What is Cyber Insurance and What does it Cover?

Cyber Insurance is a dedicated insurance policy, that provides both financial cover and practical help to anyone who has been victim of a cyber crime. At the moment, this type of policy is mainly aimed purely at businesses and organisations, of all sizes, any of whom could be vulnerable to a cyber attack or a data breach.

This is likely to change significantly in the near future as more and more areas of people’s individual lives are becoming vulnerable to Cyber attacks, such as their cars and their homes,  and the whole nature of cyber insurance will have to evolve to deal with these threats.

This is likely to mean that either people’s home insurance or their car insurance will have to start covering the risks of a cyber attack, or cyber insurance policies will have to evolve themselves to cover these areas.

Cyber Insurance and Indemnity

Insurance companies talk about indemnity, which is an important concept to understand. It means that the insurance policy is designed to put the insured in the same position as they were before the loss happened.

With regard to cyber insurance this means that not only is there financial protection included as part of the insurance policy, but the insurance policy  should also cover practical areas of help, such as lawyers, I.T. technicians etc. Some cyber insurance policies do include these extra areas of help, and some don’t.

Deciding what type of cyber insurance policy to buy is often determined by how much additional help is available, in the policy, in the event of a data breach, and quite often the cost will reflect this.

Cyber Crime

Cyber crime is considered one of the, if not the fastest growing area of criminal activity, and is widely evolving and quickly changing. This makes keeping up with an understanding of current threats more difficult, but there are a number of specific areas that need to be understood.

Cyber crime normally refers to a situation where information or data has been stolen from an individual or an organisation, normally known as a data breach, and there is either some financial loss as a result, some reputational damage, or something such as a ransom demand to release a computer or network that has been encrypted by a third party hacker.

Cyber Insurance Policy Cover

These are the basics of what good cyber insurance policy can offer,  although as said above, policy cover will differ significantly between insurance companies.

Incident Management Team

This is a general term for a team of specialists who can effectively take over and oversee the management of any claim as soon as there is a known reporting of a cyber crime. This can include the paying of any ransom demand,  and the restoration of any I.T. systems that have been breached as a result.

This support team  should be able to investigate the data breach, find out how it happened, restore any computer systems to full integrity, notify any clients or customers that the data breach has happened and it’s implications, and notify any relevant regulatory or statutory bodies that need to be told.

The incident management team should also include a legal team, a company that can offer access to a credit monitoring system to help with the risk of identity theft, a PR company who can help with reputational damage, and a specialist who can negotiate in the event of a kidnapping demand for a time of information or ransomware.

The Cyber Insurance Policy  will also need to have a significant financial indemnity cover, which may be needed to pay any ransom demand, loss of income  or business interruption, any type of cyber extortion or criminal activity. and any costs needed to repair the infrastructure of the computer or network system involved.

Who is at Risk ?

People often tend to associate cybercrime with big companies such as Facebook or Sony, or with governments, as data breaches that affect them tend to be the ones that get the most publicity.

In fact anyone who owns a computer that is linked to a network of any type is potentially at risk.

This applies to people who have a computer connected to the internet in their own home, as well as any computer they may use at work, it also applies to any smartphone that they may have, and quite soon will apply to the car they drive and the washing machine and refrigerator in their home as well.

Whilst it is difficult to predict trends in this area,  there is quite a lot of anecdotal evidence that cyber criminals are increasingly targeting normal everyday people for relatively small amounts of money, through various types of ransomware and threats, as well as big companies and corporations.

It is very easy to scare people into giving away small amounts of money, relatively, and in some ways this can be much more cost effective from the criminals point of view. From the point of view of the person who has experienced the crime, they are like his feel as violated as if they had either been physically attacked or their home had been broken into.

The Internet of Things

There is often reference nowadays to the internet of things, normally in the context of how it is going to change everyone’s life within the next 5 years.

What it is really referring to is that virtually every device that is not being produced is being given a wireless capability so that it can connect to the internet, as well as connecting to other devices in the home or office.

This means that anything from a refrigerator or an oven, through to a baby alarm or your car can connect to the internet and speak to other devices. There is a huge area of debate about the implications of this regarding privacy and other things,  although what is absolutely clear is that it is going to present a huge potential risk of cybercrime.

Companies love the idea of be able to connect their devices or products to the internet and other devices, and the rush to do so and get them to market often means that the security capabilities are not as carefully thought through as they should be, and that software updates are not issued or installed automatically as they should be either.

Some people like the idea of a smart home or office, other people find the idea pretty horrible. Either way in the next few years virtually everything that every individual owns or uses is likely to have the capability of connecting to the internet wirelessly.

This has huge security implications,  and is an iisue the insurance industry has not fully caught up with them. This means that most people standard home or auto insurance policy is vague about its cover in this area, and people could be left in limbo as to whether or not they are covered for any data breach that happens in their own home.

Identity Theft

The risk of identity theft has been around for some time, but with the growth of cyber crime and the amount of personal information that is shared online and through smartphones means that the risk of identity theft is probably now greater than ever.

From an insurance point of view, some home insurance policies do already provide some degree of cover for identity theft, either as part of the policy or add an additional section that can be bought at  extra cost.

The problem with the existing level of cover is that all it really does is help provide access to additional levels of credit checks and a few other useful but not really that important areas of restitution.

What most identity theft insurance protection does not do is actually help the person recover any loss that may have been incurred as a result of their identity having been stolen.

What tends to happen is that a person will have their identity stolen, and then the criminal will use that  person’s identity to obtain bank loans or credit cards or other financial benefits in that person’s name, and then run.

When  the original person discovers that their identity has been stolen and fraudulently used,  the anecdotal evidence is that most banks and other institutions are relatively unsympathetic, and the onus is on the individual to prove that they did not take out the loan or credit card etc.

This  is where an insurance policy could probably help,  but at the moment there seems to be little by way of practical benefit that most policies offer. This  may well need to change with the growth of cybercrime and cyber insurance.

Cyber Bullying

It  is worth flagging up cyber bullying as being a major element of cyber crime,  although it is not often thought of as such because the bullying tends to be emotional rather than financial.

The consequences of cyber bullying can be devastating for individuals and families, and whilst there may not be an awful lot that an insurance policy can do, the overall approach to cyber security can have a hugely beneficial effect in terms of minimising the effect of bullying, and taking steps to deal with its perpetrators.

Liability Insurance

Many  companies and organisations believe that they already have enough  cyber security insurance under different levels of liability insurance that they have already taken out. These types of insurance policies can include product liability insurance, errors and omissions insurance  or simply a public liability insurance policy.

In truth, they are unlikely to have sufficient cover, and any cover they do have is likely to be financial only, and not include any incident management team as specified above.

One of the problems is that there a lot of companies and organisations who do not have a sufficient cyber governance program, and therefore do not take cyber security as seriously as perhaps they should.

Cyber Governance

This is the name given to any structure within a company or organisation, which should represent best practice for establishing policies and procedures that both minimise the risk of, and deal with any data breach  that may occur within the company.

It can be thought of as similar to a risk management structure,  and depending upon the size and structure of the business, should have a dedicated board member partner who has specific responsibility all aspects of cyber security.

This position does not have to be a person  who has a lot of technical knowledge of computers,  but needs to be someone who can implement a policy which includes both technical and non-technical assessments of cyber security risks and how best to deal with them.

Comments are closed.