Page 39 - Info_Jan_2024

Technology Update
Cyber Extortion
Payment of extortion money is not generally
recommended in case of ransomware attacks.
However, recovering from such attacks may
sometime require payment of ransom. Cyber
insurance provides compensation of expenses
towards payments to extortionists who encrypted
the data and/or threaten to disclose sensitive
information. The cost of hiring the services of a
professional negotiator is also covered under
such insurance policies.
Business Interruption
Loss of income due to actual or potential
impairment or denial of operations in the
aftermath of cyber-attacks is a major concern for
many business establishments. Cyber insurance
covers the loss of income as well as the extra
expenses incurred during the recovery period.
Response Cost
Businesses sometimes find it difficult to cop-
up with the expenses for Forensic Investigation
to assess the spread and depth of the attack
following a security breach. As a result a
complete root cause analysis is often avoided
and the security holes are left unidentified
and unattended. Cyber insurance comes to the
aid of such organisations so that the chances
of recurrence of similar security incidents are
minimised.
Legal Recourse
Cyber insurance policies provide reimbursement
of expenses towards legal advice and regulatory
compliance in the wake of a cyber incident. This
includes cost of determining indemnification
obligations in the contracts of the organisations
with a third party. Policies also provide indemnity as external source, and insurance policies usually
against violation of privacy laws caused by a
security breach.
Public Relation
Media handling is a vital activity in management
of any crisis. Cyber insurance policies can be
customized to include the cost of handling
reputation attacks in the event of a security
breach. The expenses to mitigate any negative
publicity and cyber defamation due to the
security incident are also often covered by such
policies.
Notification Expenses
This includes the costs of notifying third parties
potentially affected by a security breach. This
often deserves importance considering the vast
extend and strategic nature of the clientele of the organisations. Proper risk assessments and
affected organisation.
Privacy Liability
Cyber insurance policies provide indemnity
against third-party damages that result from the
disclosure of confidential information handled
by the insured. This also includes coverage
for vicarious liability where a vendor loses
information the insured had entrusted to them.
System Liability
Damages that result from the failure to protect
the electronic data of a third party during a
cyber-attack is a major cause of concern for
many organisations. Policies provide coverage for
defense costs for which the insured is liable for
third-party damages.
Access Liability
Businesses often may have to compensate
for denial of services to the clients in the
wake of cyber-attacks. Insurance policies
provide indemnity from claims resulting from
unavailability of IT systems to such customers.
Source of Cyber Threats
Cyber threats can emanate from internal as well
provide coverage for such threats irrespective of
their source and cause. Ignorance and negligence
of employees are the most common cause of
internal threats. Lack of awareness and training
among employees causes improper handling of
systems which may ultimately pave way to cyber-
attacks. Negligence among employees may lead to
serious security issues such as misconfiguration
of systems and loss of credentials and even the
devices. Malicious and disgruntled employees are
another common cause for internal threats which
may lead to loss of data and denial of services.
Ransomware attacks are the prominent form of
external threats covered under cyber insurance.
There exists a cyber-crime business model
called Ransomware as a Service where malicious
elements hire the services of operators who are
technically skilled to develop malware and launch
ransomware attacks. State and non-State Hackers
as well as Hacktivists form another major source
of cyber-attacks which jeopardizes the services
of any business house. Corporate espionage and
malicious stakeholders (such as vendors in supply
chain) are also serious cause of concern for many
contractual agreements will enable businesses to
function in a realistic environment.
Side Benefits
Cyber Risk Insurance has a couple of side
benefits as well. A comprehensive security audit
of the digital assets is one of the pre-requisite for
the candidate organisations to avail the coverage
of the risk insurance. This effort will help the
entities to determine the existing vulnerabilities
and to undertake necessary remedial measures
to fix those vulnerabilities. This process in-turn
improves the security posture of the organisation
and reduces the chances of security incidents.
A qualitatively superior and quantitatively
accurate assessment of risk is another
prerequisite to arrive at the premium of cyber
risk insurance policies. This exercise distributes
risks fairly among all the parties involved and
avoids concentration of risk with any one of the
stakeholders. This ultimately will put an end to
free-rides by some players and burden each one
with their share of risk. Ensuring security audit and
risk assessment, whenever the insurance policies
are renewed, will maintain the organisation in
a healthy condition vis-a-vis cyber security and
financial stakes.
Conclusion
With the increasing frequency of cyber-attacks,
it’s more important than ever to have the right
people, policies and technologies in place to
protect organization’s sensitive information and
assets. It is increasingly becoming important
to establish a backup mechanism to shoulder
the financial burdens of any such attacks. Like
any other insurance product, consumers feel
the premium spent on cyber insurance policies
as a wasteful expenditure until they once claim
the benefits of the same. While every endeavor
may be made to secure one’s data by deploying
appropriate cyber security solutions, the benefit
of an insurance policy that provides coverage for
financial liabilities arising from cyber incidents
also may be simultaneously ensured for a healthy
and peaceful business atmosphere.
Contact for more details
C.J. Antony
Deputy Director General & SIO
NIC Tamil Nadu State Centre
E-2-A, Rajaji Bhavan, Besant Nagar, Chennai - 600090
Email: antony@nic.in, Phone: 044-2490 8001
January 2024 informatics.nic.in 39