Cyber Insurance: Protecting Your Business Against Modern Digital Threats

Insurance is a safeguard against the unexpected costs of loss, damage, or injury. Despite our best efforts to prevent incidents like fires, thefts, or accidents, life is unpredictable, and these events can happen to anyone. When they do, the financial burden can be overwhelming. While we can’t predict if or when such an event will occur, we can measure the likelihood and impact of these occurrences by analyzing data from large populations.

A Brief History

The origins of insurance trace back to the 17th century, when the first insurance markets emerged to protect ships and cargo. Back then, the loss of a ship could spell disaster for a business. However, insurance provided a safety net, allowing businesses to mitigate these financial risks.

Insurers, by pooling resources and spreading risk, were able to predict potential losses and set premiums accordingly. As businesses have evolved, so too have the risks they face. While catastrophic losses remain a threat, the nature of these risks has changed dramatically.

The Emergence of Cyber Insurance

Cyber insurance, a product of the digital age, has been around since the 1990s. As businesses became increasingly reliant on technology, their exposure to new risks grew.

The introduction of data privacy laws, requiring companies to disclose data breaches, further highlighted the need for cyber insurance. High-profile breaches in the mid-2010s, which exposed the vulnerabilities of even the most secure systems, underscored the importance of having a safety net for cyber incidents.

Cyber incidents can be incredibly costly. Businesses may need to hire external consultants, legal experts, and communications specialists to manage the aftermath of a breach. This is on top of the potential losses incurred from disrupted operations. To address these challenges, the insurance market developed cyber insurance products.

However, it’s crucial to understand that cyber insurance is not a substitute for good cyber hygiene. Relying solely on insurance without implementing robust cybersecurity measures is a recipe for disappointment and skyrocketing premiums.

Balancing Cybersecurity and Cyber Insurance

A strong cybersecurity strategy involves a balance between investing in protective measures to reduce the likelihood of a breach and using insurance to mitigate potential losses.

The goal is to minimize risk while acknowledging that some level of uncertainty will always remain. Just as cybersecurity is a constantly evolving field, so is cyber insurance. Insurers must stay ahead of emerging threats to manage their risk exposure effectively.

Understanding Your Policy

Cyber insurance policies often contain exclusions, particularly concerning claims resulting from war or armed conflict, whether declared or not. This is understandable, as insurers want to avoid being overwhelmed by numerous costly claims from a large-scale attack.

A prime example of the devastating potential of cyberattacks is the NotPetya worm of 2017, which caused an estimated $10 billion in damage worldwide. While no one has officially claimed responsibility, the U.S. Department of Justice has indicted Russian military intelligence officers for their alleged role.

Nation-state-backed cyberattacks, like those attributed to military or intelligence agencies, can be particularly destructive. These states have the resources to develop sophisticated offensive capabilities over time and can choose the most opportune moment to strike. The potential consequences of such attacks are so severe that many cyber insurance policies now exclude coverage for state-backed attacks.

However, this exclusion raises a critical question: What exactly constitutes a state-backed attack? In traditional warfare, soldiers wear uniforms and carry national insignia, making it clear who they represent. In the cyber realm, there are no such identifiers.

Attackers can range from state-sponsored military personnel to independent criminals, and everything in between. The lack of clear markings in cyberspace makes it incredibly challenging to determine the nature and affiliation of an attacker.

The Complexity of Attack Attribution

Like any crime, cyberattacks leave behind evidence. However, in the digital world, these traces don’t necessarily point directly to the perpetrator. Many attackers use shared tools, making it difficult to distinguish one group from another. Moreover, the most sophisticated attackers actively work to obfuscate their identities, adding another layer of complexity to attribution.

State-backed attacks might not even be carried out by the state itself. Proxy actors and criminal groups or individuals that can execute operations on behalf of a government, further muddying the waters. In such cases, identifying the true source of an attack becomes a Herculean task.

In today’s complex threat landscape, knowing who is behind a cyberattack is crucial. However, the level of certainty needed for legal and insurance purposes is often elusive. Attribution is rarely straightforward and relies on a series of inferences. Analysts must weigh their findings carefully, often couching their conclusions in terms of probability rather than certainty.

The Future of Cyber Insurance

As cyber threats continue to evolve, the importance of attack attribution in cyber insurance claims is likely to increase. Security professionals should be prepared to gather and analyze forensic evidence that could support or refute attribution claims. This evidence could become a key factor in determining the outcome of insurance claims.

One thing is certain which only the threat actor knows exactly who carried out an attack and for what purpose, and they are unlikely to reveal themselves. In this ever-evolving landscape, understanding the limitations of cyber insurance and the importance of robust cybersecurity measures is essential for any organization.