The federal Internet Crime Complaint Center received more than 330,000 complaints in 2009, and more than a third of them ended up in the hands of law enforcement. The damages from those referred to the authorities totaled more than a half billion dollars. The Government Accountability Office estimated that cyber crime cost U.S. organizations $67.2 billion in 2005; that number has likely increased since then.
With so much of business conducted electronically, organizations of all types are highly vulnerable to theft and corruption of their data. It is important for them to identify their loss exposures and possible loss scenarios, and to prepare for them.
What types of property are vulnerable?
The organization should consider property it owns, leases, or property of others it has in its custody. Some examples:
- Money, both the organization’s own funds and those it holds as a fiduciary for someone else
- Customer or member lists containing personally identifiable information, account numbers, cell phone numbers, and other non-public information
- Personnel records
- Medical insurance records
- Bank account information
- Confidential memos and spreadsheets
- E-mail
- Software stored on web servers
Different types of property will be susceptible to various threats, such as embezzlement, extortion, viruses, and theft; to review product options see Crime MountainGuard.
What loss scenarios could occur?
The organization needs to prepare for events such as:
- A fire destroys large portions of the computer network, including the servers. Operations cease until the servers can be replaced and reloaded with data.
- A computer virus infects a workstation. The user of that computer unknowingly spreads it to everyone in his workgroup, crippling the department during one of the year’s peak periods.
- The accounting department discovers a pattern of irregular small funds transfers to an account no one has ever heard of. The transfers, which have been occurring for almost three months, were small enough to avoid attracting attention. They total more than $10,000.
- A vendor’s employee strikes up a casual conversation at a worker’s cubicle and stays long enough to memorize the worker’s computer password, written on a post-it note stuck to her monitor. Two weeks later, technology staff discovers that an offsite computer has accessed the human resources database and viewed Social Security numbers, driver’s license numbers, and other personal information.
In addition to taking steps to prevent these events, the organization should consider buying a cyber insurance policy. Several insurance companies now offer this coverage; although no standard policy exists yet, the policies share some common features. For an overview of coverage types and how cyber insurance typically works, see What is Cyber Liability?.
Policies usually cover property or data damage or destruction, data protection and recovery, loss of income when a business must suspend operations due to data loss, extra expenses necessary to maintain operations following a data event, data theft, and extortion. For policies that focus specifically on privacy events and theft of personal information, see Data Breach Insurance (Cyber Liability).
However, each company might define these coverages differently, so reviewing the terms and conditions of a particular policy is crucial. Choosing an appropriate amount of insurance is difficult because there is no easy way to measure the exposure in advance.
Consultation with the organization’s technology department and insurance company might be helpful, or you can talk to an agent to review coverages and deductible options.
Computer networks are a necessary part of any organization’s environment today. Loss prevention and reduction techniques, coupled with sound insurance protection at a reasonable cost, will enable an organization to get through a cyber loss event.
Frequently Asked Questions
What is cyber insurance and who should consider it?
Cyber insurance helps cover losses from data breaches, system outages, and related liabilities; organizations that store or process sensitive data should evaluate their need for coverage.
Does cyber insurance cover theft of customer information?
Many policies include coverage for theft of customer information and associated response costs, but coverages and limits vary by policy and insurer.
How do I choose an appropriate deductible?
Select a deductible your organization can afford to pay while balancing the premium savings achieved by a higher deductible.
What steps should I take before buying cyber insurance?
Identify your data assets and exposures, review policy definitions and exclusions, and consult your technology team and insurer before purchasing coverage.