Shielding Your Business from Cyber Catastrophes: Insights on Cybersecurity and Insurance

Hey, I'm Joe Brunsman. Ostensibly, I'm just an insurance guy, but I love cyber insurance. I've wrote the best-selling book in the nation on the topic of cyber insurance and cyber law. Former IT guy. I got my degree in robotics, went on to Cary School of Law with a specialty in cybersecurity law. And now I do a ton of cyber insurance. And I love talking about cyber insurance, despite the fact that my wife thinks I'm a giant dork for loving such a niche industry. But I think it's super cool. I'm excited to talk about stuff that 10 years ago. I couldn't pay people to listen to me talk about it. And now it's, you know, the coolest thing going on. So I'm just happy to be here.

I hope I can live up to that. I will do my best to shock and amaze you with the knowledge I have.

does. It does. So before I answer that question, let me just reinforce what you guys were talking about earlier. So, you know, we go all the way back to 2012. That was the FTC ruling in the... in the matter of Franklin's budget car sales, where it said, hey, dealerships are holding large troves of PII. You were subject to the FTC safeguards rule. A new FTC safeguards rule just came out, was it earlier this year? And much more stringent than the last one. So it's like, all right, well, just because it wasn't your fault doesn't mean it's not your problem, car dealerships. And then on top of that, in the matter of GMR transcription services, that was 2014. where the FTC said, hey, you are responsible for the security of your vendors. So third-party risk management, frankly, like, hey, if you're a car dealership, equipment dealer, et cetera, it's like you're really good at that thing. You are not a third-party risk management assessor.

It's just not what you do. Just like, you know, I can mow my lawn. I just hate doing it. So I'm trying to hire somebody else to do it. So it's like, hey. dealerships start leaning more heavily upon the subject matter experts because the risk is there. Now, as far as the business interruption reimbursement, I tell, and this may sound weird because I'm the insurance guy, but I tell all of my cyber insurance clients, hey, a good year for you is when I talk to you once and I take your money. That is victory. A bad year for you is we're talking twice because you're about... to have a really bad month and you're having a really bad day currently. And so I think these dealerships would do very well by themselves to start taking a much harder look at cybersecurity because now hopefully their eyes have been opened. It's like, hey, this can materially impact the revenue of our organization, right?

IT, so to speak, is not this black hole that we just chuck money into. It is a necessary business expense. Just like we pay the power bill to keep the lights on. We have to do this. And those rules are only going to get more and more stringent. And these dealerships need to know, like the leadership of these dealerships, if they go back to the Drizzly case, which was late last year, the FTC is now holding ownership personally liable for data security.

Absolutely. They're coming. In the case of Drizzly, they put a 10-year consent order on the CEO because of a cyber issue. And with that 10-year consent order, Now, I mean, the data security requirements go through the roof. The cost you're going to have to expend is astronomical to get these third-party assessors. They're going to know the federal government's going to be poking around, critiquing everything they do. So they're going to be paying people on the back end that you don't even know exist to look over their stuff before it comes to you. And it's an absolute nightmare for a business to go through.

Zero. Unless they watch my YouTube video.

Well, to a certain degree, you can't. You can't insure everything. My side of the equation, the insurance industry has just done an atrocious job actually explaining to people that cyber insurance does not solve all woes. Legally, it can't. There's plenty of moral hazards. There's plenty of case law that reflects that. And so kind of a basic answer is, hey, within a cyber insurance policy, you most likely have a dependent business interruption reimbursement type clause where hey, somebody you're relying upon, right, that's a vendor, you need that guy to generate revenue for your business, a la CDK Global. If they go down, your business cyber insurance policy can step in and start reimbursing some of those losses. Now, yeah, they probably have that on their policy, but there's caveats to that, which is one, there's going to be a waiting period. It could be hours. It could be days. I've seen up to two weeks.

And then you got to think, okay, well, on top of that, there's kind of practical limitations. It's probably going to be sublimited coverage because insurance industry is saying, hey, we're insuring your company, not everybody else. So there's going to be a finite amount of money there. You're going to have to submit that claim. Now you have to work through that whole process. Every cyber policy is different. So I have to... speaking kind of broad strokes here, but we don't actually know how long this is going to go on for. So, you know, the insurance guy answers, oh yeah, if these guys go down, you'll get reimbursed for it. The technical answer is, nah, there's rules to the game. There's limits to how much you're going to get reimbursed. And then now you might have to evidence that particular loss. Now you got to think, okay, does your policy have a forensics accountant who's going to come in?

Then we got to start saying, okay, and practical terms, the easiest way to evidence how much money you lost is, well, what did you make last year, right? During the same period of time. Now, maybe your business was crushing it last year. Maybe it was doing terrible last year. It's doing amazing this year. And so there's so many variables there to deal with that, you know, the short, the short synopsis is, hey, talk to your insurance guy, look at your cyber policy. Right. Determine if you want to file that claim or not, because there's obviously long term repercussions to filing cyber claims. You got to start kind of weighing the economic decision there in your own personal, I'll say, comfort with risk. And hey, regardless, I'm going to say that every single cyber insurer that's insuring these dealerships, this is their wake up call.

and we've seen it in other industries already, they're going to start saying, are you doing third-party risk management? Are you actually holding your vendors to the same levels of security that you're obligated to hold? People have been answering that question. They have not been doing the due diligence. And so now it's like, well, next year, they're going to be really asking questions. They might ask for proof. All right, show me your vendor list. Who are they doing? Do you have the stock reports for these guys? I love you. And if you don't, you're toast.

So that brings an interesting twist to this whole saga. Now, CDK Global is obviously a massive organization. At least a billion dollar company. I think there are probably more. All over the world. I know here in the US, it's at least 15,000 dealerships that have been impacted. In the breach notification laws, it will say, hey, if law enforcement gets involved, you can put a pause on all this breach notification, etc. Now, what dealerships and just businesses at large, to be fair, don't understand is that, yeah, maybe CDK Global. Just entirely screwed up and they did something completely boneheaded and it's entirely their fault that all your client's information just got stolen. Well, look in the MSA, look at every single state and territory breach notification law in the United States. It's going to say CDK is the data holder. You dealership are the data owner. So guess what? You're paying if it comes down to it, you're going to be paying for.

attorney, forensics, breach notification, credit monitoring. And on top of that, guess what? There are, as of last year, and it's only ramped up, latest numbers from Dwayne Morris, there are 45 class action data breach claims filed every month in the United States. So let's imagine you're a dealership. Maybe you weren't super tight on that third-party risk management, right? Maybe you're not even to blame, but you have some advantageous plaintiff's attorney out there. You have tens of thousands of clients who were sent their breach notification letters. Bam, now you're facing class action claims, potentially in multiple jurisdictions. And you're going to want your cyber policy to deal with that. But to make it even more complicated, and hopefully everybody's following me so far. Tell me if you're not. But because we don't really know what's going on. We heard it's a ransom event, at least according to the latest Coveware report.

70-some-odd percent of ransomware events also include data exfiltration. So this could be, right, you could have second-order, third-order ransoms coming. Yeah.

I think it's... It's a good idea simply because there are so many variables at play. And frankly, you know, I nerd out on this stuff for a decade and all day, every day. And I read all the reports and I get really in the weeds. And there's just so much that we don't know. And this environment is evolving so fast that. Frankly, no one attorney, no really even a team of attorneys can actually say, hey, what's really going to happen here? What's your exposure going to be? Having a cash reserve, I think, is a good idea for any business because, hey, sometimes it snows. You need to bust out the emergency food because you can't get to the grocery store. You were talking about the magnitude of this issue. What dealers... don't yet know because it's not their world. The insurance industry is really looking at, they're looking at this in a real difficult way because there's only so many cyber insurers that really insure dealerships actually.

So now you have this giant potential aggregation of loss. So what are insurance companies going to do? They're going to go, okay, what are the terms and conditions? of our policy here. Because, hey, you're held as a customer of the insurance company to the clear and conspicuous terms of that policy, even if you didn't read it, you didn't understand it, and your insurance guy never told you about it. So within most of these insurance policies, they're going to say, hey, if you have something which could potentially become a claim, a la CDK, you have to report that before you renew your insurance. Now, your insurance renewal is an arbitrary day of the year and law enforcement is definitely involved, intelligence community is involved. We're probably not going to know for quite some time what happened. Hey, if that rolls through your renewal period, right, you renew your cyber insurance, you're like, ah, we don't know yet, whatever, right?

No one said that there's been a breach yet. And then CDK Global comes out and they say, oh, hey, by the way, all this information got stolen or there's... evidence that's on the dark web, et cetera, obviously insurance companies are going to go, what's the easiest way to save billions of dollars? They're going to say, well, let's take a real hard look at that notification provision. And most business owners just don't know that that's a thing. They're thinking, oh, well, if I have a cyber claim, I have to report it. And it's like, no, there's something called a written notice of circumstance in most of these policies. And just given the magnitude of this issue, It's like, hell yeah, the insurance industry is going to go, well, do we want to pay out billions of dollars or do we want to try and deny a claim because

Yeah. So to get back to your original point there, Ron, it's like, yeah, you probably should have some money set aside and you don't know. Hey, what's the probability that the FTC is going to come knocking? What's the probability that, say, your state attorney general is going to say, well, Did you do third-party risk management? Were you adhering to our reasonable cybersecurity safeguards? What are the odds that a class action claim is going to rise against you? And business owners don't know the breach notification law that applies depends on where your clients are residents of. So maybe, right? I bought my truck from a dealership in Pennsylvania. I'm a Maryland resident. So if my information got stolen, they have to adhere to Maryland breach notification law. Maybe they had a guy come from Massachusetts. Now they're subject to 201 CMR 17. That's 18 different administrative, technical, and physical safeguards that they have to evidence.

And guess what? The AG is going to ask for, hey, where's your written information security plan? What are you doing with third-party risk management? And I would wager a lot of these dealerships simply don't know that information. They don't have those policies in place, much less are they enforced. And they're about to get a real big wake-up call that this could get very, very bad, very, very expensive in a whole bunch of ways that they probably don't even want to know about.

Drives my wife nuts.

That's right. That's right.

To answer Kevin's question about, you know, is the FTC going to take a look at this? Right now, FTC chairwoman Khan has just been losing hand over fist and it hasn't stopped her yet. And so, I mean, this is a circumstance where they're... So many people are impacted and it has such a massive potential economic detriment to our country and really to many countries around the world that I would be shocked if they don't. I mean, it would just, I'd be dumbfounded if the FTC did not go after, start looking into CDK Global and what's been going on there.

Yeah, and there is actually the component of the average consumer has zero control over their information once it goes into these dealership systems. And so I'm not particularly a big fan of large government, but it's like, okay, this seems to me to be... a very rational reason to have the government come in to say, we have to protect the end consumer. And if that means we're putting the screws to a billion dollar corporation, Chairwoman Khan has had zero qualms about doing that. Now, will the FTC go after dealerships individually? Probably unlikely that they'll do that, but that's probably more the territory of you could have various attorneys general. Obviously, the plaintiff's bar via class action claims. Once again, I would be dumbfounded. If it turns out there's actually a data breach here, I'd be shocked if there's not. Probably, given the scope of this, a class action claim launched in every single state.

Actually, probably multiple class action claims. Then you start thinking about, okay, how is this going to impact the insurance side? What I often tell people is, You know, yes, I'm the insurance guy, but before I ever did insurance, I was an IT guy. And it's like, you're going to increase your security the easy way or the hard way, right? You got two choices here. Now, the easy way is you go, all right, this isn't going to get any simpler. It's not going to get any easier. How do you eat an elephant one bite at a time? So we might as well just jump in, get this thing going, lock it down the best we can. So that way, if we do have regulators, if we do have attorneys coming after us, we can evidence we did the best we could with what we had. We just happened to get bit, right? The hard way is what everybody is about to experience, which is insurance companies mandating things, right? Governments starting to mandate additional controls.

And you'll see in every single, every single breach notification letter, it'll always say at the bottom, Like, hey, magically, we have found more money to increase our security and we're ramping it up, et cetera, et cetera. Right? Every single time. You're going to see that. So anybody listening to this, hey, just go look up publicly available breach notification letters. There's, I think,12 states off the top of my head where you can find this. Just start poking through and they're all going to say that. Right? So it's, hey, don't wait until like two weeks before you get your renewal. to suddenly figure out that your insurance company is saying, hey, now you need EDR on every single endpoint. Why don't you have a 24-7 SOC? Where's your third-party risk management reports? We want to see this policy, etc. That's just not enough time to implement that stuff.

Just do it the easy way, which is I always tell all my clients, okay, I don't have insight into your network architecture. That's obviously not what I do. I'm your insurance guy. I know some stuff based on the questionnaire. The easiest thing to do if you're a dealership is you're not an IT guy. Go to your MSP. Go to your IT folks and say, give me a wish list to increase our security. Rank it, right? Biggest bang to the buck, moving down, right? Like what can we do right now to increase our security, right? At what cost? And then just start chipping away at it. And one thing I would add, to get a little even dorkier here is one of the benefits of being an insurance guy is that I get to play the idiot and nobody ever calls me out on it. So I was at a conference and I was sitting in the back in the speaker's room and they had actually brought in a plaintiff's bar attorney who did class action claims following data breaches.

So he's like, what are you doing here? And I said, oh, I'm just, I'm the insurance guy. Just here to talk about cyber insurance. And then I proceeded to pick his brain for the next half hour. And one of the things that he said that always stuck with me is I was like, hey, super very self-important attorney guy. What's the one thing you see, right, when you're going through discovery and you subpoena stuff and you're like, I got him dead to rights, I'm buying a new boat. And he's like, ah, it's simple. He goes, every single time. He goes, we start subpoenaing emails about data security between say like management and IT, right? And IT every time, right? There's an email where it's, hey, we need this thing. We have this giant vulnerability. This is really bad, right? And then management goes, ah, we don't have the money for it. He goes, dad to rights, got him. He's like, daddy's buying a new boat.

So I was like, all right, what's the reverse of that, the obverse of that? Like, what would you hate to see? And he goes, oh, it's super easy. He goes, plan of action and milestones, POA and M. He goes, no business has unlimited funding. He goes, but what would really kill us is if somebody came in front of the court and they said, yeah, we got hit. And you're right, we didn't have that control that would have fixed it. But we had sat down with the CIO, CISO. you know, CFO, CEO, the board. And we had a plan and we said, all right, we don't have unlimited money, but given the funding constraints we have, given the prevalent risks that are, you know, present in the world, in the next four months, we're going to implement this, right? And then in six months, we have to reassess this. And then a year from now, we're going to have funding for this, right? And he goes, juries, juries would love that.

He goes, juries, he goes, you know, juries will side with you. If you show them like you were trying to be responsible, he's like, but if you were intentionally irresponsible, daddy gets a new boat. And so I would just urge everybody, go to your IT folks, get that plan in place and start saying, okay, what do we need to do to start chipping away at this problem? It'll save you. It's good stuff. Okay.

Well, and to make this, to add, I guess, one final wrinkle. Let me quote from Understanding Insurance Law 6th edition that might add a little, I wouldn't call it clarity, a little, I don't know, spice to this whole conversation. So, quoting here, the default rule is that agents and brokers have no duty to advise their insureds about the adequacy or appropriateness of the insurance coverage they purchase. Or about optional coverage that might be available. Now let's segue that into the fact that, hey, you know what? The insurance industry is not super fun or not super excited about shelling out hundreds of millions, billions of dollars because of one event. And so there are plenty of business owners out there where they have to understand, hey, they never read their cyber insurance policy. Well, guess what? The guy that sold it to you, he probably didn't read it either.

And even if he did, he may not understand what it actually says because he kind of needs at least some modicum of IT knowledge to begin with. And so, hey, guess what? Cyber policies have, some of them, they have widespread event exclusions, right, to save the bottom line of the insurance company so that they don't go bankrupt. Now, there's different thresholds in that widespread event exclusion. And so, somebody listening to this. has that on their policy, and they probably don't even know it. And then they're going to have potentially critical vulnerability exclusions, right? They need to know what that is. They need to talk to their IT folks about that, right? There could be zero-day exclusions. There's all types of potential ways that cyber insurers could get out of coverage if they can get away with it. And so, you know, my point here is, hey, cyber insurance, it's a reserve parachute. Right?

It's when the full defense in depth for your business has been penetrated. It is not the go-to answer. Right? It is not, oh, something happened, let's get cyber insurance. Cyber insurance is getting really tired of paying out on stuff that should have been patched. Right? It's a moral hazard for the insurance industry. They're doing everything they can to try and get away from paying out for that stuff.

Oh, it already is.

No, it's already happening. I'll say five, six years ago, cyber insurance was the wild west and I loved it and it was super fun because I could get anything I wanted at any amount with any term and condition that I could throw in there. The underwriters had no idea what they're doing. Insurance companies are just happy to get some money and everybody was hunky-dory. What we're seeing really in the last few years is like 40 years of policy evolution just squished. into a couple years you know and it's a really difficult area and as uh charlie munger uh was recently quoted as saying cyber insurance may be rat poison right there's a lot of insurance companies they're writing this stuff because they think they have to and it's a economic issue and it's a competitiveness issue but they're not super excited about it to be honest and so If you actually look under the hood, a lot of these cyber insurers and you talk to the underwriters, you talk to the actuaries, there's a whole lot of question marks and they're getting a lot more serious about what they're willing to insure, what they're not willing to insure.

And so, you know, companies, it's like, hey, maybe you've gotten away with your small organization and you have literally zero security and your, you know, cousin's uncle's nephew's best friend comes in every six Thursdays to, you know. Make sure that Outlook is working right. Those days are over. And you will not get cyber insurance. And you're going to get hit. You're going to get crucified by the plaintiff's bar. Something's going to happen. I mean, hell, I had one client where they just happened to do a tax return for this one attorney for one year, five years ago. His information got breached. Class action claim. Right there. Right? So, you know. People think, oh, they're only going after the big guys. It's like, well, if they go after the big guys, it's going to impact all the small guys.

But why rob Fort Knox and get shot in the face by a tank when you could go after 20 small credit unions, Bonnie and Clyde style, and get away with it for quite some time? And there's no – people often ask me, well, why doesn't law enforcement do something about this? And I'm like, think about it this way. If you're – let's say you're a smart kid. in some third world country somewhere, in a day, you can make more money than all of your ancestors combined since the dawn of time. And there's no extradition treaty. They're probably never going to find you. And damn it, you want that Ferrari. Well, hey, there you go. Right? That is, it's like terrorism. You have to be right every time. They only have to be right once. And so this problem is not going away. It's only going to get worse. You throw AI into the mix. It's going to get a million times harder. So on that, you know.

it's fun. I was nerding out on this stuff for like a decade and nobody cared and I couldn't pay someone to listen to me talk about it. So I always think it's fun when I get to just nerd out on stuff that I think is super interesting. It's constantly changing. It's always evolving. Yeah, I get to bring in the legal side a little bit and the insurance side and some of the IT stuff. I get to mix and match all this stuff in my head. I get to help people and I think it's awesome.