Cyber Liability Insurance

Nowadays many organisation's main assets are their information and networks rather than physical things like office buildings. Also, the protection of the privacy of employees, customers and the public is a growing issue.

At a talk organised by the Insurance Institute of London, Emily Freeman of insurance brokers Lockton explained why conventional insurance policies such as general commercial liability, professional indemnity, errors and omissions (E&O) liability, criminal damage, privacy and property protection are very unlikely to cover the effects of information damage or loss. If you want insurance to offer worldwide protection against damage and consequential losses, possibly with the involvement of insiders, you need an explicit policy—typically called cyber liability insurance.

Not all cyber liability insurance products are the same and the package should be discussed with your existing broker or one that specialises in cyber insurance. The aspects to consider are:

• data network availability and damage
• loss or damage to sensitive data
• internet defamation, copyright and trademark infringement
• data breach notification and crisis management
• regulatory investigations, fines and penalties.

Apparently there is now a trend in litigation moving on from omissions and correctness, to "is it doing it securely?".

Something, then, to be considered more in web application specifications and acceptance testing.

Web site operators (especially those that collect personally identifiable information, rely on the web site for critical business processes, operate in a more highly regulated environment, or who allow users to contribute content) should investigate the risks and possible benefits of cyber liability insurance. No web-enabled system can be completely secure, but you'll need to demonstrate that you are applying and monitoring security best practices—otherwise you might not be able to transfer any risk at all to an insurer.

The recent data breach at Heartland Payment Systems in the United States reminds us that compliance is not security. It seems the data was copied using a technique requiring a high level of system access. Take care!