Cyber Insurance: 7 Questions To Ask

Cyber insurance is a growing field putting business and security leaders to the test as they navigate the often tricky process of researching and purchasing policies. Technology is quickly changing, and so is risk.

Insurance for cyber-security is different from other types of insurance because the nature of threats is constantly changing. A hurricane doesn't change intensity because a building code changes, but cyber-criminals will change their strategies as technology and risk evolve.

"New trends like BYOD, and IoT make tech strategy change all the time," says Portnox CEO Ofer Amitai. "It's really a problem for businesses to assess their policies and terms. Technology is so dynamic. It's difficult to say what's going on; what's their risk." 

These changes make it harder for underwriters and companies to stay abreast of the landscape. During the tricky process of buying cyber insurance, you'll ask and answer questions about your company, security posture, and other factors to determine which policy is best for you, and how much coverage you should buy. 

It's worth noting the research process is changing for businesses as the marketplace gets more competitive, notes David Bradford, chief strategy officer and director of strategic partner development at Advisen. Because insurers are fighting to underwrite the same businesses, they're making the purchasing process less burdensome for clients.

That said, insurance remains a tricky field to navigate, especially for companies new to it.

1.What am I afraid of ?

A key step in buying cyber insurance is figuring out what to protect, Amitai explains. This goes beyond the common concerns around customer and employee data to include things like brand reputation.

If a data breach hits, your business will need to worry about more than IT damage. The cost of public relations expertise, to recover a brand name following an attack, may not be covered under a cyber insurance policy.

 2.Cyber insurance is data breach insurance, right?

Oftentimes companies perceive cyber insurance as data breach insurance but it is important to understand breaches make up one portion of cyber insurance coverage. 

Policies also cover the cost of forensics, legal fees, business interruption, and a whole variety of expenses incurred related to a cyber incident.

3.Where do my Exposures lie?

Many companies struggle to purchase insurance because they don't know where their weaknesses are. Risk assessments help them identify their exposures, where their greatest vulnerabilities lie, and which assets are most vulnerable. Where does sensitive data reside? For multi-national firms, how large and varied is your attack surface? Are you protected in all the areas where sensitive data is stored?

Because cyber insurance is a fairly new field, companies often neglect to do this. Quantifying risk is a critical step in determining how much insurance coverage to buy.

4.What is the potential damage?

Once you determine your most critical assets and where your vulnerabilities lie, it's important to gauge the likelihood and potential cost of an attack. Which scenarios do you care about? 

How much will it cost if your most valuable information is exposed to cyber-crime? This number is likely to change as businesses adopt new technologies like cloud, mobile, and IoT, all of which will increase the attack surface and potential cost of a breach.

Cyber insurance isn't a replacement for strong security measures, and businesses should continue to change their strategies to acknowledge the risk these products will bring.

Insurance is something you want to have in place, but it's not a replacement for best practices. It ensures a loss and you won't have to close the business if you get a major breach.

5.How does the size of my business affect my insurance policy?

Small companies undergo a simple insurance application process. They may answer four to five questions that don't require investigation; for example: Do you have a firewall? Do you encrypt at-risk data? Inquiries won’t go much deeper than that, and smaller businesses will be given a fixed price for their risk.

The process gets more complicated for mid-size organisations, which typically answer a questionnaire about the security controls they have in place. They will provide information about firewalls and other data protection policies, data access and recovery, outsourcing, and compliance.

Larger businesses have to do the most work in developing information for underwriters. Insurers typically require an audit of most big organisations. Underwriters have to speak with CISO, CIO, and IT teams, making the process burden-some and complex.

6.Where are there gaps in my policy?

Given the range of cyber insurance policies, businesses need to put in their due diligence to determine which one is right for them. 

One of the biggest problems with cyber insurance is organisations don't have a firm grasp of what is and isn't covered. Many make the mistake of not buying the correct amount of the insurance that best suits their needs.

Different types of businesses face different threats. Misunderstanding your policy can lead to some unfortunate outcomes. What happens if a hacker breaks into a medical device and causes physical harm? Is bodily injury covered under your insurance policy? It's understandable to think so, but this isn't included in many plans.

Manufacturers, another example, are exposed to property damage. If someone hacks into their control system and wreaks havoc in production, the business may expect their cyber-insurance policy will cover it. Many of them don't.

7. How can I make sure I'm doing this right?

Experts recommend consulting a broker when things get difficult, but to choose with caution. There are some excellent brokers in the field, but many are so new they don't have enough experience to effectively advise clients.

Work with a broker who has domain expertise in cyber insurance. This is important because cyber insurance policies vary from carrier to carrier. Auto policies, for example, are generally similar. Cyber varies in language and policies.

Most major brokerage operators have on-staff experts who know enough to work with large businesses purchasing cyber insurance policies. Small companies buying via local agents or brokers, in contrast, may find those don't have the level of expertise they need.

Contact Cyber Security Intelligence for more Information
www.cybersecurityintelligence.com

 

« WikiLeaks Will Share CIA's Hacking Secrets
DeepMind Uses Blockchain To Track Health Data »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Virtual Security

Virtual Security

Virtual Security provides solutions in the field of managed security services, network security, secure remote work, responsible internet, application security, encryption, BYOD and compliance.

Logscape

Logscape

Logscape provides a big data analytical tool for log file analysis and operational analytics.

Texplained

Texplained

Texplained specializes in security audits of microchips to identify vulnerabilities and protect against invasive cyber attacks.

CTR Secure Services

CTR Secure Services

CTR Secure Services provides a broad range of security consulting services from asset protection to cyber security.

European Business Reliance Centre (EBRC)

European Business Reliance Centre (EBRC)

EBRC is a leader in integrated Data Center, Cloud and Managed Services and a Centre of Excellence in Europe in the Management of Sensitive Information.

Redjack

Redjack

Redjack is a cutting-edge network analytics company focused on enterprise and ISP security and intelligence solutions.

Digital Transformation EXPO (DTX)

Digital Transformation EXPO (DTX)

Digital Transformation EXPO showcases the latest technology and insight from the world’s leading brands and experts in DX.

Center for Analysis & Investigation of Cyber-Attacks (CAICA)

Center for Analysis & Investigation of Cyber-Attacks (CAICA)

The Center for Analysis & Investigation of Cyber-Attacks is one of the leading Kazakhstan organisations in the field of information and computer security.

Moxa

Moxa

Moxa is a leading provider of industrial networking, computing, and automation solutions for enabling the Industrial Internet of Things.

Eco Recycling (Ecoreco)

Eco Recycling (Ecoreco)

Eco Recycling is India's first and leading professional E-waste Management Company that has set industry benchmarks with its innovative & environment friendly disposal practices.

NeuShield

NeuShield

NeuShield is the only anti-ransomware technology that can recover your damaged data from malicious software attacks without a backup.

Dasera

Dasera

Dasera’s Radar and Interceptor products deliver visibility, governance, and protection solutions for data-agile companies.

Association for Uncrewed Vehicle Systems International (AUVSI)

Association for Uncrewed Vehicle Systems International (AUVSI)

AUVSI is the world's largest nonprofit organization dedicated to the advancement of uncrewed systems and robotics. Focus areas include cyber security for uncrewed systems and robotics.

WPScan

WPScan

With WPScan, you'll be the first to know about vulnerabilities affecting your WordPress installation, plugins, and themes.

Mantodea Security

Mantodea Security

Mantodea Security is an industry-agnostic powerhouse backed by extensive experience and expertise in the realm of IT security.

SafeLiShare

SafeLiShare

SafeLiShare’s data security platform unifies encryption strategies for organizations with hybrid and multi-cloud infrastructures, ensuring data is secure regardless of its location.