Y2K Rears Its Head One More Time - Insurance Thought Leadership

Advertisement

http://insurancethoughtleadership.com/wp-content/uploads/2014/04/bg-h1.png

Facebooktwitterredditpinterestlinkedinmail

December 8, 2016

Y2K Rears Its Head One More Time

Summary:

Recent attacks via potent malware may not be covered in policies because of long-forgotten exclusions designed for the Y2K scare.

Photo Courtesy of Pixabay

In the late 1990s, in the run up to Jan. 1, 2000, insurers deployed Y2K or “electronic date recognition” exclusions into a multitude of insurance policies. The logic made sense: The Y2K date change was a known risk and something that firms should have worked to eliminate, and, if Armageddon did materialize, well, that’s not something that the insurance industry wanted to cover anyway.

Sixteen years later, one would expect to find Y2K exclusions only in the Lloyds of London “Policy Wording Hall of Fame.” But no so fast.

Electronic date recognition exclusions are still frequently included in a variety of insurance contracts, even though it’s doubtful that many folks have given them more than a passing glance while chuckling about the good old days. And now is the time to take a closer look.

Last month, various cybersecurity response firms discovered that a new variant of the Shamoon malware was used to attack a number of firms in the Middle East. In 2012, the original version was used to successfully attack Saudi Aramco and resulted in its needing to replace tens of thousands of desktop computers. Shamoon was used shortly thereafter to attack RasGas, and, most notoriously, the malware was used against Sony Pictures in late 2014. Shamoon has caused hundreds of millions of dollars of damages.

The new version, Shamoon v2, changes the target computer’s system clock to a random date in August 2012 — according to research from FireEye, the change may be designed to make sure that a piece of software subverted for the attack hasn’t had its license expire.

This change raises issues under existing electronic date recognition exclusions because many are not specifically limited to Jan. 1, 2000; they instead feature an “any other date” catch all. For example, one of the standard versions reads, in part:

“This Policy does not cover any loss, damage, cost, claim or expense, whether preventative, remedial or otherwise, directly or indirectly arising out of or relating to any change, alteration, or modification involving the date change to the year 2000, or any other date change, including leap year calculations, to any such computer system, hardware, program or software and/or any microchip, integrated circuit or similar device in computer equipment or non-computer equipment, whether the property of the Insured or not.”

See also: Insurance Is NOT a Commodity!  

By our estimation, this exclusion is written broadly enough to exclude any losses resulting from a Shamoon v2 attack, if indeed the malware’s success is predicated on the change in system dates to 2012.

Given that the types of losses that Sony and Saudi Aramco suffered can be insured, firms shouldn’t be caught off guard. We advise a twofold approach: Work with your insurance broker to either modify language or consider alternative solutions; and ensure that your cybersecurity leaders are monitoring your systems for indicators of compromise, including subtle measures like clock changes.

description_here

About the Author

Scott M. Kannry is the chief executive officer of Axio Global. Axio is a cyber risk-engineering firm that helps organizations achieve more comprehensive cyber risk management through an approach that harmonizes cybersecurity technology/controls and cyber risk transfer.

More articles by Scott Kannry:

follow @ITLUpdates for more stories like this

Email Scott

+ READ MORE about this author ...

Like this Post? Share it!

Add a Comment or Ask a Question

blog comments powered by Disqus
Do NOT follow this link or you will be banned from the site!