Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

1/26/2016
08:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Insurers Getting Smarter About Assessing Cyber Insurance Policy Risks

2016 shaping up to be a year of greater maturity in how insurance companies underwrite their cyber insurance policies.

Cybersecurity experts expect 2016 to be the year that insurance companies gain a greater level of maturity with how they underwrite cyber-insurance customers and assess them throughout the life of a policy. As that happens, customers could experience some pain as insurance companies get wise to the red flags of poor information security practices. But overall, this maturation could mean good things for cyber-insurance customers and the infosec world as a whole.

The most recent example of this maturation came last week two of the biggest global companies with a history in traditional disaster modeling and risk assessment for the insurance industry at large--RMS and AIR Worldwide-- announced they'll be moving into the cyber risk management market next month. Together with the Center for Risk Studies at Cambridge University, RMS and AIR worked with eight large insurers and reinsurers--including Lloyd's of London--to publish a Cyber Exposure Data Schema meant to create open standards for how the industry shares data about cyber risk, estimates losses, and to establish common language and categories that cut across the industry.

This move by more traditional players in the insurance market has been precipitated by a number of those in the cybersecurity space who have already started offering up products for insurers looking for better ways to assess and quantify their insureds' cyber risk posture. These services will continue to keep cropping up in spades as the insurance industry tries to balance the increasing demand for cyber insurance with the challenges of underwriting in a dynamic field new to most insurers.

According to PWC, the cyber insurance market is set to triple in the next few years and will reach $7.5 billion by 2020. Its industry watchers have already warned insurers that they've got to get smarter about how they assess risks and write their policies to fulfill this demand.

"If insurers continue to simply rely on tight blanket policy restrictions and conservative pricing strategies to cushion the uncertainty, they are at serious risk of missing this rare market opportunity to secure high margins in a soft market," says Paul Delbridge, insurance partner with PwC. "If the industry takes too long to innovate, there is a real risk that a disruptor will move in and corner the market with aggressive pricing and more favorable terms.”

As things stand, the methods of the third-parties and insurance companies currently quantifying cyberrisk are "all over the map," says Mark Weatherford, chief security strategist for vArmour and the former deputy under secretary of cybersecurity  for the DHS. Some consultants do it through an interview-based process and others through internal scanning, and still others like Risk Based Security and BitSight Technologies use externally visible network behavior to pinpoint companies exhibiting risky symptoms.

It'll likely be a long time, if ever, that the industry will decide on one set method. But this new open standard is a harbinger for a higher degree of rigor and scholarship that insurance companies will bring to bear as cyber insurance moves out of its Wild West days of shooting policies from the hip. As that happens, says Weatherford, there's going to be a period of adjustment for the information security community.

The more the insurance companies gain experience and tools in assessing the true risk posture of clients, the more likely policies will grow expensive for risky clients and claims will be rejected for those who fail to meet policy requirements. That may be an uncomfortable situation during this transition, but there are a lot of benefits in the long run, Weatherford says.

First of all, many insurers who have stayed out of the cyber insurance market due to their inability to accurately underwrite are going to be able to offer more policies to a wider range of firms. And secondly, added pressure from insurers is going to spur many organizations into getting their infosec acts together, Weatherford predicts. As companies are assessed before policies are written, the process may uncover issues they may have been unaware of and could spark management to invest in necessary security changes in order to meet minimum policy requirements.

Weatherford predicts that the insurance market will likely move toward a more dynamic, real-time means of keeping tabs on insureds' risk postures--similar to how Progressive adjusts its policies using a data dongle in its customers' cars to monitor driving habits.

"That's a wonderful thing for us in the security because, because now it's going to force companies to say 'If we want affordable cyber insurance, we're going have to invest in security, and we're going to have to be prepared to act fairly quickly when an event like Heartbleed happens," he says.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17475
PUBLISHED: 2020-08-14
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
CVE-2020-0255
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-10751. Reason: This candidate is a duplicate of CVE-2020-10751. Notes: All CVE users should reference CVE-2020-10751 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-14353
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-18270. Reason: This candidate is a duplicate of CVE-2017-18270. Notes: All CVE users should reference CVE-2017-18270 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-17464
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-17473
PUBLISHED: 2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.