Cyber Security Insurance

Cyber attacks mean business risks

People have been talking about the inevitable rise of cyber security insurance for more than a decade now. Cyber attacks have grown into a significant business risk, and an important component of reducing this type of risk is via transfer through insurance policies. In spite of expectations and mainstream attention that the topic of cyber attacks and theft has received over the last few years, this market has been slow to build.

There are four generally-accepted ways for dealing with business risk:

  1. Acceptance: budgeting for expected losses.
  2. Mitigation: deploying processes or technologies to reduce risk.
  3. Avoidance: modification of business practices in the hope of reducing risk.
  4. Transfer: insurance as a hedge against risk.

Typically, some combination of these strategies is implemented, depending on the particular risk. With respect to business risk associated with attacks on computer and communication systems, acceptance and mitigation continue to be the preferred choices of enterprises. Despite this, insurance carriers remain bullish that cyber security insurance is a growth market.

Insurance Against Cyber Threats

In the most general and highly-simplified sense, there are two types of cyber security insurance:

  • First-party insurance covers direct harm to a company such as loss of income due to incapacitated networks, cost of network repairs and impact of loss on corporate reputation due to attack.
  • Third-party insurance covers losses to a company’s customers in the event that their personal information or other data is compromised.

There are very few standards in the cyber security market with respect to what is or is not covered in policies. This helps explain the slow growth of the first-party insurance market, which is one of the more striking features of the current industry. Policies are beginning to mature and available policies on the market today include network security liability, privacy liability, crisis management, identity theft response, cyber extortion, network business interuption and data asset protection.

Third-party cyber security insurance is currently more of a success story. This could be partly because third-party insurance often covers costs associated with fulfilling the requirements of breach notification laws. Costs due to such a breach can be significant and can include forensics investigation, regulatory reporting requirements and notification costs, public relations, legal, call center and credit monitoring services for customers.

The Good (and Bad) News

According to a recent Ponemon Institute survey of risk management professionals in U.S. private sector organizations, cyber security has become a mainstream business concern. Respondents rated the need to protect against cyber security risks as comparable to other insurable risks, such as natural disasters or fire. Confirming the severity of this concern, 31 percent of the organizations in the survey stated that they currently have a cyber security policy, and 39 percent stated that their organizations have plans to purchase a policy.

For those under the impression that insurance carriers would add some much-needed data rigor to the cybersecurity risk management markets, there is some bad news; they simply are not there yet. The truth is that carriers believe technical controls account for a relatively small percentage of the overall security posture of an organization and that they can build risk models without a detailed understanding of these controls for a particular customer.

The Best Practice Framework

The cyber security best practice framework is currently being developed through the National Institute of Standards and Technology (NIST), the goal of which is to help critical infrastructure providers reduce their risk exposure through the adoption of agreed-upon best practices. This strategy is to include insurance carriers in the process of developing the framework with the goal of building “underwriting practices that promote the adoption of cyber risk-reducing measures and risk-based pricing, and foster a competitive cyber insurance market.” In other words, it is hoped that adoption of the framework will lead to lower cyber security insurance premium costs.

Going Forward

The cyber security insurance market may well be at an inflection point. National media coverage of cyber attacks has brought knowledge of these threats to the mainstream audience.

This is the thinking behind the Security and Exchange Commission’s (SEC) decision to issue guidance with respect to how cyber risk should be discussed in the SEC filings of public companies. SEC guidance is currently considered a recommendation rather than mandate, but it’s a start; and research shows that it is having an effect on the way in which public companies are describing their cyber risks.

To flourish, the cyber security market needs the trend of increased transparency in cyber risk.

This article originally appeared in the February 2014 issue of Security Today.

Featured

  • Cloud Adoption Gives Way to Hybrid Deployments

    Cloud adoption is growing at an astonishing rate, with Gartner forecasting that worldwide public cloud end-user spending will approach $600 billion by the end of this year—an increase of more than 21% over 2022. McKinsey believes that number could eclipse $1 trillion by the end of the decade, further underscoring the industry’s exponential growth. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • Securing the Future

    In an increasingly turbulent world, chief security officers (CSOs) are facing a multitude of challenges that threaten the stability of businesses worldwide. Read Now

    • Guard Services
  • Security Entrances Move to Center Stage

    Most organizations want to show a friendly face to the public. In today’s world, however, the need to keep people safe and secure has become a prime directive when designing and building facilities of all kinds. Fortunately, there is no need to construct a fortress-like entry that provides that high level of security. Today’s secured entry solutions make it possible to create a welcoming, attractive look and feel at the entry without compromising security. It is for this reason that security entrances have moved to the mainstream. Read Now

Featured Cybersecurity

New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3