Cyber Security Insurance

Cyber attacks mean business risks

People have been talking about the inevitable rise of cyber security insurance for more than a decade now. Cyber attacks have grown into a significant business risk, and an important component of reducing this type of risk is via transfer through insurance policies. In spite of expectations and mainstream attention that the topic of cyber attacks and theft has received over the last few years, this market has been slow to build.

There are four generally-accepted ways for dealing with business risk:

  1. Acceptance: budgeting for expected losses.
  2. Mitigation: deploying processes or technologies to reduce risk.
  3. Avoidance: modification of business practices in the hope of reducing risk.
  4. Transfer: insurance as a hedge against risk.

Typically, some combination of these strategies is implemented, depending on the particular risk. With respect to business risk associated with attacks on computer and communication systems, acceptance and mitigation continue to be the preferred choices of enterprises. Despite this, insurance carriers remain bullish that cyber security insurance is a growth market.

Insurance Against Cyber Threats

In the most general and highly-simplified sense, there are two types of cyber security insurance:

  • First-party insurance covers direct harm to a company such as loss of income due to incapacitated networks, cost of network repairs and impact of loss on corporate reputation due to attack.
  • Third-party insurance covers losses to a company’s customers in the event that their personal information or other data is compromised.

There are very few standards in the cyber security market with respect to what is or is not covered in policies. This helps explain the slow growth of the first-party insurance market, which is one of the more striking features of the current industry. Policies are beginning to mature and available policies on the market today include network security liability, privacy liability, crisis management, identity theft response, cyber extortion, network business interuption and data asset protection.

Third-party cyber security insurance is currently more of a success story. This could be partly because third-party insurance often covers costs associated with fulfilling the requirements of breach notification laws. Costs due to such a breach can be significant and can include forensics investigation, regulatory reporting requirements and notification costs, public relations, legal, call center and credit monitoring services for customers.

The Good (and Bad) News

According to a recent Ponemon Institute survey of risk management professionals in U.S. private sector organizations, cyber security has become a mainstream business concern. Respondents rated the need to protect against cyber security risks as comparable to other insurable risks, such as natural disasters or fire. Confirming the severity of this concern, 31 percent of the organizations in the survey stated that they currently have a cyber security policy, and 39 percent stated that their organizations have plans to purchase a policy.

For those under the impression that insurance carriers would add some much-needed data rigor to the cybersecurity risk management markets, there is some bad news; they simply are not there yet. The truth is that carriers believe technical controls account for a relatively small percentage of the overall security posture of an organization and that they can build risk models without a detailed understanding of these controls for a particular customer.

The Best Practice Framework

The cyber security best practice framework is currently being developed through the National Institute of Standards and Technology (NIST), the goal of which is to help critical infrastructure providers reduce their risk exposure through the adoption of agreed-upon best practices. This strategy is to include insurance carriers in the process of developing the framework with the goal of building “underwriting practices that promote the adoption of cyber risk-reducing measures and risk-based pricing, and foster a competitive cyber insurance market.” In other words, it is hoped that adoption of the framework will lead to lower cyber security insurance premium costs.

Going Forward

The cyber security insurance market may well be at an inflection point. National media coverage of cyber attacks has brought knowledge of these threats to the mainstream audience.

This is the thinking behind the Security and Exchange Commission’s (SEC) decision to issue guidance with respect to how cyber risk should be discussed in the SEC filings of public companies. SEC guidance is currently considered a recommendation rather than mandate, but it’s a start; and research shows that it is having an effect on the way in which public companies are describing their cyber risks.

To flourish, the cyber security market needs the trend of increased transparency in cyber risk.

This article originally appeared in the February 2014 issue of Security Today.

If you like what you see, get more delivered to your inbox weekly.
Click here to subscribe to our free premium content.

comments powered by Disqus

Digital Edition

  • Security Today Magazine - November December 2019

    November/December 2019

    Featuring:

    • The Security of Medicine
    • Security Trends to Watch
    • Envisioning What Might Be Ahead in 2020
    • Security Foresights of the New Year
    • Integrated Technology Drives Security

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety