San
Francisco Based Security Firm Recommends Full Cyber Risk Assessment
to Prevent Losses that Can Cost Millions.
San
Francisco, CA, USA -- Losses from cyberattacks and security
breaches continue to plague companies of all sizes, and while more
organizations are investing in basic cyber insurance, most are
woefully underinsured. According to Greg Reber, CEO of AsTech
Consulting -- independent cyber security experts specializing in
software and IT infrastructure security -- to protect themselves,
companies need a comprehensive risk assessment and to work with
underwriters to make sure they both agree and understand the terms of
cyber insurance policies.
The
history of financial losses from a cyber-attack are well documented.
Target reported $252 million in expenses related to its data breach
in 2013, however the company only had $90 million in cyber risk
insurance. Similarly, Anthem Inc. suffered a data breach in February
2015, and the company is now providing credit monitoring and identity
protection services to patients who were affected. In both cases,
insurance coverage was inadequate to cover costs and additional
losses from litigation and class-action suits.
According
to a recent study by the Ponemon Institute, companies are four times
more likely to insure physical assets than information assets, even
though the Probable Maximum Loss (PML) from loss of intellectual
property can exceed $200 million. Of those surveyed by Ponemon, 52
percent see cyber risk exposure increasing but only 19 percent have
cyber insurance coverage with an average limit of $13 million, and 54
percent have no plans to purchase cyber insurance.
"Executives
underestimate the potential losses from a cyber-attack and are
unclear how to best insure their operation against potential losses,"
said Reber. "They buy cyber risk insurance, but too often the
coverage is inadequate since many insurance companies rely on
self-reporting when assessing areas of coverage. By being better
educated about cyber risk and cyber risk insurance and taking simple
preventative steps to isolate potential areas of cyber risk,
companies will be in a much better position to protect themselves
when they do have a security breach."
Cyber
risk insurance policy coverage is often based solely on information
provided by the company and insurance questionnaires are generic and
leave companies under insured. Another common issue is undervaluing
the potential losses from a cyber breach, resulting in substantial
losses not covered by insurance.
To
ensure proper cyber risk insurance coverage, Reber recommends
companies take a number of steps:
1.
Assess their cyber risk to understand the specific possibilities for
a cyber-attack and what data could potentially be exposed or lost.
The best approach is to assume that you can't cover all possible
contingencies, so it's a matter of when a breach will occur, not if.
2.
Develop a cyber breach response strategy, including remediation and
notification, to minimize potential losses.
3.
Work with an experienced cyber risk underwriter that understands the
potential losses from a cyber-attack or data breach and is willing to
develop a policy with adequate coverage.
4.
Review potential cyber risk annually, since the degree of cyber risk
changes over time.
About
AsTech Consulting
AsTech
Consulting has been helping Fortune 1000 companies manage risk and
protect vital information assets since 1997. AsTech's technical team
are true Internet security experts, providing a full suite of
services focused on risk management and mitigation including
Vulnerability Discovery and Remediation, Secure Development Training,
Secure Software Development Lifecycle Consulting and Security
Architectural Design. For more information, visit
http://www.astechconsulting.com.
Contact:
Tom
Woolf
Public
Relations Director, Gumas Advertising
415-259-5638
