from its policy.

For policies to provide the right amount of coverage (and charge a worthwhile premium), insurance companies normally rely on actuarial data for fine tuning. The amount of data needed to do that doesn’t exist yet. However, Goodman said that won’t be the case for much longer.

“When the breaches happen and the incident response comes in, [insurance companies] will figure out what things you’re doing, what antivirus you’ve bought and what operating system you’ve had, how often you scan it and all sort of things,’ he said. ‘Then they will adjust the premiums based on security posture, and guess what? They are going to be mathematically correct in a way infosec could never be.”

The result? Unless a company meets certain cybersecurity requirements, it could see its premiums spike.

Security vendors can respond to this shift by offering some type of guarantee or warranty if their products fail to stop an attack, Goodman said. He said end-user license agreements have “destroyed any notion of liability.”

“We do not accept this in any other industry except software and security,” Grossman said. “Not TV, not clothes, nothing. Every thing out there comes with some kind of return policy or guarantee except infosec.”

He also voiced support for the Cyber Independent Testing Laboratory, the operation stood up Peiter and Sarah Zatko that will rate the security of software similar to the way the independent Underwriters Laboratories evaluates a range products.

Until that project becomes commonplace, Grossman looks at the cybersecurity industry as a “$75 billion garage sale” — with all sales being final.

“We can do better and deserve to do better.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure