SMEs And Cyber Insurance

Carter Schoenberg, President and CEO of Hemisphere Cyber Risk Management LLC explains the challenges of SMEs and the role cyber insurance plays to protect them today while preparing them for coming threats

Business today increasingly relies on partners.

The increase in third party risk programs suggests security leaders take this seriously. The reality is our partners, often small and medium businesses, face growing challenges, too. Understanding the situation and current limitations is a key step in making sure everyone is properly covered. Cyber insurance plays a key role here. 

Carter Schoenberg is an industry veteran of 16 years who has served commercial and government clients with industry leading predictive analysis used by law enforcement, intelligence community, legal experts, and the insurance sector to address cyber-risk. He talked at length about the challenges of the small and medium businesses. We focused on a range of opportunities, including industry approaches, cyber security, and the role of security leaders at larger organizations to influence change.

Are SME (small and medium businesses) too small to take cyber security and insurance seriously?

They used to ask John Dillinger why he robbed banks. He responded, “Cuz that’s where the money is.” Small business owners tend to forget they make up over 99% of all business in the United States, according to the US Census Bureau.  I do not know of a single small business that does not accept credit cards. 

Even micro business owners use Square or other point of sale mobile terminal capabilities. These same small businesses generally do not have network defensive capabilities let alone the ability to identify if an attack is even occurring - outside of the self-evident ransomware attack. That is a pretty “target rich” opportunity.  If you examine the fact that a recent survey by Small Business Trends where SMEs place such an emphasis on “Customer Records” but turns a blind eye to “Employee Records”, Houston - we have a problem!

“I recently worked a case where a small business had to respond to 35 state attorney general requirements for disclosing a breach of PII (employee W2 data) and it was a massive blow to them financially in terms of internal manpower and paying for external subject matter expertise”’ he said. 
 
Most SME’s fail to understand these factors and if you do not understand your risk exposure, how can you protect against or mitigate it? SME owners may say, “Why would China or Russia want to come after me?” To a certain extent, they are correct but when you add context, they are factually wrong. If we mean nation state actors, perhaps they are not what you need to worry about. Men and women in uniforms are not the issue, individuals and groups acting in a collective within China and Russia are your problem.

How do we address the challenge of translating the risk in a way that SMB (and others) understand?

People in the field of cyber-security are great at identifying technical threats. We fail miserably at translating it into business risk.  If I were to say to a SMB client, “Management interfaces and services allow the remote management and administration of a host. If these services are available to the general enterprise network, they are vulnerable to a wide range of attacks, from the enterprise network user population. Almost all administrative services are vulnerable to brute force and password guessing attacks.”. What the heck are they supposed to do with that? Now let’s look at it differently.

“You have a vulnerability that we detected that can allow unauthorized access to your payroll and accounts receivables. There is information supporting the bad guys are actively taking advantage of this weakness you have and we want to limit your exposure to it.  We have prepared some recommendations, based on risk and priority to guide you through how to resolve it. We estimate it will take about 2 man hours to resolve and have minimal impact on your business operations.”

Now you have translated a technical finding into a business risk, highlighted a solution based on priority and what is business and cost justified.  The big challenge in the industry is that cyber has become so commoditised that people have become accustomed to paying out good money for reports that add little or no value because they are not actionable or repeatable for SMEs.

What do enterprises need to think about when it comes to the SMBs they partner with or acquire?

Any technology professional who has ever lived through a merger or acquisition will tell you the same story.  The Buyer’s CEO struck a deal with the Seller’s CEO. The acquisition is complete and IT (let alone cybersecurity) staff were never consulted and is now tasked to make Sales and HR functions interoperable immediately.  

Unfortunately, while the CEO’s are busy reviewing the books (revenues, pipelines, debt, etc.) they never look at what is the cyber hygiene of the Seller. Most recently (albeit not SMBs) both Verizon and Marriott have hit the presses in the last year because of the intent to buy out Yahoo and the Starwood Group realising massive financial risk exposure after negotiations due to “undisclosed” breaches during the courting period. 

Regardless of business size, the Federal Trade Commission is taking a very stiff position on businesses that misrepresent their cyber capabilities when conducting commerce as it applies to transmitting, storing, or receiving personally identifiable information or otherwise protected data under statutory law or regulatory requirements.

What’s happening with the current state of the insurance marketplace?

Data supports that in 2015, the market value of cyber policy premiums was $1 billion dollars. This is expected to increase to as a high at $10 billion by 2025. In order to accomplish this target Cash Annual Growth Revenue (CAGR), the insurance sector must properly evaluate a business model that not only improves top line revenues but also improves bottom line estimates by reducing the volume and values of claims stemming from a cybersecurity event.

There are 63 firms selling cyber policies and one major firm alone currently has over 50,000 SMB clients with cyber coverages. Regardless of how many clients a firm has or their respective client’s size, they all continue to struggle with pricing. 

In many instances, pricing is likely set artificially high as one of the traditional questions a buyer is rated against is annual revenues. The higher the revenues, the higher the premium. In 2015, NetDiligence reported that 62% of all claims originated from small business. This data point alone could highlight a need to categorically reevaluate how to measure and assess cyber policy premiums and coverage amounts.

In the race to write policies, there was a misstep leading to the unforeseen volume and value of claims. This positioned policy writers, to create unique lines of coverage and clearly defined “exclusions” to traditional general liability or errors and omissions policies where cyber coverages may have been “thought” to be covered.

How can cyber insurance help better address these issues?

Since 2011, DHS has been working with the insurance sector to see how to best work collaboratively and find common ground as to how to address cyber-risk through insurance. The industry came back with a resounding, “We don’t have the data to standardise”.  

This has fueled the race to write policies with little regard as to how providing pre-event services (vulnerability assessments, network and host monitoring, security training, legal consultations) can dramatically reduce the likelihood of a claim instead of focusing on post-event services (breach notifications, forensics, incident response, credit monitoring, etc.) that cost an arm and a leg unless you have the power of collective buying like carriers do.

In March, the state of New York just imposed some pretty hefty cyber-sec requirements for any business in the financial services sector with $10m in annual revenues. The legislative act basically stated there was a business justification to warrant such measures. 

In 2017, there is a business justification that warrants a categorical shift in adopting pre-event service offerings within the scope of the policy premium versus waiting for the catastrophe.  

Liken this to the following historical events that we take as status quo but was not always around because legislation or industry did not mandate it:

•    ‪Seat belts‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬
•    ‪Air bags‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬
•    ‪Smoke detectors‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬
•    ‪Removal of lead paint and asbestos‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬‬

What resulted? Dramatic decreases in civil tort action.  We can talk cyber all day long as a national security interest but at the end of the day, the almighty dollar is what drives national policy and in this case cyber policy premium and coverage limitations.  

CSO Online

Please contact Cyber Security Intelligence for free information and support regarding Business Cyber Insurance.

You Might Also Read:

Cyber Security Myths for SMEs (£):

Small Businesses Should Consider Cyber Insurance:

Five Pitfalls of Cybersecurity Insurance:

 

« NATO Could Go To War In Response To A Cyber Attack
North Korea, WannaCry, Cyberattacks And Lazarus »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CircleCI

CircleCI

CircleCI’s platform allows developers to rapidly release code (for web and mobile apps) they trust by automating the build, test, and deploy process.

6cure

6cure

The 6cure Threat Protection solution eliminates malicious traffic to critical services in real time and protects against DDoS attacks.

Cyber Akademie (CAk)

Cyber Akademie (CAk)

Cyber Akademie is a training and education center providing high-quality training and information events on information security and data protection.

Qubitekk

Qubitekk

Qubitekk has developed quantum cryptography solutions for the machine-to-machine (M2M) communications market.

ESL Bangladesh

ESL Bangladesh

ESL is the Largest IT Infrastructure & Telecom Service Provider in Bangladesh.

SenseOn

SenseOn

SenseOn’s multiple threat-detection senses work together to detect malicious activity across an organisation’s entire digital estate, covering the gaps that single point solutions create.

A-LIGN

A-LIGN

A-LIGN is a technology-enabled security and compliance partner trusted by more than 2,500 global organizations to mitigate cybersecurity risks.

Kingsley Napley

Kingsley Napley

Cyber crime is an area of growing legal complexity. Our team of cyber crime lawyers have vast experience of the law in this area.

Cynterra

Cynterra

Cynterra is a next generation cloud cyber security and data analytical service provider offering cloud security compliance, data protection, visibility and threat protection services.

IT Security Jobs

IT Security Jobs

IT Security Jobs is a dedicated portal for everything related to IT professionals looking for IT Security jobs.

Grayshift

Grayshift

Grayshift is the leading provider of mobile device digital forensics, specializing in lawful access and extraction.

Jisc

Jisc

Jisc is a membership organisation working in partnership with the UK’s research and education communities to develop the digital technologies they need to teach, discover and thrive.

People Driven Technology

People Driven Technology

People Driven Technology is a customer-obsessed organization. We leverage our decades of business, technology, and engineering experience to deliver outcomes for our clients.

Focus on Security

Focus on Security

Focus on Security are Cyber Security recruitment specialists. We’re dedicated to connecting you with the top Cyber Security talent across the globe. We focus on partnerships and results.

Skyhigh Security

Skyhigh Security

Skyhigh Security enables your remote workforce while addressing your cloud, web, data, and network security needs.

Elba

Elba

Employee security needs to be reinvented. SaaS security needs to involve end-user and awareness needs to be actionable. Meet elba, the 5-in-one cybersecurity hub with no compromises.