Cyber Security Insurance
Cyber attacks mean business risks
- By Andrew Braunberg
- Feb 05, 2014
People have been talking about the inevitable
rise of cyber security insurance for more
than a decade now. Cyber attacks have
grown into a significant business risk, and
an important component of reducing this
type of risk is via transfer through insurance
policies. In spite of expectations and mainstream attention
that the topic of cyber attacks and theft has received over the
last few years, this market has been slow to build.
There are four generally-accepted ways for dealing with business
risk:
- Acceptance: budgeting for expected losses.
- Mitigation: deploying processes or technologies to reduce risk.
- Avoidance: modification of business practices in the hope
of reducing risk.
- Transfer: insurance as a hedge against risk.
Typically, some combination of these strategies is implemented,
depending on the particular risk. With respect to business
risk associated with attacks on computer and communication
systems, acceptance and mitigation continue to be the preferred
choices of enterprises. Despite this, insurance carriers remain
bullish that cyber security insurance is a growth market.
Insurance Against Cyber Threats
In the most general and highly-simplified sense, there are two
types of cyber security insurance:
- First-party insurance covers direct harm to a company such as
loss of income due to incapacitated networks, cost of network
repairs and impact of loss on corporate reputation due to attack.
- Third-party insurance covers losses to a company’s customers
in the event that their personal information or other data is
compromised.
There are very few standards in the cyber security market with
respect to what is or is not covered in policies. This helps explain
the slow growth of the first-party insurance market, which is one
of the more striking features of the current industry. Policies are
beginning to mature and available policies on the market today
include network security liability, privacy liability, crisis management,
identity theft response, cyber extortion, network business
interuption and data asset protection.
Third-party cyber security insurance is currently more of a
success story. This could be partly because third-party insurance
often covers costs associated with fulfilling the requirements of
breach notification laws. Costs due to such a breach can be significant
and can include forensics investigation, regulatory reporting
requirements and notification costs, public relations, legal, call
center and credit monitoring services for customers.
The Good (and Bad) News
According to a recent Ponemon Institute survey of risk management
professionals in U.S. private sector organizations, cyber security
has become a mainstream business concern. Respondents
rated the need to protect against cyber security risks as comparable
to other insurable risks, such as natural disasters or fire. Confirming
the severity of this concern, 31 percent of the organizations in
the survey stated that they currently have a cyber security policy,
and 39 percent stated that their organizations have plans to purchase
a policy.
For those under the impression that insurance carriers would
add some much-needed data rigor to the cybersecurity risk management
markets, there is some bad news; they simply are not
there yet. The truth is that carriers believe technical controls
account for a relatively small percentage of the overall security
posture of an organization and that they can build risk models
without a detailed understanding of these controls for a particular
customer.
The Best Practice Framework
The cyber security best practice framework is currently being developed
through the National Institute of Standards and Technology
(NIST), the goal of which is to help critical infrastructure
providers reduce their risk exposure through the adoption of
agreed-upon best practices. This strategy is to include insurance
carriers in the process of developing the framework with the goal
of building “underwriting practices that promote the adoption of
cyber risk-reducing measures and risk-based pricing, and foster a
competitive cyber insurance market.” In other words, it is hoped
that adoption of the framework will lead to lower cyber security
insurance premium costs.
Going Forward
The cyber security insurance market may well be at an inflection
point. National media coverage of cyber attacks has brought
knowledge of these threats to the mainstream audience.
This is the thinking behind the Security and Exchange Commission’s
(SEC) decision to issue guidance with respect to how
cyber risk should be discussed in the SEC filings of public companies.
SEC guidance is currently considered a recommendation
rather than mandate, but it’s a start; and research shows that it
is having an effect on the way in which public companies are describing
their cyber risks.
To flourish, the cyber security market needs the trend of increased
transparency in cyber risk.
This article originally appeared in the February 2014 issue of Security Today.