Cyber insurance is a hot topic in many debates today. It is believed to be the long-awaited cure for high-impact security risks, especially in light of constantly evolving privacy legislation and disclosure obligations. But what actually is it?
Simply put, cyber insurance is a tool intended to mitigate the losses that result from information security incidents.
The decision to use it, however, should be based on rigorous risk management. Firstly, a company performs a risk assessment, during which information security risks are identified and logged. This can help the business prioritise from a cost-benefit perspective. The company can then choose a risk treatment option: it can decide to accept, mitigate, avoid or transfer the risk.
Mitigation and acceptance are quite common approaches in the information security domain. Security professionals can implement a countermeasure to reduce the likelihood and impact of the threat. If it is not feasible to do so for economic reasons, however, then the risk can be accepted. In the case of avoidance, businesses can decide not to perform the activity that exposes them to the risk. Lastly, information security risk can be transferred to a third party. This is where cyber insurance can be useful.
The ownership of risk, however, can’t be transferred fully. In the case of cyber insurance, it is more about risk sharing. Both parties should understand their accountability, liability and risk allocation.
Cyber insurance should be cost-effective. But how can one calculate the cost of such product? To understand this, we might want to look how insurance brokers work in more traditional areas. Insurance companies rely heavily on historical data, demographics and averages. The car insurance industry, for example, has evolved over many years to collate accurate statistics of the frequency of accidents per driver based on age, season, car type, country, etc. in order to predict the likelihood and cost impact on a case-by-case basis.
Understanding the business
For cyber insurance, however, historical data is not always readily available. Understanding the business becomes key to determining the cost. There are many parameters that can define the premium: size, territory, type of business, human errors and other unknown factors can all contribute. Premiums rely on the maturity of the information security programme.
Is it possible to reduce this cost?
There are many ways to achieve cost reduction. In general, the business will need to demonstrate that some measures have already been taken to reduce the likelihood and impact of a potential cyber security incident. Certifications such as ISO 27001 can be one of the ways to do so. Or, for instance, having an incident response team may drive the premium down. Otherwise, the insurer would have to provide its own service, charging the client extra. In a nutshell, premiums are never fixed. It has to be a dialogue between the company and the insurance broker. If a company adequately understands its risk, the insurance premium can and should be negotiated.
It is important to mention the importance of a holistic approach to risk treatment. Implementing controls to prevent security incidents and purchasing cyber insurance are not mutually exclusive strategies. If cost-effective, risk management and treatment should be a combination of both methods. Consider health and safety policies as an example. Safety coordinators invest in fire extinguishers to minimise the impact of fire just as information security professionals deploy firewalls to keep malicious intruders out of the company’s network. Remember that the building is also almost always insured – maybe it is time to consider a similar approach to information systems.
Leron Zinatullin is author of The Psychology of Information Security, which discusses how to improve an organisation’s security culture.
You can follow Leron on Twitter @le_rond.