Via insurance or otherwise, cyber-attack risks must be managed

THE risk of cyber attacks looms larger by the day, and few companies and governments can afford to blithely ignore the potentially devastating damages.

In 2014, for instance, over 83 million accounts of US bank JP Morgan Chase were compromised when hackers obtained the highest administrative privilege for dozens of its computer servers. Equally worrying was the breach suffered by eBay when hackers stole personal records of 233 million users. In Singapore, government portals and the websites of Prime Minister Lee Hsien Loong and President Tony Tan were under attack in 2013. More recently, it was revealed in Parliament this year that the Ministry of Foreign Affairs IT network also suffered a breach last year.

Cyber security insurance readily springs to mind as an option to mitigate risk, yet even in this space the challenges are not insignificant. A report by PwC, Reaping the dividends of cyber insurance, estimates that annual gross premiums for cyber protection is set to snowball from US$2.5 billion in 2014 to US$7.5 billion by the end of the decade. Ninety per cent of that insurance is purchased by American companies. While that suggests an obvious opportunity for insurers globally, it is not as straightforward as it may seem. Pricing, for one thing, is a hurdle - due to the dearth of data needed to better assess risk, which is itself dynamic. Many companies are reluctant to own up to cyber breaches in the effort to shield their reputations. There is also the difficulty of assessing damage which may be deep, far reaching and contentious. A vulnerability in a widely used software, for instance, can wreak widespread and simultaneous damage.