1. Emerging Case of Cyber Insurance
Emerging Case of Cyber Insurance
Security is crucial for a society to flourish otherwise it is only a matter of time before society will
succumb to its sad end or shrink to an unnoticeable size. Societies which exist in today's world have
done two things exceptionally right in their past. One, they have not merely defended themselves
against invaders but attacked also. Two, if they could not beat the invaders, they did business with
them. And such societies are flourishing even today. Others faded.
In today's society digital computing is one of the major agents which are responsible for its
flourishing and prosperity. And hence security of digital computing infrastructure, institution which
rely on this infrastructure and users who get benefitted from these infrastructure and institutions
should be protected.
Today, we have insurance for almost everything which has a market value. We can insure our lives,
and our health. Government mandates that one should insure his vehicle. One can insure his real
estate property. In fact, large insurance companies can provide insurance cover to space missions. If
you understand how insurance work then you can skip a few following lines and start from next
paragraph. Insurance works on simple principle that if N person are 'insured' against an event E, the
probability of occurring event E to all the N persons together (in small time frame) is low and will
decrease as N increases. Consider a scenario where a company insured 100,000 people against
losing their lives for a modest fee of Rs. 10000 per annum for a period of 10 years. So, an insured has
to pay Rs 10000 every year for 10 years and if he dies, then insurer will pay him big amount say
Rs15,00,000. So company collected 100,000 x 100,000 in ten years and will pay 15,00,000 to family
members of deceased one. The most unfavorable case for insurer is death of all 100,000 persons and
most favorable case is of everyone surviving.
So insurer needs some analysis of an individual who seeks insurance. Insurer, will prefer
persons from various localities whose death rates are low. Now insurer can say that event E is highly
improbable and if it occurs it is really unfortunate and victim should be compensated for that. Such
companies can even share their profit for steps towards health programs which in turn help society
and companies.
Cyber insurance can be (and is) a lethal weapon against cyber attacks on enterprises. As human
being is mortal, an organization is always in danger of being breached. An organization can be
compromised either because of its loose security policies, unaware users or backstabbing employees
and highly lethal security attacks.
Cyber insurance will work on strict security principles. If an organization is insured then insurer will
pay for damages happened due to cyber security attacks. Cyber Insurer would like to prefer
organizations which are good at security and has low chances of being breached. Insurer would also
try its best to make sure that it does not insure an organization which is no way serious for security.
As always, they generally insure only for highly improbable events. Now, if an organization keeps
everything in place and spent millions of dollars on security and was never breached for say, 7 years.
A security attack happened and organization lost some business then it can be compensated against
these damages.

2. Emerging Case of Cyber Insurance
The new emerging business model of cyber insurance will have two though indirect but serious
impacts:
1. Cyber security of course is big business but it is highly technology based only. Cyber
insurance will make it more commodity based and couple it tightly with finance industry.
This will pressurize the stakeholders to take serious steps towards security, standards and
their enforcement. Eventually, Cyber insurance may become key driver for international
internet police.
2. Cyber security insurers will themselves adopt attacking methodologies against cyber attacks
and will force (or inspire) insured parties to be carefully defensive against cyber attacks.
Here little correlation between society surviving secrets and impacts of cyber insurance can be
drawn.
Three basic questions need to be answered to put any insurance business in operation.
1. Which improbable event organization can be insured against?
2. What will be insurance claim amount in case of event occurred?
3. What will be mode of paying premium and how much premium has to be paid?
Cyber Insurance as a case has two specific challenges which are not yet solved completely and hence
presents lucrative opportunities for researchers as well.
First challenge, advanced technologies are required (in their matured phase) to assess the security
standards deployed in a particular organization and risk associated with it. These two things if can be
quantified, then only it will become possible for an insurer to state that on what terms he can
provide insurance policy to prospective insured. We will also need advance forensics techniques to
verify the validity (or genuineness) of a cyber attack happened.
Second, innovative business models need to be explored and tough questions need to be answered
in the language of insurance providers.
Cyber insurers are expected to bank on big data analytics to determine the expectancy rate of
attacks for typical group of enterprises. Once cyber insurance policy are open in market, CISO has to
choose the right policy for their organization. They need to be quite clear what they want to insure
against. For example:
1.
2.
3.
4.
Loss in business due to shutdown hours
Loss in brand value due to data theft
Loss of employee productivity
Loss of infrastructure damage
Cyber insurance is almost ready to play a larger role in the enterprise security and risk policies. With
this new paradigm shift in the risk management skills like big data analytics, security standards
compliance testing, risk quantification approach and forensics are also expected to play important
roles.