A few months back, I was a passive observer to an interesting email thread. People on the thread were discussing a breach that was big news at the time. Suggestions were made as to why the breach occurred, how it may have occurred, how the response could have been better executed, among many other points. At one point in the discussion, one individual decided to interject the concept of cyber insurance in a mocking and condescending tone. In other words, the individual did not feel that cyber insurance was a valid topic worthy of serious discussion.
In the past, I’ve written about the challenges that the security community has with mocking and condescending, and the tremendous disservice it does us in terms of improving the state of security. I don’t wish to further discuss that subject in this piece, though this incident does raise another interesting discussion. Is cyber insurance a valid tool in the security professional’s tool belt, or is it merely hype? Although mocking and condescending is never justified in my opinion, it is possible to understand those who would respond to extreme hype in that manner.
In order to answer the question of whether or not cyber insurance is a valid tool in the security professional’s tool belt, we need to take a step back. Let’s think about security in the broader context of managing, mitigating, and minimizing risk. More specifically, let’s think about risk from the perspective of an executive or board.
For our purposes, at an executive or board level, the risk from a security issue (sometimes referred to as a cyber event) can be rolled up into two main categories at a strategic level:
● Near-term costs incurred because of incident response, liabilities, notification requirements, fines, penalties, legal fees, and other such expenses
● Long-term costs incurred because of damage to the business, damage to the brand reputation, loss of customer confidence, loss of business partners, and other such losses
There are, of course, many different types of risks and threats that an organization faces. At the tactical and operational levels, an organization needs to prioritize these risks and threats and understand what people, process, and technology are required to properly mitigate those risks and counter those threats. I (and others) have discussed that process in the past. My point here is not to gloss over or oversimplify all of the hard work that goes into that important effort. Rather, the point I am making is that to evaluate the value of cyber insurance to an organization, we need to zoom out and see risk from a strategic perspective, rather than a tactical or operational one.
What we quickly realize when we look at risk from a strategic perspective is that it all comes down to cost. There are many details and moving parts to a holistic security program based upon a sound and strategic risk mitigation strategy. But when boards and executives think about security, they think about costs. What will it cost for me to mitigate the risk that I will suffer significant losses and incur significant costs in the event of a security incident or breach? As security professionals, wee may not like the way that point of view feels, but it’s important that we understand it.
When we think of security in these terms, we can begin to see how cyber insurance fits into the broader context of a security strategy focused on risk mitigation. In some cases, people, process, and technology may be able to mitigate huge risks and huge potential costs for a reasonable investment. In other cases, the investment required to properly mitigate a risk through people, process, and technology may be disproportionately high. If that is the case, what is an organization to do?
This is where cyber insurance can play a role in rounding out an organization’s risk mitigation strategy. Of course, cyber insurance varies widely in what it covers and at what levels, so it’s important to thoroughly examine coverage when shopping around.
When considering cyber insurance, it’s important to think about what risks you’re most keen to mitigate and match those to different types of coverage that may be available.
Here is a partial list of commonly covered incidents from a white paper that my company recently published:
● Forensics: This is the cost of investigating and analyzing an attack, often done by a third party with specialized expertise.
● Notification expense: In many cases, a breached entity will be required by law to notify customers, partners or suppliers who have been impacted by a breach. Even if this isn’t a legal requirement, many firms do this to help manage their brand and business relationships during and after a breach.
● Public relations: Depending on the size of a breach, extensive communications with the press and the business community might be required.
● Business interruption: If systems or data are unavailable due to an attack, and business is disrupted, this can be covered. This is generally the highest expense — in 2014 organizations suffered an average of $204 million in business interruption costs due to cyber attacks.
● Credit monitoring: It is becoming standard for companies that have been breached to offer consumers credit-monitoring services to protect them from any subsequent identity threat or financial fraud.
● Breach coaching: A breach coach is a high-level response coordinator, working with technical experts to isolate affected data, notify customers, retain necessary forensics professionals and manage crisis communications. A breach coach is often the first responder to an incident and helps the company triage the response to a breach.
● Legal costs: These can be hefty, as lawsuits filed against breached companies only add to all the business losses. Hiring legal experts and settling the lawsuits can add up to tens of millions of dollars.
● Regulatory fines: If any violations of regulations such as the Health Information Portability and Accountability Act (HIPAA) or Payment Card Industry (PCI) rules occurs, your organization may be fined.
It’s also important to remember what cannot be covered, such as theft of intellectual property and remediation of a breach. Of course, it goes without saying that policies vary widely, so it’s important to review the policy thoroughly and understand what is and is not covered.
It’s easy to cynically view cyber insurance as yet another fad creating noise in the already crowded security market. What’s harder is truly understanding all of the necessary components in a sound and strategic risk mitigation strategy. Cyber insurance, like any tool, will not solve all of an organization’s problems. But it
can help an organization round out its risk mitigation strategy.
