Via insurance or otherwise, cyber-attack risks must be managed
THE risk of cyber attacks looms larger by the day, and few companies and governments can afford to blithely ignore the potentially devastating damages.
In 2014, for instance, over 83 million accounts of US bank JP Morgan Chase were compromised when hackers obtained the highest administrative privilege for dozens of its computer servers. Equally worrying was the breach suffered by eBay when hackers stole personal records of 233 million users. In Singapore, government portals and the websites of Prime Minister Lee Hsien Loong and President Tony Tan were under attack in 2013. More recently, it was revealed in Parliament this year that the Ministry of Foreign Affairs IT network also suffered a breach last year.
Cyber security insurance readily springs to mind as an option to mitigate risk, yet even in this space the challenges are not insignificant. A report by PwC, Reaping the dividends of cyber insurance, estimates that annual gross premiums for cyber protection is set to snowball from US$2.5 billion in 2014 to US$7.5 billion by the end of the decade. Ninety per cent of that insurance is purchased by American companies. While that suggests an obvious opportunity for insurers globally, it is not as straightforward as it may seem. Pricing, for one thing, is a hurdle - due to the dearth of data needed to better assess risk, which is itself dynamic. Many companies are reluctant to own up to cyber breaches in the effort to shield their reputations. There is also the difficulty of assessing damage which may be deep, far reaching and contentious. A vulnerability in a widely used software, for instance, can wreak widespread and simultaneous damage.
For these reasons, insurers today set limits on their cyber coverage. PwC points out that while the maximum limit may be US$500 million, some companies have difficulty securing more than US$300 million. High premiums are also an issue. "Given the high cost of coverage, the limits imposed, the tight attaching terms and conditions, and the restrictions on whether policyholders can claim, many policyholders are questioning whether their cyber insurance policies are delivering real value," said PwC. Earlier this year, the head of the largest insurer Lloyd's of London called for governments to step in to cover cyber risk, as potential liabilities are too large for insurers' balance sheets. To illustrate the potential fallout, Lloyd's and University of Cambridge Centre for Risk Studies looked into a hypothetical scenario where hackers brought down parts of the US power grid, affecting 15 states. The impact to the US economy was estimated at US$243 billion, rising to more than US$1 trillion in the most extreme version. Claims paid by the insurance industry were estimated at between US$21 billion and US$71 billion.
Singapore's establishment of the Cyber Security Agency earlier this year acknowledges the national and even global nature of cyber threats. To date, it has signed memoranda of understanding with the UK and France to work together to strengthen cyber security. In the private sector, Singtel has set up an advanced security operations centre to track and stop online breaches. Elsewhere, the governments of Australia, US, UK and the European Union are at various stages of mulling over mandatory reporting of data breaches. Can governments step in as insurers of last resort? To be sure, most governments will prefer a commercial solution. But for now, all parties - government, companies and insurers - will have to brace for more risk than they bargained for.
