Is The Time Right To Spread Your Risk?

Andrew Rose

For many years, security professionals have lived by the three pillars of risk management – AVOID, TREAT, ACCEPT.  These great tenets have served the profession well, enabling CISOs to build appropriately secure networks at a tolerable level of cost. Unfortunately, as evidenced by the litany of security breaches we have seen over the past 12 months, it’s clear that the landscape is changing.  More than ever before, security is clearly a ‘no-win’ game.

The high profile attackers, state-sponsored or otherwise, are one threat – but it goes deeper than this.  The keys to the kingdom are no longer in the hands of the generals and policy makers; their decisions and discussions are enabled by email, IM and IP telephony, all of which sit firmly in the domain of the IT department and system admin – and stressed, poorly paid employees do not make the ideal custodians of such critical information. As an example, Anonymous claims to have access to every classified government database in the US, but they didn’t hack them – disaffected system administrators and employees simply opened the doors for them, or sent them the access codes. 

As the broadening gap between our ambitions for a secure enterprise and our abilities to deliver on such a vision become self-evident, the time has come to pay equal attention to the poor cousin of risk management, “TRANSFER.”  For many CISOs, risk transference is a topic that is largely theoretical as, even when a task is outsourced, the risk associated with a breach commonly remains with the data owning organisation. Cyber insurance offers a different solution.

Read more

Is CyberLiability Insurance Becoming A More Feasible Risk Management Strategy?

Andrew Rose

The cyberinsurance market today represents only a tiny segment of the overall insurance industry, and a recent Forrester paper on the topic identified that only a very small percentage of organizations that have purchased business insurance have also purchased cyberinsurance. Many insurance companies, however, are now estimating a period of significant growth in this area, and recent conversations suggest that more companies are either interested in this coverage or have recently purchased such policies.

I'm interested to know where your organization sits on this topic. If you have a minute, please respond to our short poll on the topic

You can find the poll in the right column of this page, below the “About the Analyst” or “About this Blog” section.

------------------------------------------------------------------------------------------------------

7/22 UPDATE - An interesting story which seems to suggest that Sony may be trying to leverage cover from existing 'traditional' insurance policies to cover for recent cyber-losses, much to the annoyance of the insurer... http://www.theregister.co.uk/2011/07/22/sony_breach_insurance/

In the unlikely event that Sony do manage to get the insurer to pay, that would be an interesting development for the future of cyberliability insurance...