All too often these businesses turn to cyber insurance, thinking it will be an easy way to safeguard against any financial loss that they may face after a cyber incident. Companies reach the conclusion that taking out a cyber insurance policy is a great excuse not to invest in good security practices or products, often using it as a way to cut investment in IT security. On the surface, it does seem tempting to pay an insurance premium each month, hope for the best and rely upon a third party to pay out in the wake of a massive data breach. However, this is a misguided theory, as in reality the insurance approach to cyber security is never a substitute for the classic time-tested approaches of investing in people, proven technology and good management.
Cyber attacks are not force majeure
When considering cyber insurance, it’s vital to make the distinction between what is preventable and what a business has no control over. As with insurance in the real world, insurance companies will not pay out if the business or consumer has not taken normal and adequate care to secure their property against the threat. In the physical world, insurance companies will send out inspectors and require attestation by survey forms to show proof that the insured is following best practices to prevent any kind of damage. In the case of cyber insurance, however, the insurers do not check for adequate controls and only test these controls when a claim is actually made – which is time consuming and hugely expensive to do, not to mention too late.
The end result of this liability transfer strategy is that many companies that buy cyber insurance elect not to take normal due care. Instead, they merely purchase the insurance just to make sure they are covered. Unfortunately, for the short-sighted business that chooses this path, the usual outcome is that the insurance company will not pay out on the policy because the insured has not taken reasonable steps to secure its environment. The insurer will then go through the long and arduous process of proving that this is so.
A succession of fraud
Because the company does not take the necessary precautions to protect its resources adequately and the insurance company knows this to be the case, yet rarely goes in to test the security of the insured party prior to insuring them, (which is what would normally be done in the physical world), the result is two parties committing fraud against each other and hoping that a claim never occurs.
Back to basics
In truth, cyber insurance will never pay off for the purchaser because it does not replace proper security or internal IT controls. For example, most information is stolen or breached from inside an organisation and yet it can be easily prevented by putting in controlled access to privileged resources and accounts known as privileged identity management. However, in most companies the C-Suite is led to believe naively that it will be cheaper to buy insurance instead and will not purchase this sort of solution.
Top-down approach
The power of the CEO has to be brought to bear when it comes to implementing cyber security policies that are completely analogous to simple and well-tested concepts in the physical world. You need to know who has the keys, be aware of internal and external theft, and make a decision as to how much extended risk you want to take. It’s no different in the IT world from a risk and mitigation perspective, and concepts such as force majeure still apply. Cyber insurance cannot make up for inadequate leadership it has to come from the top downwards and be integral throughout the business and an investment that is seen to be valued and of importance.
Centres of excellence
Ultimately, companies that have invested in building their own “security centres of excellence” and have implemented strong cyber-defence controls, almost universally see an excellent return on their cyber-defence investment. However, it does require leadership and vision to make these investments. In building this competency, losses are generally negligible and in fact, cyber insurance firms will pay claims to such a company who have taken appropriate measures to secure their business.
Instead of paying the cyber insurance premiums and hoping for the best, it’s time organisations take back control and lead from the top when it comes to cyber security.
The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.
