The widespread system failure caused by a faulty update from the cybersecurity firm CrowdStrike disabled an estimated 8.5 million computers around the world, most notably banking, airlines, health services, some emergency services, and even electric billboards.
The software update interacted unexpectedly with devices running Microsoft Windows OS, sending them into a looping crash that could only be resolved by manually booting the system in ‘Safe Mode’ and installing CrowdStrike’s rapidly released hotfix.
The impact was immediate and global, since both CrowdStrike and Windows (for which the update caused issues) are used worldwide. Simultaneously, Microsoft Azure suffered a DDoS attack, which added further confusion for users of Microsoft applications.
So, what can you do to mitigate such issues in the future?
- Form an incident response plan and test it
Businesses around the world struggled to respond effectively to the outage, and many had to resort to pen and paper. In short, the downtime caused significant interruption to day-to-day digital/automated process.Having a tried and tested incident response plan for system failure scenarios will ensure a coordinated response, even though some disruption is unavoidable. It can help minimise the system outage and resulting financial impairment, reducing the immediate strain on employees, customers, and relevant stakeholders.Typically, cyber insurers provide incidence response services on a 24/7 basis at no cost to the policyholder for the first 72 hours, to offer immediate assistance in the event of a cyber-related incident. A panel of specialists will be at hand to provide key services to help manage and mitigate a cyber incident
- Be aware of the insurance claims process
It can help to be aware of the procedures and claim conditions of your cyber insurance policy. Your cyber insurance policy will be carefully worded to provide exact steps to notify insurers of an incident.At the earliest opportunity, notify insurers of a potential loss, even if you don’t have all the details. At the same time, we recommend you notify your broker or insurance advisers, who can guide you on recovery steps. There will likely also be requirements to notify regulators. Seek the advice of experienced breach response providers to guide you in notifying within the required regulatory timeframe.
- Is a CrowdStrike type incident covered by business interruption insurance?
A standard cyber-insurance policy will provide cover for business interruption losses arising from a security failure in your own environment or from third-party technology outsourced service providers. However, not all policies will provide coverage for business interruption arising from operational failures and system failures of third parties. If this form of cover is in place, it is sometimes sub-limited. Supply-chain failure is recognised by insurers as a principal source of cyber claims, and insurers, therefore, are willing to provide this type of cover to help protect businesses from losses similar to the CrowdStrike incident. With this type of cover, it is important to be aware that there is a waiting period (typically between six to twelve hours for an SME), after which you will be covered up to the policy limit, subject to the terms and conditions.Within the business interruption module under a cyber-insurance policy, this should include the following:1. Loss of revenue
2. Increased costs of working
3. Additional costs incurred to help prepare your business interruption calculation as well as accountancy costs to verify the loss
- Risk management
Make sure you understand the ramifications of an outage in your – or a third party’s – IT systems. It is important to be clear how your insurance policy will be triggered in the event of a loss, and the contractual obligations in place between yourselves and the third party.It is therefore essential that you carry out due diligence on your supply chain prior to appointing any third parties to ensure that you are mitigating your cyber risk.
Stay protected with Elmore
Elmore performs ‘silent reviews’ on insurance contracts to make sure you have the cover you need and expect.
Our cyber team will be happy to discuss your needs and find the best corporate cyber insurance to protect your business.