Cyber risk 'the next asbestos'

Cyber risk is the insurance industry’s next asbestos and a “cyber hurricane” is building, says Jennifer Richards, managing director of Aon Risk Solutions Australia’s financial specialities and global risk consultants groups.

She told the AILA conference cyber was not a complex risk. It could be as simple as leaving a laptop on the bus or having weak passwords.

Hackers were responsible for 22% of data breaches; lost devices accounted for 19%; malware and viruses accounted for 18%.

Ms Richards said the landscape was changing. Cyber events were now more lucrative than drug trafficking in Australia.

Heightened media awareness brought increased brand and reputation risk. The Australian Securities & Investments Commission now required boards to review and update cyber polices and consider cyber risk insurance among their risk management tools. Many traditional polices now had cyber risk “carve outs”.

There were “a lot of gaps” not covered in traditional polices and specific cyber liability insurance was needed that covered first and third party risks.

First-party risks insurance generally covered included:
• Business interruption (loss of income and extra expenses)
• Costs to restore/recreate data
• Notification costs & credit monitoring services
• Forensic investigations
• Cyber extortion
• Crisis communication/public relations
• Legal costs assisting with privacy notification/compliance response

Insured third-party risks included:
• Defamation claims
• Infringement of intellectual property claims
• Violation or infringement of privacy claims
• Claims from dissemination of confidential information or damage to third-party systems
• Legal defence costs
• Privacy breach regulatory proceedings and investigations
• Fines & penalties

Ms Richards said annual gross written premium for cyber in the United States was about $US2 billion, compared with only about $A20 million in Australia. “Capacity is an issue in the US; we are looking at captives and offshore alternatives.”

But she warned the market may be “fragile” because of the potential exposures.

Ms Richards warned mandatory notification of cyber breaches was coming.

Glenn Crombie, a technical specialist with Chubb, said there was a misconception cyber risk did not affect small businesses.

“All businesses are targets. Hackers are lazy; they take the path of least resistance. The pay day may not be as big [with SMEs] but they can still make money.”

Another common myth was that outsourcing IT avoided the need for insurance. “Antivirus software is reactionary. [IT specialists] only know about new malware because someone gets hit.”

Disgruntled employees and other insiders and trusted vendors were responsible for 50% of breaches and losses.

Mr Crombie said “phishing” was becoming craftier, with fake websites and emails not looking like obvious hoaxes. “The reality is, people do click on the links.” That could see malware downloaded into their systems, with data being encrypted and ransoms demanded for its release. “One in 965 emails contains a phishing attack,” he warned.

It was taking longer to discover attacks – often months, even years, between a system being compromised and malware being identified.

Mr Crombie said underwriters writing cyber liability considered:
• Risk management plans, business continuity plans and incident response plans
• What security controls are in place?
• Back-ups and archiving
• Compliance
• Some industry segments are targeted more heavily than others
• Is the entity online revenue dependent?
• How does it assess third-party vendors?

Insurance was not the only solution to cyber resilience. Training and awareness was important, as were policies and procedures.

For insurers, the challenges were that there was not a huge amount of data yet; the fast pace of change; no big third-party claims – yet; aggregation across policies; and the systemic issue for big hosting companies, which had the potential for liability across a lot of clients.

Ms Richards agreed, saying systemic risk was “the largest concern”.

She expected premium to build fast, as more insureds were “coming on board”.

Mr Crombie said cloud storage raised issues because it was more complex to secure. “You can’t just unplug it from the wall.”