Cyber insurance provides coverage for losses from cyber incidents and security breaches. It helps manage cyber risks through risk sharing. However, the cyber insurance market is still immature with global losses from cyber incidents exceeding the total cyber insurance market. Key challenges include asymmetric information between insurers and clients, interdependent and correlated cyber risks, and limited reinsurance capacity due to lack of claims data and potential for simultaneous global attacks.

1. Cyber Insurance Kshitij Rohan Stuart Shromon Prateek

2. Cyber-Insurance in a Nutshell Risk sharing avoid extreme losses at manageable expenses Security metric premiums differentiate good and bad risks Incentive function to develop and deploy sound security technology Market for cyber-insurance immature losses from cyber incidents in the range of $ 200 bn global cyber-insurance market < $ 2 bn -Majuca et al., 2006 (Danger of) High correlation of cyber-risks due to homogeneous technology -Geer et al., 2003

3. Information Technology

4. Cyber Crime Cyber crime is usually restricted to describing criminal activity in which the computer or network is an essential part of the crime, this term is also used to include traditional crimes in which computers or networks are used to enable the fraudulent activity. Spamming and criminal copyright crimes Unauthorized access (i.e, defeating access controls), malicious code Theft of service like any financial frauds Social engineering frauds (e.g., hacking, identity theft, child pornography, online gambling, securities fraud)

5. Cyber Crime Cyber crimes that are most frequently conducted are : Theft of information contained in electronic form Virus / worm attacks Trojan attacks Web jacking Computer security breaches can have a first-party impact (on the firm itself) a third-party impact (on clients).

6. Example The ICICI Bank Example A few customers of ICICI Bank received an e-mail asking for their Internet login name and password to their account. The e-mail seemed so genuine that some users even clicked on the URL given in the mail to a Web page that very closely resembled the official site. Such a scam is known as 'phishing.‘ On submission of the confidential information the information was directed to another email ID.

7. Classes of Cyber-Risks Insider attack Hardware failure Configuration vulnerability (user settings) Configuration vulnerability (default settings) Viruses and worms Targeted hacker attack Standard software exploit requiring user interaction Remote standard software exploit Systemic errors (Y2K, break of assumed secure cryptography)

8. Cyber-Insurance Scenario Global Risk Correlation Decisions are made at firm-level

9. Cyber-Insurance Scenario Internal Risk Correlation Decisions are made at firm-level

10. Two-Step Risk Arrival

11. Who needs cyber insurance? Do you ? Use e-mail have networked PCs Web site private customer data in your computer systems You may have firewalls virus protection anti-spam systems prudent procedures to protect passwords prevent employees from downloading dangerous material

12. What is Cyber Insurance ? The steadily rising number of cyber crimes bring new urgency to efforts to strengthen IT security at every level. IT security has traditionally referred to technical protective measures such as firewalls, authentication systems, and antivirus software to counter such attacks. The most effective way to provide relatively comprehensive coverage for computer disasters is through cyber insurance. Cyber insurance is considered a method of better managing IT security threats because cyber-policies cover areas normal insurance policies do not.

13. Coverage's.. Typical coverage's include the following: First-party business interruption covers revenue lost during system downtime caused by accidents and security breaches. First-party electronic data damage covers recovery costs associated with compromised data Third-party network security liability covers losses associated with the compromise and misuse of data for such purposes as identity theft and credit card fraud. Third-party media liability covers infringement and liability costs associated with Internet publishing, including Web sites, e-mail and other interactive online communication.

14. Types of Cyber Insurance Privacy and security liability. Crisis management Business interruption, denial-of-service attack and lost income Cyber extortion Media or web content liability

15. Cost of Cyber Insurance Premiums vary according to your situation and the amount of coverage Most companies issue stand-alone policies AIG’s netAdvantage Chubb’s SafetyNet and CyberSecurity Annual premium would be $3,500 for about $1 million in coverage, with a $5,000 deductible, That would cover privacy and network security suits, identity theft resolution and Web content liability.

17. How does Cyber Insurance work ? Value-Vulnerability Grid

18. Cyber-Insurance Management Framework

19. Decision Plan

20. Benefits Of Cyber Insurance Prospective benefits of well-functioning markets for cyber-insurance include a focus on market-based risk management for information security, with a mechanism for spreading risk among participating stakeholders; greater incentives for private investments in information security that reduce risk not only for the investing organization but also for the network as a whole; better alignment of private and public benefits from security investments; better quantitative tools and metrics for assessing security; data aggregation and promulgation of best practices; and development of a robust institutional infrastructure that supports information security management.

21. Benefits Of Cyber Insurance Thus cyber-insurance can, in principle, be an important risk-management tool for strengthening IT security and reliability, both for individual stakeholders and for society at large. But are these prospective benefits realistic and achievable?

22. Trends In Cyber Insurance Pre 1990: little commercial demand for property or liability insurance specifically covering losses from network security breaches or other IT-related problems. Rapid growth of e-commerce kindled significant interest in such coverage. The Y2K computer problem, although ultimately resulting in little direct damage or loss, brought further attention to cyber-risk issues and pointed out the limitations of existing insurance coverage for IT failures. Potential liability from IT security breaches has increased as a result of federal legislations in the US and Europe.

23. Trends In Cyber Insurance Mid 90s: few insurance companies developed specialized policies covering losses from computer viruses or other malicious code, destruction or theft of data, business interruption, denial of service, and/or liability resulting from e-commerce or other networked IT failures. Coverage was spotty and limited, but premiums were high. Moreover, numerous legal disputes arose over whether such losses could come under general commercial property or liability policies that were written to cover direct physical damage to tangible assets.

24. Trends In Cyber Insurance Businesses now generally buy stand-alone, specialized policies to cover cyber risks. According to Betterley Risk Consultants surveys, the annual gross premium revenue for cyber insurance policies has grown from less than US$100 million in 2002 to US$300 to 350 million by mid 2006. Industry experts believe that cyber insurance will be one of the fastest growing segments of the property and casualty market over the next several years.

25. Trends in Cyber Insurance..

26. Limitations for Cyber Insurance Asymmetric information A problem that exists for most established insurance markets as well as cyber insurance. Insurance companies feel the effect of asymmetric information both before and after a customer signs an insurance contract. Adverse selection problem Customer who has a higher risk of incurring a loss will find insurance at a given premium more attractive than a lower-risk customer. Differentiating between these two types of customers is crucial to run a profitable business. There are methods to reduce asymmetric information between insurer and policyholder, but none of them are fool-proof.

27. Limitations for Cyber Insurance Second impact occurs after an insurance contract has been signed. Insured parties can take actions that increase or decrease the risk of claiming, but insurer can‘t observe the insured’s actions perfectly. The problem of moral hazard also arises under full insurance cover. Partial insurance and clauses may mitigate certain actions by insured and clauses in the insurance contract. Many actions remain unobservable. Problem of asymmetric information is common to all insurance markets; however, most markets function adequately given the range of tactics used by insurance companies to overcome these information asymmetries. Many of these remedies have developed over time in response to experience and result in the well-functioning insurance markets we see today.

28. Limitations for Cyber Insurance Interdependent and correlated risks To face a steady claim stream and avoid large spikes in payouts, insurers must maintain a sufficiently large policyholder base and insure risks that are relatively independent and uncorrelated. In the case of cyber insurance, risks might be correlated and interdependent. Events that are likely to result in concurrent claims from a substantial proportion of policyholders impose a high probability of ruin on a cyber-insurer.

29. Limitations for Cyber Insurance Inadequate reinsurance capacity Insurers face events that prompt many claims at once, such as large natural disasters. Primary underwriters can limit their total exposure by passing some of their risk to well-capitalized reinsurers. Geographically diversifying or even quantifying cyber-risks seems more problematic, however, because cyberattacks might be globally correlated and interdependent. Paucity of prior claims data coupled with the plausibility of simultaneous attacks worldwide make reinsurers reluctant to provide catastrophe protection for business interruption or related cyberlosses that some think could reach US$100 billion.

30. Limitations for Cyber Insurance Insurers and reinsurers have spent a tremendous amount of time and resources to quantify the actual expected losses to any existing or theoretical portfolio of risks. The Internet is very unique in that on the surface at least, it does not look to be able to be modeled in this way. Whereas natural perils losses occur in a specific geographical location, the Internet is both everywhere and nowhere at the same time, while the perils to be protected are still being fully identified and defined. The practical consequences of correlated and interdependent risks are seen in limited reinsurance capacity, which makes it difficult for large firms to obtain large cyber insurance policy limits.

31. Thank You !!!!