Leverage and Demonstrate Value with

your Cyber Insurance Renewal

Speaker:
Erik Decker, VP & CISO Intermountain Health

#BHUSA @BlackHatEvents
Learning Objectives:

1. Understand the Critical Controls to be Insurable

2. Strategies for Presenting your Program
3. Understand to how to be a “Good Risk”

#BHUSA @BlackHatEvents
 Critical Controls and Foundations
Endpoint Secured, Privileged
Multifactor Email Filtering
Detection and Encrypted and Access
Authentication and Web Security
Response Tested Backups Management
• Assume • Detection and • Test and validate • Highest critical • Phish defense,
credential response, 24x7 critical functions assets first links and
compromise (Domain attachments
admins!)

The above is based on Marsh McLennan, one of the largest cyber brokerage
firms in the world

info.marsh.com/l/395202/2022-03-28/c5ncfd/395202/164985992723Bv0KAI/866595782_US_Cyber_Campaign___12_Key_Cyber_Controls_V3.pdf
#BHUSA @BlackHatEvents
 Other Important Controls
Incident Awareness Asset Logging &
Patch and 3rd Party Risk
Response Training & Hardening & Network EOL Systems
Vuln Mgmt. Management
Plan & Test Phish Testing Restriction Protection

Mandatory Baseline Catalog Determine

Scan monthly Define
annual training config assets assets for critical
(min) processes Segment EOL
(min) (endpoint, logging vendors
systems
server,
network)
Define Action Phishing Focus on key
Integrate with
Plans and Clear RACI Simulation controls (this
SIEM
Mitigate monthly list)
Restrict
Invest in
inbound
SOC upgrading out
Report & Internet ports Build 3rd party
Monitor, esp. Crisis mgmt. & Playbooks of EOL, if
Response (RDP, SMB, Lifecycle
KEVs TTX (e.g., Domain feasible
SOC playbook SSH, DB) Program
Admin use)

#BHUSA @BlackHatEvents
 Presenting Your Program
Executive Overview Cyber Program
Mission / Vision
/ Fundamental Risk Themes &
Principles Key Strategies

Major Business Governance

Overview
Strategies

Demographics
Key Financial
Metrics
Validated Ratings
& Benchmarks
Rating
Agencies Active Projects &
Key Controls

#BHUSA @BlackHatEvents
Likelihood By Event
Type Fictitious Analytics
Privacy
Business Interruption
Ransomware
$350
Total Severity Potential

Millions
$300
1 in 4 Where limits and
Event
$250 probability intersect
Average (based on
Where you will be paying (~1/25)
$200 market) you will be hit
25% out of pocket
(~1/11)
$150
(~1/5)
1 in 6.6
Event $100
$70
1 in 50 $50
15%
Event $25
$0 $5
1 in 2 Events 1 in 5 Events 1 in 10 Events 1 in 50 Events 1 in 100 Events 1 in 200 Events 1 in 500 Events
2%
Total Event Cost Average Retention Limits

A fictitious example of a $10b Organization #BHUSA @BlackHatEvents

 So How Do You Value Your Program?
Increased
Lowering Price
Secondary capacity at
per Million
competing for same PPM
primary
Insuring Response Total Capacity Premium Price per
Organization Million
Primary $10MM $10MM $900,000 $90,000
Secondary A $15MM xs $10MM $25MM $1,000,000 $66,666
Secondaries Secondary B $5MM xs 25MM $30MM $275,000 $55,000
wanting to be
Secondary C $10MM xs $30MM $40MM $450,000 $45,000
higher in tower
Secondary D $20MM xs $40MM $60MM $750,000 $37,500
Secondary E $10MM xs $60MM $70MM $300,000 $30,000
Retention $5MM
TOTAL $70MM $70MM $3,675,000
Lower Retention
at Premium #BHUSA @BlackHatEvents
Questions?

#BHUSA @BlackHatEvents