You are at your desk sipping a hot cup of coffee, ready to tackle the day ahead. As the caffeine starts working, so do you. Checking emails, you open one from a familiar sender and the email prompts you to click on a link. The link you clicked on leads nowhere. You think nothing of it, delete the email, and move on.
The ransom demand soon arrives via email: “Pay $50,000 within 48 hours. Failure to do so will result in the removal of your company's data and network.” When you clicked on that link, you unwittingly launched a cyberattack.
“You have been hacked!”
These types of cyberattacks happen more often than we care to admit. In its “2017 Internet Security Threat Report,” Symantec estimated that one in 131 emails contained malware—the highest level in five years. That's just one of the ways hackers can compromise your network. A careless or disgruntled employee might give out a password and user ID to a cybercriminal, or stolen smartphone or tablet might allow someone to drill into your system and steal your trade secrets, customer files, customer credit card numbers or other priceless data.
The financial ramifications of a cyberattack are staggering and the damage to a company's reputation may be irreparable. Consequently, these companies look to their insurers to help alleviate the financial damage caused by cyberattacks.
Nothing can be more financially devastating to a business owner than to discover insufficient insurance coverage for a cyberattack. Just as problematic is the ever-changing legal landscape regarding cybersecurity claims.
When hackers gained unauthorized access to Sony's PlayStation Network in 2011, stealing personal information of approximately 77 million customers, the global company came under legal assault from angry customers and aggressive lawyers alike. But when Sony looked to its commercial general liability policy to pay for those claims, Zurich Insurance Group refused to do so. Sony then sued Zurich to provide insurance coverage to its customers, eventually reaching a settlement in 2015.
As cyberthreats have become an everyday occurrence, it is vital for small and midsize businesses, as well as large enterprises, to mitigate their financial risks through insurance. Unfortunately, there are few standard policies in use today for cyberliability coverage.
The lack of standardization makes it difficult for companies to compare insurance products or understand their coverage provisions, which is why a trusted legal adviser should be consulted at the time of purchase. Here are some of the key questions to consider:
• Are there any cybercoverage provisions in my current general liability policy?
• Where is my greatest exposure to financial loss (customer records, intellectual property, etc.)
• What is the premium cost of cyberinsurance to protect against those risks?
• What is covered and what is excluded in a cyberinsurance policy?
• Does the policy cover damages related to a derivative legal action, such as a shareholders' suit?
• Is there any coverage for cyberterrorism?
• Will the policy pay the legal fees entailed in defending against a plaintiff's suit?
• What is the reputation and record of the insurance carrier in paying cyber-related claims?
• What should I do before an attack to document the value of my data and integrity of my network?
• What actions must I take immediately after a cyberattack in order to preserve the evidence of an attack and establish grounds for a claim?
• What information and documents are necessary for filing a claim?
• Can I file a claim if my confidential data is stolen from a cloud or managed service provider?
• If service providers are involved, are they (and their carriers) responsible for defending against a suit?
Because of these complex issues, business owners should take the time to weigh their options and consult with their operational, technical and legal advisers before rushing out to purchase (or renew) a cyberinsurance policy.
MITIGATE YOUR RISKS
There are other steps that businesses should take to reduce the risk of a cyberattack, beginning with network firewalls and intruder detection software. A strong user password and authentication protocol is also essential, as well as limiting employee access to the company's most sensitive information. Education and training programs should include cyber safety tips, like avoiding logging in through an unknown wireless network or inserting a stranger's thumb drive into a company laptop.
These types of security policies and procedures have two important benefits: lowering the risk of a cyberattack, and establishing a solid foundation for an insurance claim in the event of an attack. Because cyberthreats will continue to evolve as criminals become more sophisticated, security professionals will never be able to provide 100 percent protection. Therefore, businesses will increasingly need to incorporate cyberinsurance into their risk mitigation programs.
Hugo Alvarez is a partner with Alvarez Barbara in Miami.
Originally published on dailybusinessreview.com. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.