Risk Insider: Tony Boobier

Is There a Need to Redesign Cyber Insurance?

By: | April 28, 2016

Tony Boobier is an experienced independent consultant focusing on insurance analytics. An international speaker, commentator and published author, he lies awake at night thinking about the convergence of insurance and technology. He can be reached at [email protected].

When FBI Director James Comey said, “There are two kinds of big companies in the United States. There are those who’ve been hacked … and those who don’t know they’ve been hacked…,” he was reinforcing the fact that hacking is increasingly becoming a mainstream activity.

Tools such as Crackz, hackz, scriptz and others enable a user to gain additional access to computer systems and information or to run a program they have not legally purchased. Ask your search engine “how to hack” and not only will you get a long list of advice, but you will even find a video which has had more than four million visits.

The problem has moved beyond individual opportunists. It is an issue which increasingly involves premediated crime, often with a financial or disruptive motive. It also has its own language such as “Trojan” — a malicious program that perform actions not authorized by the computer user.

Will the vision of insurance marketers to have insurance based on connected cars, homes and people ultimately prove to be the Achilles’ Heel of their companies?

Increasingly hackers see themselves as guns for hire, selling both services and data on the dark web. Sometimes known as “Butterfly Hackers,” they focus on corporations and use sophisticated tools, often with inside knowledge of the organization.

This inside knowledge often comes from disgruntled employees. It’s even said that the most dangerous person in an organization is the IT manager, as they are best placed to know the system. They are paid through the very same technology that insurers and banks are contemplating for their own future, that of bitcoins operating in a blockchain environment.

Typical hacks may simply demand money from the personal user, using ransomware, which even provides call-back software for ease of payment. In a corporate environment, the hacks may extend to distributed denial of service (DDoS) attacks, effectively putting an online company out of business as it is bombarded with multiple anonymous inquiries.

But it isn’t always negative. A new profession of ethical hackers known as “white hats” has emerged. Their job is to assess the security of computer systems using penetration testing techniques. There’s even a professional qualification in the subject.

As this era of Big Data continues, 2.5 gigabytes of data are created daily by 6.4 billion connected things. In 2016, 5.5 million new things will get connected every day.

Technology research firm Gartner believes we will reach 20.8 billion connected things by 2020.

Some experts are already suggesting that the way into corporate systems will not be through a direct approach but rather through the multitude of less secure external devices. Will the vision of insurance marketers to have insurance based on connected cars, homes and people ultimately prove to be the Achilles’ Heel of their companies?

The recent news that cyber hackers stole $950 million in what is thought to be the world’s biggest bank raid should be enough to raise the alarm bells. JPMorgan’s 2014 hack is said to have affected 100 million customers. The recent hack of the Panamanian law firm Mossack Fonseca is said to involve 11.5 million documents. With the recent ‘Dieselgate’ affair at Volkswagen said to be likely to cost up to $35 billion, what might be the financial impact of a hacked connected car system for a major manufacturer?

As insurers increasingly focus on operational risk — that is, failure due to systems, processes, people and external events — as a key element of managing their capital adequacy and solvency, how will the regulators and insurance commissioners view the potential increase in the risk of someone infiltrating an insurer’s own site through some form of remote device?

Overall, there seems to be agreement that prevention is better than cure, but where cyber crime happens, it is critical that companies carry appropriate insurance cover. Cyber insurance cover has been around for a decade or so, but as cyber crime has developed, then doesn’t insurance cover also need to mature? With policies provided by some major insurers giving cover to $100m, isn’t it time to think about whether this is enough?

More from Risk & Insurance