Friday, 17 February 2012
Inability to accurately value information is holding back cyber insurance
Risk managers must do more to accurately articulate their cyber risk concerns to insurers if this evolving area of insurance is to properly develop, Mark Fishleigh, Head of Insurance at UK-based information security firm BAE Systems Detica, told an audience of over 150 risk experts at an emerging risks seminar organised by Commercial Risk Europe.
Mark Fishleigh, Head of Insurance at UK-based information security firm BAE Systems Detica
There is growing awareness of cyber risk among risk managers, as proved by the fact that it was highlighted as one of the major challenges facing the profession in CRE’s 2011 Risk Frontiers Survey. There are also an increasing number of insurance products available for cyber risks. However, said Mr Fishleigh, there is currently an imbalance between the supply from insurers and the demands of insureds in what is still an immature market.
Cyber insurance products have tended to come from two different directions—liability underwriters extending their standard coverage to include cyber-related risks and property underwriters that have finally accepted that losses can occur where there is no physical damage. There are even some policies, such as a US-based coverage for the cost of notifying customers in the event of a data breach, where some insurers are stepping back from the market because they believe it is over-supplied.
Please sign up here to our full-time mailing list to ensure that you receive our weekly newsletter.
There are, though, other areas where big gaps in coverage remain, said Mr Fishleigh, such as cyber terrorism and cyber warfare where clear definitions do not yet exist. There is also a lack of standard wordings among all cyber-related policies and different products for the same risks can vary markedly, he added.
What is clear, continued Mr Fishleigh at the Risk Frontiers seminar held on Wednesday in London, is that the cyber insurance products that currently exist are supply- rather than demand-driven. "Insurers like cyber risk. It is a new product and a new revenue stream." Furthermore its evolving status means that insurers can still charge a relatively high rate for coverage.
Demand from risk managers is not at the same level as supply, noted Mr Fishleigh, largely due to business underestimating the value of the information it holds. "Most corporates have not quantified the value of their information so it is very difficult to insure it."
It is also difficult for buyers to tell which policies represent value for money and which are too expensive without an accurate assessment of the value of their information. "I don't think risk managers fully understand the risk," warned the cyber expert.
Corporates therefore have to make more accurate and effective assessments of the information they hold and how it should be treated—something that governments, unusually, are very good at, stated Mr Fishleigh. “If you cannot protect all of your data then you should consider segregating the most critical from the less critical and applying more stringent security to the former.”
Risk managers should also focus on improving board level understanding of cyber risk, establish standards for defining cyber attacks and cyber security and participate in information sharing initiatives where possible, such as the UK’s ‘hub and node’ pilot scheme.
The full extent of the threat that organisations face from malicious cyber criminals was made clear to the audience by an earlier presentation from IT security expert Paul. C. Dwyer, an advisor to the International Cyber Threat Task Force.
Mr Dwyer referred to the so-called ‘Dark Market’, an underground stock exchange where criminals can trade stolen personal data, malicious codes and viruses, hacking tools and expertise.
He highlighted cloud mobile technology and social media as the two biggest challenges currently facing risk managers.
Mr Dwyer also supported Mr Fishleigh’s view that risk managers must improve their own level of education and that of their board when it comes to cyber risk. “Education is the key. A CEO may get sufficient comfort as regards their IT security by talking to their head of IT but it is not an IT issue per se. The risk manager has to get his board to understand the complexity of cyber risk and the fact that it has a different profile to more conventional risks.”
Please sign up here to our full-time mailing list to ensure that you receive our weekly newsletter.
Innovation debate hots up as JLT launches intangible package
New Risk Framework proves every cloud has a risky lining
Corporate round-up
Sustainable policies boost risk management at financial firms says think tank
IOR elects new council members and include first international representative
Time to ‘end the deadlock’ on CBI says DVS commitee
German risk managers unhappy with cyber products on offer
Is Nero at it again?-comment
Supply chain–out of control?–comment
Let the people speak!
A fine balancing act–Portugal
Risk professionals must adapt out of date approaches to maintain progress
Risk managers may become obsolete as risk culture spreads say IRM experts
Strategic thinking and challenging top management key to bright future—IRM
Australasian risk management standards rise, but room for improvement
EU to create risk committee to encourage risk-based regulation
Risk managers at financial institutions make board level breakthrough
Global supply chains still at risk with lessons not learnt, warns Marsh
Beware ninja trends and infobesity warns trendspotting futurist
Lords risk select committee needed to drive agenda says academic
AIR develops new CBI modelling tool for risk managers
