http://sentinelone.com/

JEREMIAH GROSSMAN
CHIEF OF SECURITY STRATEGYAN INSIDERS GUIDE TO CYBER-INSURANCE AND
SECURITY GUARANTEES@jeremiahg
https://www.jeremiahgrossman.com/
http://blog.jeremiahgrossman.com/

BIO

WHO I AM…

▸ Professional Hacker▸ Person of the Year (OWASP, 2015)▸ International Speaker▸ Black Belt in Brazilian Jiu-Jitsu▸ Founder of WhiteHat Security

AREAS OF INTEREST▸ Intersection of security guarantees and cyber-insurance▸ Malware / Ransomware▸ Easing the burden of vulnerability remediation▸ Security crowd-sourcing▸ Industry skill shortage“I OFTEN SAY THAT WHEN YOU CAN MEASURE WHATYOU ARE SPEAKING ABOUT, AND EXPRESS IT IN
NUMBERS, YOU KNOW SOMETHING ABOUT IT;BUT WHEN YOU CANNOT MEASURE IT, WHEN YOUCANNOT EXPRESS IT IN NUMBERS, YOUR KNOWLEDGE
IS OF A MEAGRE AND UNSATISFACTORY KIND."

Lord Kelvin

HYPER-GROWTH INDUSTRY“2015 GLOBAL SPENDING ON INFORMATIONSECURITY IS SET TO GROW BY CLOSE TO 5%
THIS YEAR TO TOP $75BN,…”

The Wall Street Journal

HACKTIVISTSORGANIZED CRIMENATION-STATETERRORISM?

1,073,777,722

NETCRAFT: JULY 2016 WEB SERVER SURVEYNO WAY REGULATIONS CAN KEEP UP.

FREQUENCY OF INCIDENT CLASSIFICATION PATTERNS OVER TIME ACROSS CONFIRMED DATA BREACHES.
VERIZON DATA BREACH INVESTIGATIONS REPORT (2016)

“APPSEC IS EATING SECURITY"
INCIDENT PATTERNS BY INDUSTRYVERIZON DATA BREACH INVESTIGATIONS REPORT (2016)

APPLICATION SECURITY

TRUSTWAVE GLOBAL SECURITY REPORT (2016)

ofyorxi

deInn!

rizat
iong
Fu!
ncInsutio
ffinacilit
SQeny!
tPLInasjeswctioorn!
dRecoveFiryng!
er
prin
tin
gus
eAb

ct

iren!

ioxat!

10%!

DFin!

16%! 15%!

hotA
ut

en

fic
iion

ss

catio

Loe!

20%!

ce

usy!

ger
Aborg!

fin

oo

24%!

Se

ur

so

Re

ct
orredi

Re

es
tF

Re
qu

Spe!

rc

29%! 26%!

Insu
f

le

ic
tab

RL

te

Sint

te

Fo30%!

U

ss

roon

40%!

ed

PrC

e50%!

g!

56%!

ut

tin

Sc
ripe!

ag

yer

60%!

Br

teSiak

Le

La70%!

Cssronat
iom

rt

80%!

CInforra
nspotTficiensuf

In

VULNERABILITY LIKELIHOOD (1 OR MORE)

100%!

90%!

70%!
47%!

11%! 11%! 8%!
6%!

WHITEHAT’S WEBSITE SECURITY STATISTICS REPORT 2015
6%!
6%!
5%!

0%!

TOP 10 VULNERABILITY CATEGORIES BY PROGRAMMING LANGUAGE

VERACODE: STATE OF SOFTWARE SECURITY REPORT VOL 6, FALL 2015

WHITEHAT’S WEBSITE SECURITY STATISTICS REPORT 2015
iltaade

Tr!

191!

Re!

g!

rin

iti
estilUtuace!

ncsuraInal!

ciSo

136!
158!

anuf&&s!

200!

Mencna

are

C

cen!

132!

Fi

lth

ea

Hioats!

ice

130!

lS
ervi

na

ioat

uc

rm

forv

Se

111!

In

erth108!

O

tion!

nt
ifi
c!

traSc
ie99!

inism

Ad

&n!

at
io

150!

Ed

ic

blalon

si

od

97!

Pu

es

mt!

enin
m

tio
n!

73!

ofm

corta

te

En

Ac

&rta

po

100!

Pr

ts

Ar

ns

Tra

AVERAGE TIME-TO-FIX (DAYS)

250!

227!

192!

160!

50!

0!

PERCENT VULNERABILITIESFOUND VS. FIXEDVERACODE: STATE OF SOFTWARE SECURITY REPORT VOL 6, FALL 2015

WINDOWS OF EXPOSURE
Finance &!
Insurance!
Health Care &!
Social Assistance!
Information!

Retail Trade!

39%!
52%!
38%!
60%!

14%! 11%! 18%!

17%!

11%! 12%! 11%! 14%!
11%! 14%! 16%!

22%!

9%!10%!11%!11%!

Always Vulnerable!
Frequently Vulnerable (271-364 days a year)!
Regularly Vulnerable (151-270 days a year)!
Occasionally Vulnerable (31-150 days a year)!
Rarely Vulnerable (30 days or less a year)!

WHITEHAT’S WEBSITE SECURITY STATISTICS REPORT 2015

HOW MANY TIMES DO YOU ESTIMATE THAT YOUR ORGANIZATION’SGLOBAL NETWORK HAS BEEN COMPROMISED BY A SUCCESSFULCYBERATTACK WITHIN THE LAST 12 MONTHS?

CYBER EDGE GROUP: 2015 CYBERTHREAT DEFENSE REPORTNORTH AMERICA & EUROPE

WHAT IS THE LIKELIHOOD THAT YOUR ORGANIZATION’SNETWORK WILL BECOME COMPROMISED BY A
SUCCESSFUL CYBERATTACK IN 2015?

CYBER EDGE GROUP: 2015 CYBERTHREAT DEFENSE REPORTNORTH AMERICA & EUROPE

MORE APATHY“71% WERE AFFECTED BY A
SUCCESSFUL CYBERATTACK IN2014, BUT ONLY 52% EXPECT TOFALL VICTIM AGAIN IN 2015.”

2015 CYBERTHREAT DEFENSE REPORTNORTH AMERICA & EUROPESURVEY’S ALL AGREEDO YOU EXPECT A CYBERATTACK TO STRIKEYOUR ORGANIZATION IN 2015? (N = 3,435)
A. YES
B. NO
C. UNSURE

46%
24%
30%

Respondents are global business and IT
professionals who are members of ISACA.

APATHETIC.
REALISTIC.
BOTH?

RANGE OF EXPECTED LOSSES
RECORDS

PREDICTIONAVERAGE(LOWER)!

(LOWER)!

100!

$1,170!

$18,120!

1,000!

$3,110!

10,000!

EXPECTEDAVERAGEPREDICTION(UPPER)!

(UPPER)!

$25,450!

$35,730!

$555,660!

$52,260!

$67,480!

$87,140!

$1,461,730!

$8,280!

$143,360!

$178,960!

$223,400!

$3,866,400!

100,000!

$21,900!

$366,500!

$474,600!

$614,600!

$10,283,200!

1,000,000!

$57,600!

$892,400!

$1,258,670!

$1,775,350!

$27,500,090!

10,000,000!

$150,700!

$2,125,900!

$3,338,020!

$5,241,300!

$73,943,950!

100,000,000!

$392,000!

$5,016,200!

$8,852,540!

$15,622,700!

$199,895,100!

VERIZON DATA BREACH INVESTIGATIONS REPORT (2015)

DOWNSIDE PROTECTIONCYBER-INSURANCE▸ As of 2014, American businesses
were expected to pay up to $2billion on cyber-insurance
premiums, a 67% spike from $1.2
billion spent in 2013.
▸ Current expectations by one
industry watcher suggest 100%
growth in insurance premium
activity, possibly 130% growth.

BOOMING INDUSTRY“ACCORDING TO PWC, THE CYBERINSURANCE MARKET IS SET TO
TRIPLE IN THE NEXT FEW YEARS AND
WILL REACH $7.5 BILLION BY 2020.”

Dark ReadingHYPER-GROWTH“THE LARGEST BARRIER TO GROWTH IS LACKOF ACTUARIAL DATA ABOUT CYBERATTACKS,BUT THIS IS QUICKLY CHANGING WITHCONTINUED CYBER ASSAULTS.”“ABI RESEARCH FORECASTS THE MARKET TOHIT US $10 BILLION BY 2020.”
ABI Research

BUY WHATEVER THERE IS“ABOUT A THIRD OF U.S. COMPANIESALREADY HAVE SOME FORM OF CYBERINSURANCE COVERAGE, ACCORDING TO AREPORT PRICEWATERHOUSECOOPERS
RELEASED LAST YEAR.”

The Parallax

SMALL PAYOUTS. LARGE PAYOUTS.

BREACH CLAIMS▸ Target spent $248 million after hackers
stole 40 million payment card accounts
and the personal information of up to 70
million customers. The insurance payout,according to Target, will be $90 million.
▸ Home Depot reported $43 million inexpenses related to its September 2014
hack, which affected 56 million credit anddebit card holders. Insurance covered only
$15 million.

LOTS OF INSURERS GETTING INTO THE BUSINESSBREACH CLAIMS▸ “Anthem has $150 million to $200
million in cyber coverage, includingexcess layers, sources say.”▸ “Insurers providing excess layers ofcyber coverage include: Lloyd’s ofLondon syndicates: operating unitsof Liberty Mutual Holding Co.;
Zurich Insurance Group; and CNA
Financial Corp., sources say.”INCIDENTS DRIVING UP COST OF PREMIUMS“AVERAGE RATES FOR RETAILERS SURGED 32% IN
THE FIRST HALF OF THIS YEAR, AFTER STAYINGFLAT IN 2014, ACCORDING TO PREVIOUSLYUNREPORTED FIGURES FROM MARSH.”“AND EVEN THE BIGGEST INSURERS WILL NOT
WRITE POLICIES FOR MORE THAN $100 MILLION
FOR RISKY CUSTOMERS.”The Security Ledger

2014 – 2015
NEW SECURITY INVESTMENT VS. CYBER-INSURANCE

Cyber-Security Insurance~$3.2 billion in spending (+67%)

Informa(on Security Spending (Global)~ $3.8 billion in new spending (+4.7%)$3,200,000,000$3,800,000,000

EVER NOTICE HOWEVERYTHING IN THE
INFORMATION SECURITY
INDUSTRY IS SOLD “AS IS”?
NO GUARANTEESNO WARRANTIESNO RETURN POLICIESINFORMATION SECURITYTHE$75 BILLIONGARAGE SALE

SECURITY GUARANTEESINFOSEC’S BIGGEST OPPORTUNITYSECURITY VENDORSCASE STUDIES▸ SentinelOne▸ WhiteHat Security▸ Trusona▸ Others…

SECURITY GUARANTEEDETAILS▸ Program Launched: July 2016.
▸ Setting up their guarantee with theunderwriter took 3 months.
▸ Claims or payouts? 0.

SENTINELONE’S GUARANTEE OFFERS FINANCIALSUPPORT OF $1,000 PER ENDPOINT (UP TO $1
MILLION PER COMPANY), SECURING AGAINSTFINANCIAL IMPLICATIONS OF A RANSOMWARE
INFECTION, IF SENTINELONE IS UNABLE TOBLOCK OR REMEDIATE THE EFFECTS.

SECURITY GUARANTEEDETAILS▸ Program Launched: August 2014.
▸ Setting up their guarantee with theunderwriter took 18 months.
▸ Claims or payouts? 0.

IF A WEBSITE COVERED BY SENTINEL ELITEIS HACKED, EXPLOITED BY A MISSEDVULNERABILITY, THE CUSTOMER WILL BEREFUNDED IN FULL AND OFFERED UP TO$500,000 IN BREACH LOSS COMPENSATION.

SECURITY GUARANTEEDETAILS▸ Program Launched: January 2016.
▸ Setting up their guarantee with theunderwriter took 18 months.
▸ Stroz Friedberg ran theassessments on behalf of theunderwriter to measureperformance.
▸ Claims or payouts? 0.

MALWARE KITS COME WITH WARRANTEES$249

Malware offered forwith a service levelagreement (SLA) and replacement warranty if thecreation is detected by any antivirus within 9 months

THE CYBER INDEPENDENT TESTING LAB“…THE ZATKOS’ OPERATION WON’T TELL YOU IFYOUR SOFTWARE IS LITERALLY INCENDIARY, BUT IT
WILL GIVE YOU A WAY TO COMPARISON-SHOPBROWSERS, APPLICATIONS, AND ANTIVIRUS
PRODUCTS ACCORDING TO HOW HARDENED THEYARE AGAINST ATTACK. IT MAY ALSO PUSH
SOFTWARE MAKERS TO IMPROVE THEIR CODE TO
AVOID A LOW SCORE AND REMAIN COMPETITIVE.“The Intercept

“THE ONLY TWO PRODUCTS NOT COVEREDBY PRODUCT LIABILITY ARE RELIGION AND
SOFTWARE, AND SOFTWARE SHALL NOTESCAPE MUCH LONGER.”Dan GeerCISO, In-Q-Tel

THANK YOU
Jeremiah Grossman@jeremiahg
https://www.facebook.com/jeremiahgrossman
https://www.linkedin.com/in/grossmanjeremiah
https://www.jeremiahgrossman.com/
http://blog.jeremiahgrossman.com/