How much cyberinsurance is enough?

How a top security manager feels about cyberinsurance often may have a lot to do with the type of company he or she works for.

Take Jim Motes, vice president for information security at Kohler, the large privately-held global manufacturer best known for its plumbing and other home products based in Kohler, Wis. 

Motes says there are three broad areas most companies would consider cyberinsurance for: to protect against breaches of B2C e-commerce or a breach at a physical retail store, protect intellectual property, trade secrets and the PII of employees and recover from a breach into a manufacturing facility, an IoT event.

“Since we don't do that e-commerce and have a minimal retail footprint, I don't see the value proposition in cyberinsurance for B2C cases,” says Motes. “And with intellectual property, it's really difficult to come up with a financial value for what could potentially be lost. There are numerous variables to consider, such as who the attacker is, whether they are a nation-state or if they are a competitor that will try to use the information to gain some form of economic advantage.”

On the IoT front, Motes says he's very interested in how the cyberinsurance industry plans on addressing the growth of IoT devices and the risk of cyber-related events targeting connected manufacturing facilities around the world.

“That's an area that makes sense for me,” he says. “While there's a definite financial number I can allocate for a day of downtime at a plant, from what I can tell, I don't know that anyone has developed a comprehensive insurance portfolio to address that scenario yet.”

Motes says for now, he's partnered with his security peers at four other Wisconsin companies.

“We've agreed to support one another if another member of our group suffers a breach,” explain Motes. “We are also able to call on one another to perform validation of our security controls, such as vulnerability assessments or pen tests. Besides giving our teams more real-world experience, we offer each other additional training opportunities, and the members have augmented their security staff when it counts at no incremental cost. It's very difficult to find qualified security people, and this arrangement benefits all group members and their security teams.”

Making Some Progress

David Shearer, executive director of (ISC)2, says his organization has been focused on giving companies the tools to make financial determinations on a security breach so they can apply more accurate values to cyberinsurance. 

“There's a lot of emphasis put on technical capabilities or whether a company is B2B, B2C or a manufacturer concerned about IoT security,” says Shearer. “What companies need is a way to put a value to a cyber event and explain it in a way that will make business sense to the people in the C-Suite so they can in turn explain it to the insurance company.”

Shearer says (ISC)2 recently entered into a partnership with RiskLens, which has developed a cloud-based enterprise risk management product that helps companies determine specific values to a security breach. The product combines modern analytics with the Factor Analysis of Information Risk (FAIR) methodology developed more than a decade ago by RiskLens co-founder Jack Jones.

Nick Sanna, CEO of RiskLens, says FAIR breaks an event down into two discrete categories. Primary loss includes downtime, and response and replacement costs. Secondary loss takes into consideration fines and judgments from criminal penalties, reputation loss (think Target or Home Depot), reimbursement of money stolen and the cost of credit monitoring services.

“Now, if something were to happen, the company can run an analysis of what a breach will cost,” explains Sanna. “It puts them in a better position to determine not only how much coverage they need, but the type of coverage the company needs.”

Jim Bramlett, director of risk management at Home Depot, says anything companies can do to work more closely with insurance companies definitely helps the process.

Bramlett says Home Depot had taken on cyberinsurance long before its major breach a couple of years ago, but adds that they now work more closely with the insurance companies than ever before.

“The way we were it is we have the underwriters point out what their areas of concern are,” he explains. “We then have our security team work with the insurance company's IT consultants to explain what the risks are.”

Roxane Divol senior vice president and general manage of website security at Symantec, adds that the insurance industry has also taken steps to better understand how to value cyberinsurance. She says Symantec has been working with many of the leading insurance companies over the past several months to help them better evaluate risk.

“The insurance companies need tools that give them a better sense of risk,” she says. “And while I know there's been a tendency on the part of CISOs not to take on cyberinsurance, they'd rather spend money on security infrastructure, I think more of them are seeing the need to take on a policy. Think of it like a homeowner, you'll put a dead bolt on your door but you also need homeowner's insurance. The same holds true with security. You need a good security infrastructure, but you also need cyberinsurance to cover a breach.” 

Most analysts report that the cyberinsurance market will grow exponentially in the years ahead. PwC estimates that annual global spend on cyberinsurance premiums will grow from about $2.5 billion today to $7.5 billion by 2020.

In the United States, there's a vast opportunity for the insurance companies to cover manufacturers. According to the PwC study, only 5 percent of manufacturing companies in the United States hold stand-alone cyberinsurance, compared to around 50 percent in the health care, technology and retail sectors.

And even with more insurance companies entering the market, which moderated prices to an increase of only 5.2 percent in Q3 2016 compared to a 6.9 percent increase during Q2 2016, according to the Marsh Global Insurance Market Index, there's a ceiling on what insurance companies will cover.

Don Ulsch, a senior managing director at PwC, says the maximum a company can be insured for is about $500 million, but the reality for many companies is that it's tough to even get coverage for $300 million.

So what should companies do?

Ulsch says companies need to understand their risk profile. One important factor is geopolitical risk. For example, do they do business in countries with higher than normal levels of fraud and cybercrime, like Russia and Eastern Europe?

Companies also need to use available tools to get a better sense of what a breach will cost. And they need to require third-party vendors to purchase cyberinsurance.

“I had a CISO tell me once that he wouldn't buy cyberinsurance for his company, but he makes sure all the third-party vendors have cyberinsurance,” Ulsch adds.

It all gets back to what (ISC)2's Shearer advises about focusing on the business aspects of cyberinsurance and getting the CISOs more involved in the process. Today, more often than not, the chief financial officer handles cyberinsurance and the CISO only gets called in briefly for a technical consultation. That's changing as the cyberinsurance market evolves and gets more sophisticated.

Bottom line: What the insurance company allows your company to buy may never be enough coverage for a serious breach. Target is the classic case, where the breach cost roughly $300 million and insurance from multiple carriers covered only about one-third. But that doesn't let companies off the hook. CISOs must be readily available to give the company's top executives a more accurate picture of the actual financial risk. Today, what's covered can be as important as how much.  

Read more: https://www.scmagazine.com/how-much-cyberinsurance-is-enough/article/632114/