Cyber Security Insurance

Cyber attacks mean business risks

People have been talking about the inevitable rise of cyber security insurance for more than a decade now. Cyber attacks have grown into a significant business risk, and an important component of reducing this type of risk is via transfer through insurance policies. In spite of expectations and mainstream attention that the topic of cyber attacks and theft has received over the last few years, this market has been slow to build.

There are four generally-accepted ways for dealing with business risk:

  1. Acceptance: budgeting for expected losses.
  2. Mitigation: deploying processes or technologies to reduce risk.
  3. Avoidance: modification of business practices in the hope of reducing risk.
  4. Transfer: insurance as a hedge against risk.

Typically, some combination of these strategies is implemented, depending on the particular risk. With respect to business risk associated with attacks on computer and communication systems, acceptance and mitigation continue to be the preferred choices of enterprises. Despite this, insurance carriers remain bullish that cyber security insurance is a growth market.

Insurance Against Cyber Threats

In the most general and highly-simplified sense, there are two types of cyber security insurance:

  • First-party insurance covers direct harm to a company such as loss of income due to incapacitated networks, cost of network repairs and impact of loss on corporate reputation due to attack.
  • Third-party insurance covers losses to a company’s customers in the event that their personal information or other data is compromised.

There are very few standards in the cyber security market with respect to what is or is not covered in policies. This helps explain the slow growth of the first-party insurance market, which is one of the more striking features of the current industry. Policies are beginning to mature and available policies on the market today include network security liability, privacy liability, crisis management, identity theft response, cyber extortion, network business interuption and data asset protection.

Third-party cyber security insurance is currently more of a success story. This could be partly because third-party insurance often covers costs associated with fulfilling the requirements of breach notification laws. Costs due to such a breach can be significant and can include forensics investigation, regulatory reporting requirements and notification costs, public relations, legal, call center and credit monitoring services for customers.

The Good (and Bad) News

According to a recent Ponemon Institute survey of risk management professionals in U.S. private sector organizations, cyber security has become a mainstream business concern. Respondents rated the need to protect against cyber security risks as comparable to other insurable risks, such as natural disasters or fire. Confirming the severity of this concern, 31 percent of the organizations in the survey stated that they currently have a cyber security policy, and 39 percent stated that their organizations have plans to purchase a policy.

For those under the impression that insurance carriers would add some much-needed data rigor to the cybersecurity risk management markets, there is some bad news; they simply are not there yet. The truth is that carriers believe technical controls account for a relatively small percentage of the overall security posture of an organization and that they can build risk models without a detailed understanding of these controls for a particular customer.

The Best Practice Framework

The cyber security best practice framework is currently being developed through the National Institute of Standards and Technology (NIST), the goal of which is to help critical infrastructure providers reduce their risk exposure through the adoption of agreed-upon best practices. This strategy is to include insurance carriers in the process of developing the framework with the goal of building “underwriting practices that promote the adoption of cyber risk-reducing measures and risk-based pricing, and foster a competitive cyber insurance market.” In other words, it is hoped that adoption of the framework will lead to lower cyber security insurance premium costs.

Going Forward

The cyber security insurance market may well be at an inflection point. National media coverage of cyber attacks has brought knowledge of these threats to the mainstream audience.

This is the thinking behind the Security and Exchange Commission’s (SEC) decision to issue guidance with respect to how cyber risk should be discussed in the SEC filings of public companies. SEC guidance is currently considered a recommendation rather than mandate, but it’s a start; and research shows that it is having an effect on the way in which public companies are describing their cyber risks.

To flourish, the cyber security market needs the trend of increased transparency in cyber risk.

This article originally appeared in the February 2014 issue of Security Today.

Featured

  • ASIS International and SIA Release “Complexities in the Global Security Market: 2024 Through 2026”

    ASIS International and the Security Industry Association (SIA) – the leading security associations for the security industry – have released ”Complexities in the Global Security Market: 2024 Through 2026”, a new research report that provides insights into the equipment, technologies, and employment of the global security industry, including regional market breakouts. SIA and ASIS partnered with global analytics and advisory firm Omdia to complete the research. Read Now

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

  • ASIS Announces ANSI-Approved Cannabis Security Standard

    ASIS International, a leading authority in security standards and guidelines, proudly announces the release of a pioneering American National Standards Institute (ANSI)-approved standard dedicated to cannabis security. This best-in-class standard, meticulously developed by industry experts, sets a new benchmark by providing comprehensive requirements and guidance for the design, implementation, monitoring, evaluation, and maintenance of a cannabis security program. Read Now

Featured Cybersecurity

Whitepapers

New Products

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3