A new study from Chubb found that when it comes to cybersecurity, Americans are concerned, but not necessarily prepared to take the appropriate – and necessary – preventative steps to protect themselves from a cyber attack.
According to Chubb's third annual cyber report, which examined individuals' comprehension of cyber risks and the steps they are taking to protect themselves, complacency seems to have taken hold: eight-in-10 Americans said that they continue to be concerned about a cyber breach, yet only 41 percent said that they use cybersecurity software and 31 percent regularly change their passwords. These numbers are virtually unchanged from 2018.
"When it comes to your cybersecurity, there's no such thing as being over prepared," said Fran O'Brien, division president of Chubb North America Personal Risk Services. "While it's important that the vast majority of respondents remain concerned about a breach, concern itself isn't enough. Individuals often say their lack of cybersecurity action is because it seems too time consuming in the moment. But implementing cyber safeguards today will save time and financial resources tomorrow, should a breach occur."
According to the study, individuals do not recognize the value of individual pieces of personal data. For example, just 18 percent of respondents said that they are concerned about their email addresses being compromised. But, coupled with the fact that less than one-third of respondents regularly change online passwords – consistent with 2018's findings – a single email address can be a gold mine for hackers.
Similarly, a mere 27 percent of respondents said that they are concerned about their medical records being breached. However, for all commercial claims submitted to Chubb by its healthcare policyholders, 54 percent of cyber claims were the results of an external actor, a significant increase from all prior years. If individuals knew that a compromised medical record often gives enough information to completely steal one's identity, they likely would be more concerned, Chubb said.
Survey results indicated that when it comes to cybersecurity, a consistently large portion of older respondents employ better cyber practices than younger generations. Per the survey, 77 percent of those over 55 delete suspicious emails, compared to half (55 percent) of respondents between 35 to 54 and just a third (36 percent) of respondents from 18 to 34. Similar patterns arise when looking at those enrolled in cybersecurity monitoring services.
More concerning, according to Chubb, is that younger generations do not just continue to shun the cyber lessons of older generations, their behavior is actively getting worse. For example, 76 percent and 74 percent of adults over 55 regularly deleted suspicious emails in 2017 and 2018, respectively, as compared to just 47 percent and 40 percent of adults between 18 and 34 during the same time period. Learning from past events and generations before us is critical to prevent repeating the same cyber missteps.
Chubb also found that businesses are not immune to the lack of progress around cybersecurity.
For instance, while a consistent number of individuals (75 percent and 70 percent) said that their company has "excellent" or "good" cybersecurity practices in place from 2018 and 2019, many companies continue to fail to implement the most basics of safeguards. From 2018 to 2019, there was virtually no change in the percentage of companies who hold annual employee trainings (31 percent and 33 percent), deploy filters for online content (38 percent and 40 percent) and leverage social media blocks (32 percent and 33 percent). With the number of commercial cyber incidents only rising, employers must course correct in order to protect them for the long term, in Chubb's view.
Chubb said that the continued failure to implement cybersecurity safeguards means a breach is inevitable. Yet, just 10 percent of respondents reported having a cyber insurance policy in place.
Learn more: chubb.com.
Victoria Spears
Victoria Prussen Spears is senior vice president of Meyerowitz Communications Inc., a law firm marketing communications consulting company. A graduate of Sarah Lawrence College and Brooklyn Law School, Ms. Spears was an attorney at a leading New York City law firm before joining Meyerowitz Communications. She may be contacted at [email protected].