Why DFIR Is Needed in Partnership with Cyber Insurance

A digital forensics and incident response (DFIR) firm partners with customers to swiftly contain incidents and conclusively restore systems after an attack. A DFIR will be familiar with your organization and have an understanding of your network in the case of a cyber incident.

DFIR services exist to prevent a hall of mirrors from needlessly impeding response actions, execution of incident response plans and supporting crucial processes that affect insurance claims and other dependencies. Whether at the first subtle signs of suspicious network activity, or the rapid physical disruption of commerce, transportation and healthcare – as in the case of the NotPetya ransomware – DFIR teams deploy at a moment’s notice to intercept attacks, save precious electronic evidence, perform damage control and determine what is necessary for secure restoration. Importantly, they may have to do these steps simultaneously or in very specific order to best-serve the victim, whose industry might also have norms about calling in law enforcement, notifying regulators, proving compliance to insurance or sharing intelligence with peers.

It is no surprise that DFIR roles and relationships determine cyber insurance’s current stakes and foreseeable future. Did you know that according to Society Insurance, 51% of cyber claim costs were associated with IT forensics in 2018? If an organization does not have sufficient DFIR experts and resources in place before an incident happens, they can easily end up paying more for remediation in the end – without the advantages these experts and experience could have delivered along the way.

Between incidents and particularly when insurance policies are being acquired and updated, Pondurance combines veteran DFIR insights with advisors’ eyes to proactively examine customers’ posture and preparedness.

Knowing your insurance policies’ coverage and limits before a cyber incident happens is crucial. Uncertainty can cost a great deal in response time and financial losses. While digital risks apply to nearly every facet of business today, insurance sold to cover common business risk does not always cover their “cyber” equivalents.

As a 2020 report from the Organisation for Economic Co-operation and Development (OECD)4 notes, “Much of the variation in coverage results from differences in definitions, conditions and exclusions as policies have evolved very quickly, hindering the emergence of standardised language.”

It is common for a company to call our team in for urgent incident response and not realize until halfway through the engagement whether they actually have applicable cyber coverage, because there may be confusion about what different corporate policies cover. This is a classic example of why it is important for every company’s cross-functional crisis response team with members representing the C-Suite, operations, risk, legal, IT and other departments to have a clear understanding of current insurance coverage beforehand.

Navigating cyber insurance’s higher stakes is a daunting proposition for even the largest Fortune 500 organizations. Buyers seeking new or updated insurance policies need an objective, outside set of eyes to help scope and tailor coverage, while providing ongoing risk management advice.

Pondurance performs this role across a host of industry sectors, bringing years of insight from monitoring customer networks, responding to incidents, tracking evolving threats and distilling data necessary for more risk-based decision-making.

When finalizing cyber insurance policies, policyholders benefit from “writing in” (specifying) their designated, go-to response firm for incidents. Specifying your own response firm, particularly one already familiar with your operations and insurance situation, is a pivotal step underpinning the total value of a policy.

Pondurance takes the data-first philosophy into every security consultation, insurance assessment and advisory conversation any time customers launch M&A, modernization, pandemic response and other initiatives. Following the data is essential for dispelling assumptions and a false sense of security. Companies cannot afford to wait until a crisis happens to discover whether an incident is covered.

A policyholder not establishing their designated firm will have to work with one of their insurance carrier’s default, incident response partners who focus on meeting the carrier‘s interests, first and foremost.

In cyber insurance matters, Pondurance works as the policyholder’s advocate and ally, using knowledge of our customers’ security architecture and wider industries to conclusively determine what happened, from the root cause of an incident through downstream consequences. In incident response work, Pondurance helps customers execute plans and facilitates crucial time-sensitive processes, from helping preserve evidence and IT operations, to supporting insurance claims and independently verifying when affected systems are fully restored. In a tornado analogy, this goes beyond measuring holes and taking pictures of debris. Pondurance helps clients with the IT equivalents of getting utility services restored, inventorying possessions in a new, secure space and assessing how recovery construction can improve ruggedness and resiliency in the end.

Specifying your own response firm, particularly one already familiar with your operations and an insurance situation is a pivotal step underpinning the total value of a policy.