IT Employment

Ask something
Discussion Locked

Insured against cyberterrorism?

0 helpful
9 replies

by wordworker

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Fellow technophiles, Do any of your companies carry insurance coverage for cyberterrorism? The reason I'm asking is one of my consulting clients (billion+ annual revenues) sought a quote from an insurance vendor, and got a quote for an outrageously expensive premium, a 7-digit deductible, and a mere 8-digit policy limit. The coverage would be for internet media, security, cyber extortion, and information asset liability.

It was priced so high and the limit so low that it's a no-brainer NOT to buy it. Is that the prevailing norm in the insurance biz, to make it so high-priced that no one bothers with it? If so, I'm wondering if it's because the insurance folks don't fully understand the technology they're asked to insure. Or maybe the insurance agency looks at all IT infrastructures like they do flood insurance for double-wides parked down by the river - not worth the gamble. I'd be curious to know what other companies are doing.

9 replies

by mrafrohead

Why would you get insurance against cyberterrorism.

I think that's something you would contact the police/fbi over. Not an insurance agent. Unless you have something to hide and don't want the public to get notice of.

Mrafrohead

by maxwell edison

.
Any company's general property and liability insurance policy probably covers just about any loss incurred other than those self-inflicted or caused by an act of war. So the question is this. Is cyberterrorism, as you are addressing it, an act of war or an act of vandalism?

The Department of Homeland Security (specifically the National Infrastructure Protection Center) defines cyberterrorism as follows: a criminal act perpetrated through computers resulting in violence, death and/or destruction, and creating terror for the purpose of coercing a government to change its policies.

"So to qualify as cyberterrorism, an act must fulfil two criteria: a political motivation and a destructive result. But computer attacks usually satisfy only one: the motivation. It's far more difficult to cause destruction with computers. If phones don't work, it's annoying, perhaps costly, even dangerous, but not in and of itself destructive. Even the most often cited cyberterrorist threat - shutting down the Internet - is that really destructive, or just a massive inconvenience? Most experts believe it's the latter. Very few malicious uses of technology qualify under (the) definition of cyberterrorism."

- From CIO Magazine article titled: The Truth About Cyberterrorism, by: Scott Berinato, CIO

See the whole article here (if you're interested):

http://www.cio.com.au/index.php?id=1286316100&fp=32768&fpid=1353259216

or

http://tinyurl.com/28kr3

It sounds to me like your really talking about cybervandalism (Did I just make up a new word?), which would certainly be covered under most general property and liability insurance policies, at least that would be my take on it. I suppose if I were considering such a threat to my system, I might consult an insurance attorney (not from the insurance company that gave the rate) to define the real terms and how they'd be covered.

by wordworker

Thanks guys for the quick responses. Let me try again without using "cyber terrorism" as the label for the possible event for which insurance might be bought. Let's assume that the coverage is not specifically geared toward a possible act of terrorism as defined by the US Gov.

How about this: Should you have insurance on the data stored on your network? How much would it cost to recover if your information assets were hacked and stolen, damaged, or destroyed by a really nasty e-mail bug that got through because it was new and there wasn't a pattern in the constantly-updated antivirus database to catch it?

(Assuming of course that you *could* eventually recover the data.)

by dc_guy

As a software metrics specialist, I can tell you with some authority that the state of the art in measuring the value of virtual assets is dismal. The best most companies can do is estimate how long it would take them to get back in business using their disaster recovery resources (which they can do fairly accurately using their disaster recovery plan) and then estimate the cost of the down time (which they can do fairly accurately because most of them have already got their gross revenue calculated down to the minute). For insurance purposes, then, all that's needed is to estimate the probability of occurrence, calculate the expected value, and determine whether the insurance is a good deal. Most companies choose to self-insure because, as you've found, the premiums have no correlation with the risk. You seem to be referring to an unrecoverable loss of computerized data. That's a pretty remote risk, assuming that your company has done its homework and has backup of appropriate depth and speed: generations of archived data that will almost surely go back to before the hacker first struck, audit trail to recover the subsequent transactions, and a hot site that will save a day or more in getting back online. Most companies that are automation-intensive would go bankrupt after just a few days without their information systems. There's no way to buy an insurance policy for that. You simply have to make sure that it's impossible beyond a reasonable doubt.

by wordworker

Thanks DC_Guy - you have confirmed what we thought when we got the quote.

>>assuming that your company has done its homework and has backup of appropriate depth and speed...audit trail to recover the subsequent transactions, and a hot site that will save a day or more in getting back online<<

What amazes me is the number of companies who have NOT done this kind of homework and preparation, even in the aftermath of 9/11/01.

by mrafrohead

As long as you are running backups regularly, there shouldn't be a problem. IF you are compromised, just restore.

That should take care of it.

by jkaras

Insurance for my insurance!! What is going on that we need this type of insurance? How do you collect? I'm sure they will deny a claim that you didnt protect the network properly. Insurance never pays, they use tactics to increase the flow of money in rather than payout their recipiants. What training would these adjuster have to determine or assess the situations? Talk about a sucker bet! Business has risk, you cant completely protect yourself from everything. I wish I was a scumbag so I could open an insurance company and bilk people out of money off of fear.

by wordworker

You're right about the adjusters not knowing what they're evaluating. You should have seen the goofy questions the insurance company asked us to fill out before they even issued the quote. It was obvious that a non-technical person thought them up.

You work in real estate appraisal in Florida, right? So can owners of ocean-front property get, say, hurricane insurance that will pay back the full appraised value of the home or property in case Hurricane Helen comes blasting through?

by jkaras

They probably wouldnt offer it to those people. The premium would be astronomical. Most people in Florida have hurricane insurance but from what I understand from working in the home improvement industry is that if you dont make any attempt to protect your home during said hurricane you get decreased payout or denied. Case in point, boarding up windows, use of sandbags, hurricane rated 55 mph shingles (even though they are not rated that high and you cant get them anywhere).

When I lived in California during the big fires, State Farm denied claims only paying .50 on the dollar of the policies claiming that they would go bankrupt. It took old slick willie to command them to make good after almost a year. I moved here in Orlando in 93 right after a major hail storm damaged everything. The insurance companies tried everything in the book to deny claims, claiming it was an act of God, or you didnt make an attempt to remove your car from the storm finding shelter. Insurance companies make me sick that they can actually look themselves in the mirror or their children's faces after screwing a family out of everything, all for a paycheck!

This discussion is closed to new replies.