Cyber insurance: Can you afford not to have it?

As the state of Georgia marks its first anniversary as a cyber insurance holder, officials there say they have no plans to be without it again.

That’s because in the event of a security breach, the insurance provider connects agency clients to vendors who can immediately begin remediation -- including digital forensics, legal, public relations and notification services.

“Because we already have the relationship with the insurance provider, effectively, they look like subcontractors to us,” Georgia CTO  Steve Nichols said. “It’s already been competed. We can just reach out and get things quickly.”

With those worries largely taken care of, the information security teams at state agencies can focus on important tasks – mainly, keeping cybersecurity up-to-date.

Having a list of vendors agencies can call for incident response and forensics gives Chief Information Security Officer Stanton Gatewood a "warm and fuzzy feeling," he said. And even though we have insurance, he said, we don't want to use it if we don't have to, so it has the added benefit of reminding the security professionals  to keep "sharpening their spears as far as their programs and their postures.”

Cyber insurance is coverage that public- and private-sector organizations can buy to help manage the costs related to security breaches, and states’ use of it is growing. About 38 percent of states had cyber insurance in 2017, according to the National Association of State Chief Information Officers’ October 2017 survey.

South Carolina is the most recent state to issue a request for proposals on cyber insurance on May 1, 2018, but other states bought in several  years ago. For instance, West Virginia has had a policy since 2014, and Utah since 2015.

A breach in 2012 was the impetus for getting insurance, Utah CISO Phil Bates said. “We wanted it to cover breaches -- that was the big thing -- the costs surrounding a breach,” he said. And those can be staggering. A 2017 Ponemon Institute study found that the per-record costs of data breaches to be $141, but other estimates go much higher.

Utah’s policy through Brit has a $1 million deductible and a $10 million cap. “I don’t see the landscape is getting any better, so I think this is something we’ll be dealing with for a while,” Bates said.

He recommended establishing a partnership with an insurance broker to help find the right policy – which is what the Georgia Technology Authority did, in collaboration with the state’s Department of Administrative Services. It worked with brokerage firm Willis Towers Watson before signing on to a $100 million cyber insurance policy with a retention, or deductible, of $250,000, effective July 1, 2017. DOAS Risk Management Services provides primary coverage, while XL Catlin and several others provide additional coverage. A total of $2.8 million was allocated across agencies to cover the premium.  

“The security landscape is changing pretty quickly, so you can really feel isolated and not sure what to do if you’re out there on your own,” Nichols said. “Being able to talk to the broker, talk to the lawyers, talk to a security forensics expert that can be as current as ‘Oh, we just saw this last week. This particular problem or vulnerability is going around.’ That gives me a lot of comfort.”

For a $1.82 million premium, Georgia gets coverage for:

• Breach of network security and/or data that was to be kept private.
• Defense expenses and any fines or penalties assessed by regulatory bodies.
• Lost revenue due to a network outage that exceeds 10 hours, as well as expenses to resume operations.
• Expenses associated with recovering, rebuilding or restoring data.
• Extortion incidents, including payment of ransom.
• Expenses associated with responding to an incident, including a crisis management company to help deal with the press, communications to impacted individuals.

Georgia’s policy covers all executive branch agencies with the exception of the Georgia Department of Defense (which serves as the state’s National Guard and is run like a federal agency), the state Department of Education and all higher-education institutions. Because insurers rank personally identifiable information (PII) high on the risk list, the broker said that including education data on minors would distort the pricing, Nichols said.

“Most of that [PII] data is held by agencies where we are managing all of their infrastructure through our outsourced contracts, so people were able to find some comfort in that,” Nichols said. “Even though we are not 100 percent consolidated, the parts where they felt the risk is are consolidated.”

Feeding frenzy

The demand for cyber insurance is high, said Paul Proctor, a vice president and distinguished analyst at Gartner.

“Right now it’s like a feeding frenzy: Just go get cyber insurance. From who? From where? It doesn’t matter. Just go get cyber insurance,” Proctor said. “On the buyer side, everybody is very concerned about this cybersecurity issue, and on the seller’s side of it, wow, are they making a lot of money. I mean, they can’t write policies fast enough, and people are just buying it hand over fist.”

But cyber insurance can be used as an excuse to be lax about security measures, he added, and that’s dangerous because agencies must have a defensible cybersecurity program in place to get and retain insurance. Companies aren’t going to pay out if an agency says it issues patches every 30 days and then a breach happens because the affected system hadn’t been patched in 60 days, for example.

“This is like you signing up for health insurance and ticking the box that says, ‘I’m a nonsmoker, and then you get lung cancer connected to the fact that you are a smoker,” Proctor said. “The insurance policy’s not going to pay for that.”

Cyber insurers are still climbing the learning curve, he added. That’s because unlike car or health insurance, “cyber insurance doesn’t have actuarial tables,” Proctor said. Using data such as car make and model or someone’s age and health history, insurers can estimate the likelihood of given problems, but “you can’t really do that with cyber insurance.”

The market will balance out eventually, and the signs are already there as premiums rise and payouts decrease, he said. “That’s going to lead to a balancing of people being able to choose appropriately when cyber insurance works for them and when it doesn’t,” Proctor said. “We are still a few years away from it being mature enough for everybody to be able to buy it with confidence and to get an appropriate deal for their situation.”