What is Cyber Insurance and Why Do I Need It?
As businesses handle more data in complex ways, the risk of cyber threats has grown with increasing speed and sophistication. Cyber insurance, a part of commercial insurance, helps manage these risks, focusing on data security in the realm of business operations. Â
Cybersecurity professionals continually monitor and respond to emerging threats to protect systems and data from compromise. An Insurance broker can help you assess internal risk provide insight into industry best practices for cyber-security, and recommend cyber coverages that fit your industry and your unique business model.Â
Cyber Insurance is Part of the Overall Security Framework
Accepting the reality of Cyber Security is the first step towards assessing your security, considering the implementation of security training programs, auditing your passwords and authentication methods, activating regular backups of servers and databases, and acquiring a comprehensive Cyber Insurance policy.
Cyber Risks Typically Excluded from Cyber Insurance Coverage:
- Poor Security Processes
- Prior BreachesÂ
- Human ErrorÂ
- Insider AttacksÂ
- Preexisting VulnerabilitiesÂ
- Technology System Improvements
Types of Cyber Attacks
A cyber attack refers to any deliberate and malicious attempt to compromise the confidentiality, integrity, or availability of computer systems, networks, or data. These attacks can take various forms and may have different objectives, including:
Types of Cyber Coverage
A cyber insurance policy is designed to help organizations mitigate the financial impact of a cyberattack or data breach. It typically provides coverage for a variety of expenses and losses associated with such incidents, including:Â
Data Protection: Then vs Now
Then: Paper-Based
-
Stored centrally
-
Limited physical access
-
Slow to access archived data
-
Disconnected data stores
Traditional Insurance Protection:
- Fire
- Flood
- Theft
- Professional Liability
- Errors & Omissions
Now: Digital
-
Multiple digital copies
-
Distributed access
-
More repositories to secure
-
More opportunities to affect data
Today’s Insurance To Protect Against:
- Ransomware / Malware
- Phishing / Social Engineering
- Data Breaches
- Denial of Services
- Regulatory Compliance Gaps
Cyber Attack Case Studies
A Financial Services firm experiences a data breach exposing personal data for millions of customers. In 2019, Desjardins, notified the Privacy Commissioner of Canada of a breach of safeguards that affecting close to 9.7 million individuals in Canada and abroad. Â
Primary Cyber Insurance Response:Â Â
Cyber Insurance coverage will help assess the cause of a data breach and cover associated costs to notify affected parties, provide credit monitoring to affected customers and handle public relations. In addition, policies may cover both the costs of regulatory fines/penalties and third-party claims from customers seeking damages as a result of the breach. Â
Best Preventative Measures:Â
Regulatory Compliance (PIPEDA), Incident Response Planning, Regular cybersecurity audits/system testing, Strong Password Policies, Cyber-Security Awareness Training.
Canadian directory publisher, Yellow Pages experienced a Ransomware attack in 2023 that disrupted operations and resulted in a data leak of employee information.
Primary Cyber Insurance Response:
Costs associated with restoring data and affected systems will typically be covered as your insurance carrier determines whether a negotiation of a ransom is warranted. Your policy may also cover lost revenue and expenses related to the disruption of the business because of the cyber incident.
Best Preventative Measures:
Endpoint Detection and Response software, Cyber-Security Awareness Training, Robust Backup and Recovery Plans, Vulnerability Patching, Remote Access and Authentication controls such as VPNs and MFA.
Canadian Municipality victim of Social Engineering and Business Email Compromise (BEC). A scammer impersonated the Chief Financial Offer (CFO) of an engineering firm hired to renovate a bridge and convinced employees of the City of Saskatoon, Canada, to modify the bank information provided for the service’s payment. As a result, the damages rose to more than $1 million.
Primary Cyber Insurance Response:
Social engineering and phishing campaigns are generally meant to elicit some type of employee response. There is a strong possibility that insurers will not pay for losses from a Business Email Compromise, as the loss was a result of an employee action. Businesses are advised to work with prospective insurers to understand what limits and exclusions are in place.
Best Preventative Measures:
Cyber-Security Awareness Training, Privileged Access Management, Improved email authentication and verification, tighter financial controls (ex. Dual approvals for large transactions).