2022年9月23日

黑莓和Corvus Insurance(总部位于美国，在澳大利亚设有分支机构的保险科技公司)最近发布了一项研究，揭示了IT决策者对网络保险覆盖的态度。网络保险覆盖研究在7月份对400多名IT业务决策者进行了采访。调查发现，半数受访者认为保险公司在承保范围方面缺乏透明度是他们面临的最大网络挑战之一。60%(60%)的决策者还表示，他们会犹豫是否与任何缺乏网络保险的组织签订新协议。黑莓威胁研究与情报副总裁伊斯梅尔•瓦伦苏埃拉(见上图)表示，该报告进一步证明，在网络保险方面，该行业“真的很不成熟”。新泽西的Valenzuela说:“无论是要求这些保护政策的组织方面，还是保险行业对行业内发生的事情的了解方面，都不成熟。”这位网络专家提到了哈佛大学肯尼迪学院计算机安全专家布鲁斯·施奈尔的一篇文章。这个故事将购买网络保险比作购买汽车或购买健康保险。他说:“当顾客购买健康保险时，他们比保险公司有优势，因为保险公司会问他们关于健康的问题，但只有顾客才真正知道他或她的感觉和情况。”瓦伦苏埃拉说，这种情况在二手车销售中正好相反。 “The salesperson knows more about the car than you do, so you’re at a disadvantage,” he explained. Valenzuela said Schneier saw the cyber security industry as quite unique. “Cyber security is one of the few industries where none of the parties, neither the seller nor the buyer, know what’s going on, that’s the reality,” he said. Valenzuela said insurance companies try and do due diligence but are providing solutions that are often too generic. On the other side of the transaction, the buyers of cyber insurance policies, he said, are too often doing so mainly for compliance purposes or to ensure they are considered for government projects or even to avoid investing in real cyber security measures. He advocated for an approach that focuses more on practical assessments of the cyber risks, rather than just checklists. Valenzuela said government agencies working with contractors, for example, are demanding these organizations do tabletop exercises as part of their risk assessment. He said cyber insurance coverage could depend on simulating cyberattack scenarios and showing the insurance company the results of those simulations. “For larger organizations this could involve having a practical test where you hire a company that will come and do an emulation as if they were attackers and then evaluate how good your defences are,” he said. “These are things that I think are going to happen more frequently.” He said some insurance companies are also demanding that the firms they insure have their IT networks, cloud platforms and all their cyber security managed and secured by a specialist team or an external firm as part of their managed services. Another way insurers could improve their cyber offerings, said Valenzuela, would be to have more information about the cyber threats specific to regions and industries. “What happens in APAC is very specific to the region,” he said. “It’s very different from what happens in Brazil, Mexico, or in the United States.” By way of example, he said APAC cyber threats more often involve state actors like China targeting intellectual property in the energy sector or attempting to steal healthcare technology.