We use thousands of hours in the development of our code. We use powerful pipelines of CI/CD, author extensive unit tests, and are obsessive about encryption on rest and transit. However, despite a zero-trust architecture, there is one parameter that cannot be completely addressed after all the code: human and system risk. As programmers, we tend to be the creators of the most important assets of the company such as its data and its availability. It comes with a great degree of liability with that power.
No longer is it optional to know what the overlap between code and cyber liability insurance is or what is covered or not covered between a freelance consultant or a lead engineer in a startup, or a SaaS founder. It is a basic component of the current technology stack.
The Developer’s Liability Reality
Many software developers work with the belief that they can get away with legal or financial consequences of attacks because they use best practices, i.e. OWASP guidelines, patching, and secure credential management. Nevertheless, the tech world is frequently associated with liability, which can be canceled out by three areas:
- The "Good Faith" Mistake: A misconfigured S3 bucket or a misplaced await loop in a critical payment loop can result in losing data or losing money. Bad days at the syntax level even among the best developers.
- The Social Engineering Vector: You can have the strongest walls in the form of a server, however, once one of your team members is a victim of some smart spear-phishing attack, your firewall is bypassed in all other aspects.
- The Supply Chain Attack: We are all dependent on the third party. When one of the packages in your node modules is compromised through a poisoned update, your application becomes the access point to a breach.
In such situations, it is not only how we correct the bug. But who covers the recovery, the expenses of law, and the loss of the revenue?
What Cyber Liability Insurance Actually Covers
Insurance may seem to a developer like black box logic. To its credit, we must examine the two main elements, which are First-Party Covers and Third-Party Liability.
1. First-Party Coverage: Protecting Your Own Infrastructure
In case your own systems are struck, the first-party coverage covers the emergency costs of incident response. This is nothing but your disaster recovery budget on demand.
- Forensic Investigations: To locate the point of entry and clean up the environment, specialist security firms are hired.
- Ransomware and Extortion: Professional negotiators and in certain instances, the payment of the ransom itself to access the encrypted data again.
- Business Interruption: In case a DDoS attack or a system outage goes down on your SaaS over the course of 48 hours, this coverage will be able to compensate the revenue that you have lost.
2. Third-Party Liability: Protecting You from Client Claims
This is probably the most significant to freelance developers and agencies. In case of a client whose information is stolen due to a defect in the software that you constructed, they might seek your compensation.
- Legal Defense: Since the breach may not have been your fault, defending against a lawsuit is prohibitively costly.
- Regulatory Fines: Frameworks, such as GDPR, CCPA, or HIPAA, are adhered to strictly. The fines in the case of accidental non-compliance can be covered with the aid of insurance.
- Notification Costs: The majority of the jurisdictions demand that companies inform each person who was affected by a breach. Millions of dollars can easily be spent on the mailings, call centers and credit screening of thousands of users.
Cyber Liability vs. Tech E&O: The Crucial Distinction
The distinction between standard cyber insurance and Technology Errors and Omissions (Tech E&O) is one of the most widespread confusing factors in the dev community.
Although they go hand in hand, they are the slaves of different masters:
- Cyber Liability is concerned with the incident (the hack, the breach, the virus).
- Tech E&O is regarding the service (the code did not perform, the project was delayed, the software had a bug which resulted into a financial loss).
An example: In case you develop some fintech software and a bug in it makes it compute interest the wrong way resulting in your client losing $100k, that is a Tech E&O claim. When a hacker uses a weakness in the same software to steal the credit cards of users, this is a Cyber Liability claim. To a developer, the two are the only things which provide the real meaning of full-stack protection.
The Strategic Advantage: Insurance as a Sales Tool
Insurance is turning out to be a non-functional requirement in SaaS in the enterprise and B2B virtual world. Big organizations will hardly enter into contracts with the vendors that are unable to deliver a Certificate of Insurance (COI) containing cyber coverage.
Proactively having a healthy policy in place does not only help you safeguard yourself; it will also reduce the friction of the sales process. It sends a message to your clients that:
- You are Professional: You realize the hazards of your business and have averted it.
- You are Finite: You have the support of a big carrier to claim payment on claims that would otherwise put one small company, or individual developer, in bankruptcy.
- You Value Their Data: You are vested in the game of the safety of their information.
Building a "Claims-Ready" Environment
As we do construct with high availability, we ought to construct with insurability. Auditing your security posture will now be performed by most insurance carriers prior to a policy being issued. Developers should pay attention to the following, to obtain the best rates and the most complete cover:
- Multi-Factor Authentication (MFA): Carriers will now simply refuse to cover until MFA is applied to all internal and external accounts.
- Encrypted Backups: A ransomware coverage plan often requires an "air-gapped" or immutable backup plan.
- Patch Management: The insurer will appreciate you patching with a regular schedule (such as Dependabot) to make it look like you are not leaving the front door unlocked.
Conclusion: The Final Layer of the Stack
We refer to the Seven Layers of the OSI Model, yet, in the business world, we have an unofficial Eight Layer: The Financial Layer. No system is 100% secure. It can be a zero-day vulnerability in a well-used library, or a mere human mishap on a Friday afternoon deployment, but it is a part of the development process, and risk is part of it. Good security is not an obsession with Cyber liability insurance: it supplements it. It will guarantee that when the unthinkable occurs you will have the means to solve the issue, pay off the victims, and continue to do business to write home tomorrow.
