Cyber Security Insurance

Cyber attacks mean business risks

People have been talking about the inevitable rise of cyber security insurance for more than a decade now. Cyber attacks have grown into a significant business risk, and an important component of reducing this type of risk is via transfer through insurance policies. In spite of expectations and mainstream attention that the topic of cyber attacks and theft has received over the last few years, this market has been slow to build.

There are four generally-accepted ways for dealing with business risk:

  1. Acceptance: budgeting for expected losses.
  2. Mitigation: deploying processes or technologies to reduce risk.
  3. Avoidance: modification of business practices in the hope of reducing risk.
  4. Transfer: insurance as a hedge against risk.

Typically, some combination of these strategies is implemented, depending on the particular risk. With respect to business risk associated with attacks on computer and communication systems, acceptance and mitigation continue to be the preferred choices of enterprises. Despite this, insurance carriers remain bullish that cyber security insurance is a growth market.

Insurance Against Cyber Threats

In the most general and highly-simplified sense, there are two types of cyber security insurance:

  • First-party insurance covers direct harm to a company such as loss of income due to incapacitated networks, cost of network repairs and impact of loss on corporate reputation due to attack.
  • Third-party insurance covers losses to a company’s customers in the event that their personal information or other data is compromised.

There are very few standards in the cyber security market with respect to what is or is not covered in policies. This helps explain the slow growth of the first-party insurance market, which is one of the more striking features of the current industry. Policies are beginning to mature and available policies on the market today include network security liability, privacy liability, crisis management, identity theft response, cyber extortion, network business interuption and data asset protection.

Third-party cyber security insurance is currently more of a success story. This could be partly because third-party insurance often covers costs associated with fulfilling the requirements of breach notification laws. Costs due to such a breach can be significant and can include forensics investigation, regulatory reporting requirements and notification costs, public relations, legal, call center and credit monitoring services for customers.

The Good (and Bad) News

According to a recent Ponemon Institute survey of risk management professionals in U.S. private sector organizations, cyber security has become a mainstream business concern. Respondents rated the need to protect against cyber security risks as comparable to other insurable risks, such as natural disasters or fire. Confirming the severity of this concern, 31 percent of the organizations in the survey stated that they currently have a cyber security policy, and 39 percent stated that their organizations have plans to purchase a policy.

For those under the impression that insurance carriers would add some much-needed data rigor to the cybersecurity risk management markets, there is some bad news; they simply are not there yet. The truth is that carriers believe technical controls account for a relatively small percentage of the overall security posture of an organization and that they can build risk models without a detailed understanding of these controls for a particular customer.

The Best Practice Framework

The cyber security best practice framework is currently being developed through the National Institute of Standards and Technology (NIST), the goal of which is to help critical infrastructure providers reduce their risk exposure through the adoption of agreed-upon best practices. This strategy is to include insurance carriers in the process of developing the framework with the goal of building “underwriting practices that promote the adoption of cyber risk-reducing measures and risk-based pricing, and foster a competitive cyber insurance market.” In other words, it is hoped that adoption of the framework will lead to lower cyber security insurance premium costs.

Going Forward

The cyber security insurance market may well be at an inflection point. National media coverage of cyber attacks has brought knowledge of these threats to the mainstream audience.

This is the thinking behind the Security and Exchange Commission’s (SEC) decision to issue guidance with respect to how cyber risk should be discussed in the SEC filings of public companies. SEC guidance is currently considered a recommendation rather than mandate, but it’s a start; and research shows that it is having an effect on the way in which public companies are describing their cyber risks.

To flourish, the cyber security market needs the trend of increased transparency in cyber risk.

This article originally appeared in the February 2014 issue of Security Today.

Featured

  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West 2024: Post-Show Recap

    ISC West 2024 is complete. And from start to finish, the entire conference was a huge success with almost 30,000 people in attendance. Read Now

    • Industry Events
    • ISC West
  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

Webinars

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3