Inability to accurately value information holds back cyber insurance

There is a growing awareness of cyber risk among risk managers, as proved by the fact that it was highlighted as one of the major challenges facing the profession in CRE’s 2011 Risk Frontiers Survey. There are also an increasing number of insurance products available for cyber risks. However, said Mr Fishleigh, there is currently an imbalance between the supply from insurers and the demands of insureds in what is still an immature market. Cyber insurance products have tended to come from two different directions—liability underwriters extending their standard coverage to include cyber-related risks and property underwriters that have finally accepted that losses can occur where there is no physical damage. There are even some policies, such as a US-based coverage for the cost of notifying customers in the event of a data breach, where some insurers are stepping back from the market because they believe it is over-supplied.hideThere are though other areas where big gaps in coverage remain, said Mr Fishleigh, such as cyber terrorism and cyber warfare where clear definitions do not yet exist. There is also a lack of standard wordings among all cyber-related policies and different products for the same risks can vary markedly, he added. What is clear, continued Mr Fishleigh at the Risk Frontiers seminar held last month in London, is that the cyber insurance products that currently exist are supply- rather than demand-driven. “Insurers like cyber risk. It is a new product and a new revenue stream.” Furthermore its evolving status means that insurers can still charge a relatively high rate for coverage. Demand from risk managers, however, is not at the same level, said Mr Fishleigh. This is largely due to a failure to understand the value of the information they hold, he added. “Most corporates have not quantified the value of their information so it is very difficult to insure.” Without an accurate assessment of the value of their information it is also difficult to separate those policies that represent value for money from those that do not. “I don’t think risk managers fully understand the risk,” argued Mr Fishleigh. Corporates therefore have to make more accurate and effective assessments of the information they hold and how it should be treated—something that governments, unusually, are very good at, stated the expert. “Documents are graded in terms of importance and confidentiality and this governs how the documents are treated. Very few commercial organisations take that approach. IT security can only have a limited effect. If you cannot protect all of your data then you should consider segregating the most critical from the less critical and applying more stringent security to the former.” Mr Fishleigh also highlighted a number of ways in which cyber risk can be better managed and any insurance solutions made more effective. He advised risk managers to help develop and improve board level understanding of the information a company holds and how best to protect it. “If the board knows more about the information it is covering, then it can get the right insurance policies.” He also stressed the importance of establishing effective standards. While the ISO 27001 standard has helped to bring some definition around information security, more effort should be made to define the types of cyber attacks, he said. Mr Fishleigh also talked up the importance of scenario-based exercises where simple descriptions of potential cyber risks can be sought and backed up by real world examples. In light of the fact that many cyber breaches take place out of the public domain and rarely come to light, companies should actively participate in the sharing of information, said Mr Fishleigh. There are various government-sponsored initiatives that exist. These include the UK’s hub and node project announced in late 2011. However, more work is needed to create enough incentives for firms to take part. Perhaps the greatest catalyst for better management of cyber risk will, once again, be the threat of new regulation. For example, said Mr Fishleigh, the US capital markets watchdog, the Securities and Exchanges Commission, is advising financial firms to include cyber risks within their overall risk reports to shareholders. The extent of the threat that corporates face from malicious cyber criminals was made clear to the seminar audience in an earlier presentation from IT security expert Paul C. Dwyer, an advisor with the International Cyber Threat Task Force. Central to Dwyer’s presentation was the fact that the perpetrators of cyber attacks are far more organised and professional than ever before. “The bad guys behind all of this operate as a network where they share information and exchange ideas.” There is also an increasingly commercial side to cyber crime, he explained. Mr Dwyer pointed to the so-called Dark Market, an underground stock exchange where criminals can trade stolen personal data, malicious codes, viruses and hacking tools and expertise. Like any other exchange the prices for stolen data or malicious codes can go up as well as down. As a black market business, cyber crime has a relatively attractive business model, said Mr Dwyer. It is a relatively safe crime, for which few perpetrators are either caught or hurt. With a wealth of hacking information available through Google, and the technology used to carry out cyber crime highly accessible, barrier to entry is very low, he continued. And currently there are favourable socio-economic factors at play to help attract new cyber criminals, he added. The global recession is creating more opportunity for the criminals and the waves of youthful, anti-capitalist protests are helping to recruit young hackers between the age of 15 and 25 who want to feel part of something, said Mr Dwyer. The powerlessness of law enforcement to protect companies from this type of crime was highlighted by recent comments from former Head of the British Joint Intelligence Committee and current member of the UK’s National Security Council and Special Representative to Business on Cyber Security, Baroness Neville-Jones. “The answer to cyber crime lies in private firms and government working together to disrupt criminal networks rather than prosecution,” she said. Baroness Neville-Jones has previously accused various national governments, such as Russia and China, of participating in so-called cyber warfare attacks in order to gain state secrets. The idea of cyber warfare sponsored by national governments was given further credence in 2011 when the Stuxnet computer worm was used to derail Iran’s nuclear power project. It has been suggested that the Israeli and US defence departments were in some way involved. The Stuxnet case also raises a new form of cyber liability that insurance may not be able to cover. This is the possibility of an organisation becoming collateral damage in international cyber warfare or terrorism, as in the case of Siemens when its systems were attacked by Stuxnet. Whilst there is an increasing amount of legislation aimed at cyber crime it is hard for the law to keep pace with technology and the wide reach of the internet creates huge jurisdictional issues. Yet for risk managers, legislation such as the EU Convention on Cyber Crime creates yet another potential liability by making company directors personally accountable if they have not taken every reasonable step to fend against cyber abuses. Mr Dwyer highlighted cloud mobile technology and social media as the two biggest challenges for risk managers currently. He cited the number of employees bringing their own devices to work, rather than using the corporate network, and the use of sites such as Facebook to socially engineer confidential information as potential danger areas. “Criminals go where people go and people go to Facebook.” He also supported Mr Fishleigh’s assertion that risk managers must improve their own cyber risk education, as well as their boards. “Education is the key. A CEO may get sufficient comfort as regards their IT security by talking to their head of IT but it is not an IT issue per se. The risk manager has to get his board to understand the complexity of cyber risk and the fact that it has a different profile to more conventional risks.” The increasing reach of the internet allows for the propagation of ideas and means that most cyber criminals never have to do things on their own, explained Mr Dwyer. “The web enables skills and ideas to be spread around the world. When bad guys find a weakness they can then exploit it exponentially. They can find a way to steal five pence and then repeat it a million times. These attacks can be made from a distance and at any time of day and because legislation cannot keep up, few laws are broken in the course of a cyber crime. These are all risks that many chief risk officers have not considered.”

Inability to accurately value information holds back cyber insurance

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Related Articles