Analytics
1/26/2016
08:00 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Insurers Getting Smarter About Assessing Cyber Insurance Policy Risks

2016 shaping up to be a year of greater maturity in how insurance companies underwrite their cyber insurance policies.

Cybersecurity experts expect 2016 to be the year that insurance companies gain a greater level of maturity with how they underwrite cyber-insurance customers and assess them throughout the life of a policy. As that happens, customers could experience some pain as insurance companies get wise to the red flags of poor information security practices. But overall, this maturation could mean good things for cyber-insurance customers and the infosec world as a whole.

The most recent example of this maturation came last week two of the biggest global companies with a history in traditional disaster modeling and risk assessment for the insurance industry at large--RMS and AIR Worldwide-- announced they'll be moving into the cyber risk management market next month. Together with the Center for Risk Studies at Cambridge University, RMS and AIR worked with eight large insurers and reinsurers--including Lloyd's of London--to publish a Cyber Exposure Data Schema meant to create open standards for how the industry shares data about cyber risk, estimates losses, and to establish common language and categories that cut across the industry.

This move by more traditional players in the insurance market has been precipitated by a number of those in the cybersecurity space who have already started offering up products for insurers looking for better ways to assess and quantify their insureds' cyber risk posture. These services will continue to keep cropping up in spades as the insurance industry tries to balance the increasing demand for cyber insurance with the challenges of underwriting in a dynamic field new to most insurers.

According to PWC, the cyber insurance market is set to triple in the next few years and will reach $7.5 billion by 2020. Its industry watchers have already warned insurers that they've got to get smarter about how they assess risks and write their policies to fulfill this demand.

"If insurers continue to simply rely on tight blanket policy restrictions and conservative pricing strategies to cushion the uncertainty, they are at serious risk of missing this rare market opportunity to secure high margins in a soft market," says Paul Delbridge, insurance partner with PwC. "If the industry takes too long to innovate, there is a real risk that a disruptor will move in and corner the market with aggressive pricing and more favorable terms.”

As things stand, the methods of the third-parties and insurance companies currently quantifying cyberrisk are "all over the map," says Mark Weatherford, chief security strategist for vArmour and the former deputy under secretary of cybersecurity  for the DHS. Some consultants do it through an interview-based process and others through internal scanning, and still others like Risk Based Security and BitSight Technologies use externally visible network behavior to pinpoint companies exhibiting risky symptoms.

It'll likely be a long time, if ever, that the industry will decide on one set method. But this new open standard is a harbinger for a higher degree of rigor and scholarship that insurance companies will bring to bear as cyber insurance moves out of its Wild West days of shooting policies from the hip. As that happens, says Weatherford, there's going to be a period of adjustment for the information security community.

The more the insurance companies gain experience and tools in assessing the true risk posture of clients, the more likely policies will grow expensive for risky clients and claims will be rejected for those who fail to meet policy requirements. That may be an uncomfortable situation during this transition, but there are a lot of benefits in the long run, Weatherford says.

First of all, many insurers who have stayed out of the cyber insurance market due to their inability to accurately underwrite are going to be able to offer more policies to a wider range of firms. And secondly, added pressure from insurers is going to spur many organizations into getting their infosec acts together, Weatherford predicts. As companies are assessed before policies are written, the process may uncover issues they may have been unaware of and could spark management to invest in necessary security changes in order to meet minimum policy requirements.

Weatherford predicts that the insurance market will likely move toward a more dynamic, real-time means of keeping tabs on insureds' risk postures--similar to how Progressive adjusts its policies using a data dongle in its customers' cars to monitor driving habits.

"That's a wonderful thing for us in the security because, because now it's going to force companies to say 'If we want affordable cyber insurance, we're going have to invest in security, and we're going to have to be prepared to act fairly quickly when an event like Heartbleed happens," he says.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas and her guest, David Shearer, (ISC)2 Chief Executive Officer, as they discuss issues that keep IT security professionals up at night, including results from the recent 2016 Black Hat Attendee Survey.