Cybersecurity Insurance as Risk Management
The Department of Homeland Security says that cybersecurity insurance is:
…designed to mitigate losses from a variety of cyber incidents, including data breaches, business interruption, and network damage. A robust cybersecurity insurance market could help reduce the number of successful cyber attacks by: (1) promoting the adoption of preventative measures in return for more coverage; and (2) encouraging the implementation of best practices by basing premiums on an insured’s level of self-protection.
They also note that a lot of companies out of cybersecurity insurance because of its costs, lack of clarity about what it might actually cover, and the conviction that their organization is not going to be a target for a cyber attack.
Is it actually wise for firms of small to large sizes to opt out of cybersecurity insurance? Is it realistic to believe that any company is immune to such threats or has no appeal or interest to cyber criminals? Let’s consider this…
Cybersecurity Insurance as Risk Management
In all reality, risks exist for every firm in the world. Whether you are the small shoe repair firm in a small town in the middle of nowhere or the major corporation in a large city, your financial records, personal data and other business details may be of value to many. Thus, as a form of risk management, it is worth considering the value of cybersecurity insurance.
After all, it mitigates some of the financial harm that might result from a cyber attack. For instance, you keep your client’s names and information in a database, you have financial information on your computer network, and you have your own company data on the same system. A cyber attack might compromise all of this information, and lawsuits may be the least of your worries.
However, cybersecurity insurance comes in different flavors and if you have first party insurance, it will cover the interruption to the business, damage to the reputation, and some digital assets. Third-party coverage addresses more complex matters like credit monitoring of your clients, legal fees, fines, and more.
One way to consider cybersecurity insurance, then is as one expert said: “identify and secure the company’s digital crown jewels, then quantify and insure the remaining risk.”
Cybersecurity Insurance Flaws
Though we know that cybersecurity insurance can address issues like your business reputation in the event of a digital loss or attack, many agree that it is but one area of insurance that is a bit weaker than others. For many, the coverage is not adequate where reputational damage, intellectual property, and a loss of business is concerned.
After all, a security breach can easily mean that your reputation becomes one of cutting corners and failing to put the client’s best interests first. It could paint you as irresponsible and incapable of understanding modern technologies. Few insurance policies can provide mean of measuring such losses, and creating compensation for them.
Cybersecurity Insurance as a Means to Improvements
Of course, one thing that insurances for cybersecurity make plain is that there still exists the need for security against such threats. Simply underwriting a massive policy to compensate your clients and your business is not good policy. The information that is lost to hackers can be remarkable, and a hacker may not only steal information. They might use your system for illegal purposes, aligning you to some of the world’s worst crimes. They could hijack or ransom data, costing you huge sums of money to regain access to files.
Thus, insurance is a way of offsetting some financial losses, but it is not thesolution to security risks. It is, though, a good inspiration to millions of firms to take that advice provided above — to secure the most important areas to the greatest extents possible, but also continue securing them with ever-advancing technologies and tactics.
Let’s just consider one of the most famous cybersecurity blunders of all time — the Sony Entertainment hack. This attack exposed business information, customer and worker data, and thousands of internal communications that ruined professional relationships and humiliated some of the biggest names in the industry. Everything from nude photos to celebrity earnings appeared in tabloids after this occurred, and insurances of any kind would be able to undo or repair many of the damages.
This is why insurance can be seen as the means to great improvement, yet it cannot be the end itself. Consider this comment:
…cyber insurance forces executives and boards to pay attention to the need to protect IT assets against threat actors by focusing on not only procuring cyber insurance, but also investing in effective security programs, and continually monitoring their IT networks to identify potential anomalies early on to prevent network wide problem… some organizations, especially small-to-midsize businesses (SMBs), will gain a false sense of security from cyber insurance and fail to implement the technology, process, and training components essential to a comprehensive cyber security program.
What this tells us is that, strategically, the insurance can prove beneficial to companies that have outstanding risk once all possible security methods are in place. Just as the employer who has worker’s compensation insurance in place would not ignore the safety of the workplace, the companies with cybersecurity insurances must not let their guards down.
And nowhere is this easier done than with embedded objects. You can be at home or in an office, and create a very secure router, entirely up to date computers and tablets, and yet leave your network open to hackers and cyber attacks through the use of embedded devices such as anything wireless that accesses the router, smart devices that are internet connected, and even some web or security cameras. Hackers seek attack platforms, and you might be astonished at how many there are.
Integrating a gateway device into your systems is one sure-fire way of vastly reducing cyber attack threats. CUJO, as an example, is a gateway that integrates with all embedded or network devices, knowing what they should and should not do, understanding immediately if an attack is attempted, and then thwarting it. Don’t just throw money at the problem of cyber threats, consider designing a full solution that blunts any hacker’s efforts.