Protect Your Assets With Cyber Insurance

Policies can cover cost of repairs and lost business and can protect businesses from lawsuits over loss of confidential data

As some readers may have learned the hard way, you don’t have to be a Fortune 500 company to be the target of hackers or the victim of insidious viruses. Indeed, nine out of 10 companies experienced some form of computer security incident in 2005, according to the FBI Computer Crime Survey (www.fbi.gov) and 64 percent of the victims say they suffered financial damage, with the average hit exceeding $24,000.

Which is why, in only three years, cyber insurance has ballooned into a nearly $400 million business, according to Claire Wilkinson, vice president of global issues at the Insurance Information Institute (www.iii.org.). The new form of business insurance is designed to pay for the costs of untangling the mess and loss of business when computer systems are paralyzed.

Who Needs Cyber Insurance? If you use e-mail, have networked PCs, a Web site, or private customer data in your computer systems, you have a lot to lose. You may have firewalls, virus protection, anti-spam systems, and prudent procedures (see SBR White Paper) to protect passwords and prevent employees from downloading dangerous material. But these measures are not foolproof. When they fail cyber insurance kicks in.

The most obvious need is to pay for cleaning up after a worm or a hacker attack, cleaning and restoring infected files, etc. But also you may be unable to do business for several days. And you might be liable for allowing copyrighted material or private information about your clients to fall into the wrong hands.

Claims of misappropriation of data tend to be “very significant,” says Nick Economidis, vice president, product manager for technology, media and network security for AIG’s National Union Fire Insurance Co. of Pittsburgh, Pa. The cost of defending such claims can exceed $100,0000, he says.

TYPES OF COVERAGE

• Privacy and security liability. If you maintain private employee or customer data like credit card numbers, you are liable if the information slips out because of faults in your systems or theft by hackers or malicious employees. "Employees are quite often the source of the problem. They have the easiest access,” says Economidis, citing the recent case of the disgruntled bank workers in New Jersey who sold customer account records to crooks at $10 a pop.
  
  Privacy and security liability coverage also protects you from costly corporate claims from businesses like banks and credit card issuers, who can sue even if the losses don’t occur inside your shop. “Many small businesses outsource back office operations and technology services,” says Tracy Vispoli, vice president, global financial fidelity manager for Chubb. “But you never outsource your liability associated with keeping customer data private.”
  
  

• Crisis management covers costs for restoring lost or corrupted data, and getting your systems back up and running. Some carriers include public relations coverage to help defray the costs of consultants and advertising to rebuild your reputation after an incident.
  
  
• Business interruption, denial-of-service attack and lost income coverage kicks in if you lose revenue after an attack or when a service provider, such as a web host, is shut down by a cyber attack, has a glitch or goes out of business. It also helps defray costs of restoring valuable data and repairing systems.
  
  
• Cyber extortion. People threaten your computer systems or web site, then demand money or goods to call off the threat. Extortionists increasingly target small businesses because of their perceived inability to fight back, says Economidis. Cyber extortion policies often cover the “settlement” and the cost of hiring a security firm to track down the perpetrators.
  
  
• Media or web content liability coverage protects you from charges of libel, slander, copyright and trademark infringement for content, photos, and slogans you use on your web site, and those posted on bulletin boards and chat rooms by visitors. It also covers liabilities associated with banner ads on your site for other businesses.

What Does Cyber Insurance Cost?

Like all insurance, premiums vary according to your situation and the amount of coverage. Most companies issue stand-alone policies, like AIG’s netAdvantage, and Chubb’s SafetyNet and CyberSecurity. A typical annual premium would be $3,500 for about $1 million in coverage, with a $5,000 deductible, says Steven Haase, CEO of INSUREtrust, an Atlanta-based specialty insurance provider. That would cover privacy and network security suits, identity theft resolution and Web content liability. Small business policies can run as high as $5,000 to $25,000 per million in coverage with deductibles running up to $25,000, he adds.

CYBER-INSURANCE CARRIERS

ACE USA (www.ace-ina.com) AON (www.aon.com), American International Group (AIG) (www.aignetadvantage.com) Chubb (www.chubb.com) INSURETrust (www.insuretrust.com) SWBC (www.swbc.com) St. Paul Travelers (http://www.stpaultravelers.com)

Some property insurers, such as the Hartford offer add-on coverage. Hartford’s Cyberflex option adds from 2 percent to 5 percent to your regular premium.

HOW TO BUY CYBER INSURANCE:

Experts recommend using an experienced insurance broker who can look at your existing property and commercial liability policies, find any gaps in coverage, and shop for the best policies and rates for your situation. You fill out a simple application that collects basic information about your operations and revenues and some facts about your network/computer protection measures.

At some point, cyber insurance may become just another cost of doing business, like property coverage. That’s thanks to new consumer-protection laws. More than 30 states have followed the lead of California, where the SB 1386 consumer privacy bill requires companies to disclose computer breaches that might compromise personal data. Disclosure heightens exposure to litigation and, according to Vispoli, a federal bill like SB 1386 may be inevitable. “Every security breach disaster that becomes public makes it more difficult for Congress to turn a blind eye,” she says.

On a happier note, the growing need for cyber insurance should help make the coverage easier to buy, says Haase: “As competition heats up, policies will be more competitively priced, and simple to understand,” he says.