Cyber Security Insurance

Cyber attacks mean business risks

People have been talking about the inevitable rise of cyber security insurance for more than a decade now. Cyber attacks have grown into a significant business risk, and an important component of reducing this type of risk is via transfer through insurance policies. In spite of expectations and mainstream attention that the topic of cyber attacks and theft has received over the last few years, this market has been slow to build.

There are four generally-accepted ways for dealing with business risk:

  1. Acceptance: budgeting for expected losses.
  2. Mitigation: deploying processes or technologies to reduce risk.
  3. Avoidance: modification of business practices in the hope of reducing risk.
  4. Transfer: insurance as a hedge against risk.

Typically, some combination of these strategies is implemented, depending on the particular risk. With respect to business risk associated with attacks on computer and communication systems, acceptance and mitigation continue to be the preferred choices of enterprises. Despite this, insurance carriers remain bullish that cyber security insurance is a growth market.

Insurance Against Cyber Threats

In the most general and highly-simplified sense, there are two types of cyber security insurance:

  • First-party insurance covers direct harm to a company such as loss of income due to incapacitated networks, cost of network repairs and impact of loss on corporate reputation due to attack.
  • Third-party insurance covers losses to a company’s customers in the event that their personal information or other data is compromised.

There are very few standards in the cyber security market with respect to what is or is not covered in policies. This helps explain the slow growth of the first-party insurance market, which is one of the more striking features of the current industry. Policies are beginning to mature and available policies on the market today include network security liability, privacy liability, crisis management, identity theft response, cyber extortion, network business interuption and data asset protection.

Third-party cyber security insurance is currently more of a success story. This could be partly because third-party insurance often covers costs associated with fulfilling the requirements of breach notification laws. Costs due to such a breach can be significant and can include forensics investigation, regulatory reporting requirements and notification costs, public relations, legal, call center and credit monitoring services for customers.

The Good (and Bad) News

According to a recent Ponemon Institute survey of risk management professionals in U.S. private sector organizations, cyber security has become a mainstream business concern. Respondents rated the need to protect against cyber security risks as comparable to other insurable risks, such as natural disasters or fire. Confirming the severity of this concern, 31 percent of the organizations in the survey stated that they currently have a cyber security policy, and 39 percent stated that their organizations have plans to purchase a policy.

For those under the impression that insurance carriers would add some much-needed data rigor to the cybersecurity risk management markets, there is some bad news; they simply are not there yet. The truth is that carriers believe technical controls account for a relatively small percentage of the overall security posture of an organization and that they can build risk models without a detailed understanding of these controls for a particular customer.

The Best Practice Framework

The cyber security best practice framework is currently being developed through the National Institute of Standards and Technology (NIST), the goal of which is to help critical infrastructure providers reduce their risk exposure through the adoption of agreed-upon best practices. This strategy is to include insurance carriers in the process of developing the framework with the goal of building “underwriting practices that promote the adoption of cyber risk-reducing measures and risk-based pricing, and foster a competitive cyber insurance market.” In other words, it is hoped that adoption of the framework will lead to lower cyber security insurance premium costs.

Going Forward

The cyber security insurance market may well be at an inflection point. National media coverage of cyber attacks has brought knowledge of these threats to the mainstream audience.

This is the thinking behind the Security and Exchange Commission’s (SEC) decision to issue guidance with respect to how cyber risk should be discussed in the SEC filings of public companies. SEC guidance is currently considered a recommendation rather than mandate, but it’s a start; and research shows that it is having an effect on the way in which public companies are describing their cyber risks.

To flourish, the cyber security market needs the trend of increased transparency in cyber risk.

This article originally appeared in the February 2014 issue of Security Today.

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • New Uses for AI

    New applications of AI in IP cameras are delivering precise detection, robust search capabilities, elevated data analysis and enhanced image quality. When combined with built-in analytics, AI can help streamline forensic investigations and also supports several mission-critical business functions. Read Now

  • The Critical Missing Piece

    As technology advances, security programs have invested heavily in advanced systems and sensors. These sensors generate massive amounts of data, often overwhelming the security teams tasked with monitoring them. AI technology promises to sift through this data, using logic and reasoning to differentiate potential threats from non-threats. Read Now

  • Computers Beginning to Come Back Online After CrowdStrike Caused Crash Friday

    Computers around the world are beginning to come back online after a defective update to Windows machines from cybersecurity provider CrowdStrike Friday affected almost 9 million machines. Read Now

Featured Cybersecurity

Webinars

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3