At the Heart of Cyber Risk Mitigation De-risking Cyber Threats with Insurance Vikram Singh Abstract Management of risks is an integral part of the insurance industry. Companies have succeeded in identifying and managing risks; however, the nature of risks has changed. Today, cyber risks can destroy the business and its reputation because of rapid growth in the number of cyber attacks. Organizations need ways to manage cyber risks outside of their risk appetite. Beyond providing insurance, insurance companies are using best practices and following regulations to strengthen insurer defenses against cyber attacks. www.niit-tech.com
Cyber Crime Rears its Head Along with development comes attached threats and while cyber risks have been around since the early 1990s, the solutions to deal with them have also seen steady growth. During the early days, cyber insurance coverage primarily addressed defacement and liability arising from domain name infringement. However, there has been a rapid growth in the number of cyber attacks especially in the recent years. The number of zero-day vulnerabilities discovered has doubled since 2015. Industry reports suggest that cybercrime is expected to cost the world more than $6 trillion by 2021, up from $3 trillion in 2015. As the cyber threat landscape continues to evolve, certain types of attacks are becoming increasingly common. Digital data breach, loss, and theft continue to be the leading types of cyber events; phishing attacks, too, have gained momentum, especially between 2013 and 2015. Network-disruption events (such as denial of service attacks) have also seen an increase in recent years. The more the people are inclined to electronic communication, the more the opportunity for bad According to the Herjavec Group, cybercriminals pocketed over $1billion from ransomware attacks, during 2016 alone, with the total number of ransomware incidents increasing by a whopping 748%. Based on the comprehensive analysis, researchers concluded that cyber security majorly hit these three industries: 1. Finance and Insurance 2. Healthcare and Social Assistance 3. Public Administration Cyber criminals targeted these industries because of wave, the risks are continuously expanding. Need for Cyber Insurance In today s world, no one is safe from cyber attack whether it is an individual, small business, or large companies. The existing business and standard insurance policies are not enough to cope with the impact caused by the cybercrimes. In most cases, a regular business interruption policy is not enough to compensate the insured if the systems fail because of a malicious employee, computer virus, or a hack attack. Identity theft, telephone hacking, and phishing frauds are real possibilities that are not covered by traditional business interruption policies. When it comes to loss of customer data due to a cyber attack, the penalties might be rigorous. For instance, there are severe penalties for losing credit card data. Merchant service agreements mean that you will be responsible for the expense of forensic investigations, credit card reissuance costs, and the fraud conducted on the stolen cards. Social media sites too are exposed to cyber risk due to their interactive nature. All this leads to defamatory statements, leaked information, and copyright infringement, which can lead to huge impact running into hundreds of thousands of dollars, if not covered.
Managing Cyber Risk All new technologies come with a certain risk. Once down a network Costs associated with damage to data records
Applying avoidance by selling all of your computers is probably tempting on some days, but is not generally the risk management technique of choice. Hence, the best way to manage these risks is by seeking insurance for cyber risks. Has Insurance Penetrated the World of Cyber Risk? The answer is yes! Cyber liability insurance has been around in the market for several years, but is rarely purchased. With an increase in the kind of exposure and impact of cybercrimes, its importance is being felt more. Having cyber insurance mitigates the risk costs involved with recovery after a cyber-related security breach or similar event. Cyber insurance protects networks, computers, programs, and data from attack, damage, or unauthorized access. This a system outage caused by a non-physical peril such as a virus attack. Additionally, it also provides damage done to the insured s brand. Cyber Insurance Demand by Coverage along with increase in demand for expense to Regulatory Defence. Although Internet Media Liability is the least in demand, it has good percentage. Top Risks for which Insurer Carriers are Least Prepared Risks Covered by Insurance Carriers Business Interruption Criminal Rewards Crisis Management Cyber Extortion Data Breach Identity Theft Liability Key Cyber Risks Causing Economic Loss Cyber Insurance Demand by Industries There has been an increase in such demand from the closely behind healthcare but score high in cyber insurance demand. However, Information Technology features somewhere in the middle of things. Notification Costs Website Downtime Damage due to Customer Loss Loss of IP/Trade Secrets
Strengthening the Role of Insurers via Regulation The recent growth in the number of data breach related cases have alarmed the regulators to work toward strengthening insurer defences against attacks. NAIC (National Association of Insurance Commissioners) and State insurance regulator are working collaboratively with other Financial Regulators, Congress, and the infrastructure of the US insurance commissioners. The NAIC and State Insurance regulators are tackling cybersecurity issues through the following means to protect the customers: Insurance data model law to establish standards for data security Roadmap for cybersecurity consumer protections regulation guidance Reporting requirements for insurers to track cyber insurance policies issued in the market place interruption that have caused much concern. The top 1. Increasing interconnectivity and commercialization of cyber-crime driving greater frequency and severity of incidents, including data breaches 2. With the possibility of data protection legislation be expected 3. Growing risk potential of business interruption, intellectual property theft, and cyber-extortion control systems 5. Absence of a sure-shot solution for cyber security $445 Bn. Estimated annual cost to the global economy from cyber crime $200 Bn. Estimated annual cost to world s largest four economies US, China, Japan, and Germany Trends in Cyber Insurance All new technologies come with a certain risk. Once combined, retained, or transferred using insurance or other risk-management techniques. Cyber risk is complex and forever changing. Attacks and incidents are increasing with costs climbing into multi-million dollars. There are certain risks around 50% Top 10 economies account for approximately 50%+ of cybercrime costs 42.8 M. $3.8 M. Number of detected cyber attacks skyrocketed Rising average cost of data breaches for companies around the world
The NIIT Technologies Thought Board: De-risking Cyber Threats with Insurance What are the leading types of cyber events? Digital data breach Loss Theft Phishing attacks Denial of service attacks Which three industries are majorly affected by cyber attacks? Finance and Insurance Healthcare e and Social Public Administration Assistance What risks are associated with the use of computers? Identity theft Business interruption from a hacker shutting down a network Reputational damage Damage to data records Theft of valuable digital assets Introduction of malware and other malicious computer code Human error leading to inadvertent disclosure of sensitive information Cost of credit monitoring services Lawsuits alleging trademark or copyright infringement How does cyber insurance help individuals and businesses? Cyber insurance: Mitigates risk exposure involved with recovery Protects networks, computers, programs, and data from attack, damage, or unauthorized access Covers loss of Covers damage done to reputation What are the five trends in the cyber risk domain? Increasing interconnectivity and commercialization of cyber crime Growing risk potential of business interruption, intellectual property theft, and cyber extortion industrial control systems Absence of a sure-shot solution for cyber security
Cyber Insurance: Next 10 Years Globally, the cyber insurance market is estimated to be worth around $2 billion in premiums, with the US accounting for approximately 90%. The cyber market could reach $20 billion or more in the next 10 years. Growth in the US is already underway as data protection regulations help focus minds, while legislative developments and increasing levels of liability will see growth accelerate in the rest of the world. Growth in the cyber insurance market will also be driven by increasing demand for business interruption (BI) coverage. Awareness of BI risks and insurance related to cyber and technology is seen as a key risk and a major part of the cyber insurance landscape. References Cyber Security, Risk Barometer surveys, Allianz. 2015 Cost of Data Breach Study: Global Analysis, Ponemon Institute The Global State of Information Security Survey, PricewaterhouseCoopers Novarica Report, Sites like Forbes, Reuters, Guardian, Money.cnn, Telegraph for information on cyber security About the Author Vikram Singh works as Practice Lead for insurance. He is a Business SME, bringing over 20 years of rich exposure in successfully executing and designing insurance solutions for various clients across the globe. His vast insurance domain expertise along with in-depth experience of variety of insurance products has been instrumental in bringing quality, innovation, and to CII UK) and a Certificate in General Insurance from Insurance Institute of America.
marketing@niit-tech.com 7 www.niit-tech.com 16 031