Cyber Insurance: 7 Questions To Ask

Cyber insurance is a growing field putting business and security leaders to the test as they navigate the often tricky process of researching and purchasing policies. Technology is quickly changing, and so is risk.

Insurance for cyber-security is different from other types of insurance because the nature of threats is constantly changing. A hurricane doesn't change intensity because a building code changes, but cyber-criminals will change their strategies as technology and risk evolve.

"New trends like BYOD, and IoT make tech strategy change all the time," says Portnox CEO Ofer Amitai. "It's really a problem for businesses to assess their policies and terms. Technology is so dynamic. It's difficult to say what's going on; what's their risk." 

These changes make it harder for underwriters and companies to stay abreast of the landscape. During the tricky process of buying cyber insurance, you'll ask and answer questions about your company, security posture, and other factors to determine which policy is best for you, and how much coverage you should buy. 

It's worth noting the research process is changing for businesses as the marketplace gets more competitive, notes David Bradford, chief strategy officer and director of strategic partner development at Advisen. Because insurers are fighting to underwrite the same businesses, they're making the purchasing process less burdensome for clients.

That said, insurance remains a tricky field to navigate, especially for companies new to it.

1.What am I afraid of ?

A key step in buying cyber insurance is figuring out what to protect, Amitai explains. This goes beyond the common concerns around customer and employee data to include things like brand reputation.

If a data breach hits, your business will need to worry about more than IT damage. The cost of public relations expertise, to recover a brand name following an attack, may not be covered under a cyber insurance policy.

 2.Cyber insurance is data breach insurance, right?

Oftentimes companies perceive cyber insurance as data breach insurance but it is important to understand breaches make up one portion of cyber insurance coverage. 

Policies also cover the cost of forensics, legal fees, business interruption, and a whole variety of expenses incurred related to a cyber incident.

3.Where do my Exposures lie?

Many companies struggle to purchase insurance because they don't know where their weaknesses are. Risk assessments help them identify their exposures, where their greatest vulnerabilities lie, and which assets are most vulnerable. Where does sensitive data reside? For multi-national firms, how large and varied is your attack surface? Are you protected in all the areas where sensitive data is stored?

Because cyber insurance is a fairly new field, companies often neglect to do this. Quantifying risk is a critical step in determining how much insurance coverage to buy.

4.What is the potential damage?

Once you determine your most critical assets and where your vulnerabilities lie, it's important to gauge the likelihood and potential cost of an attack. Which scenarios do you care about? 

How much will it cost if your most valuable information is exposed to cyber-crime? This number is likely to change as businesses adopt new technologies like cloud, mobile, and IoT, all of which will increase the attack surface and potential cost of a breach.

Cyber insurance isn't a replacement for strong security measures, and businesses should continue to change their strategies to acknowledge the risk these products will bring.

Insurance is something you want to have in place, but it's not a replacement for best practices. It ensures a loss and you won't have to close the business if you get a major breach.

5.How does the size of my business affect my insurance policy?

Small companies undergo a simple insurance application process. They may answer four to five questions that don't require investigation; for example: Do you have a firewall? Do you encrypt at-risk data? Inquiries won’t go much deeper than that, and smaller businesses will be given a fixed price for their risk.

The process gets more complicated for mid-size organisations, which typically answer a questionnaire about the security controls they have in place. They will provide information about firewalls and other data protection policies, data access and recovery, outsourcing, and compliance.

Larger businesses have to do the most work in developing information for underwriters. Insurers typically require an audit of most big organisations. Underwriters have to speak with CISO, CIO, and IT teams, making the process burden-some and complex.

6.Where are there gaps in my policy?

Given the range of cyber insurance policies, businesses need to put in their due diligence to determine which one is right for them. 

One of the biggest problems with cyber insurance is organisations don't have a firm grasp of what is and isn't covered. Many make the mistake of not buying the correct amount of the insurance that best suits their needs.

Different types of businesses face different threats. Misunderstanding your policy can lead to some unfortunate outcomes. What happens if a hacker breaks into a medical device and causes physical harm? Is bodily injury covered under your insurance policy? It's understandable to think so, but this isn't included in many plans.

Manufacturers, another example, are exposed to property damage. If someone hacks into their control system and wreaks havoc in production, the business may expect their cyber-insurance policy will cover it. Many of them don't.

7. How can I make sure I'm doing this right?

Experts recommend consulting a broker when things get difficult, but to choose with caution. There are some excellent brokers in the field, but many are so new they don't have enough experience to effectively advise clients.

Work with a broker who has domain expertise in cyber insurance. This is important because cyber insurance policies vary from carrier to carrier. Auto policies, for example, are generally similar. Cyber varies in language and policies.

Most major brokerage operators have on-staff experts who know enough to work with large businesses purchasing cyber insurance policies. Small companies buying via local agents or brokers, in contrast, may find those don't have the level of expertise they need.

Contact Cyber Security Intelligence for more Information
www.cybersecurityintelligence.com

 

« WikiLeaks Will Share CIA's Hacking Secrets
DeepMind Uses Blockchain To Track Health Data »

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

eBook: Practical Guide to Security in the AWS Cloud

eBook: Practical Guide to Security in the AWS Cloud

AWS Marketplace would like to present you with a digital copy of the new book, Practical Guide to Security in the AWS Cloud, by the SANS Institute.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Akamai

Akamai

Akamai are the leading provider of services for delivering, optimizing and securing online content and business applications across any device, anywhere.

Global Data Sentinel

Global Data Sentinel

Whether your data is at rest or in transit, on your network or in the cloud, it will always be secure with our advanced identity management and encryption technologies.

MACH37

MACH37

MACH37 is a market-centric cybersecurity accelerator program designed to facilitate the creation of the next generation of cybersecurity product companies.

WetStone Technologies

WetStone Technologies

WetStone develops software solutions that support investigators and analysts engaged in eCrime Investigation, eForensics and incident response activities.

PrivateVPN

PrivateVPN

PrivateVPN is a Virtual Private Network services provider offering secure encrypted access to the internet.

GOVCERT.lu

GOVCERT.lu

GOVCERT.lu is responsible for the treatment of all computer related incidents jeopardising the information systems of the government and defined critical infrastructure operators in Luxembourg.

DeviceAssure

DeviceAssure

DeviceAssure enables organizations to reliably identify counterfeit and non-standard devices with a real-time check on a device's authenticity.

Aujus Cybersecurity

Aujus Cybersecurity

Aujas is a pure-play cyber security services company with deep expertise in Identity and Access Management, Managed Security and Security Testing services.