Companies must wake up to the dangers of cyber crime
Companies are coming under increasingly serious attack from cyber criminals. Few have the systems to cope with it, says Merryn Somerset Webb, and recovering losses through insurance could prove difficult.
Back in 1979, the economist Mark Skousen published a book on maintaining the security of financial data. He was worried about relentless information collection he reckoned that 50 files of various sorts were being kept on each American. The inherent risks seemed pretty obvious to him.
In his section on companies, he added something pretty prescient: businesses should not stop at maintaining burglar alarms, employing night-watchmen and watching for "new employees working as spies for the competition", they should also be aware that much of their valuable information was now stored on computers.
It would "pay to ask your computer company specifically about unwarranted intrusion into sensitive information", he says. Forty years on, he has been proved very right.
Subscribe to MoneyWeek
Subscribe to MoneyWeek today and get your first six magazine issues absolutely FREE
Sign up to Money Morning
Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter
Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter
We are in a world with an endlessly rising number of interconnected devices (and a lot more than 50 files on each person). There is no company or product that doesn't have cyber risk attached to it. So much so that if you ask a corporate chieftain about the biggest threat to his business, they probably shouldn't say Brexit or global growth, they should say cyber risk. The growing list of governments refusing to do business with Huawei bear witness to its relevance and danger.
Political and economic risk are slow moving enough that a quality company can cope, but a cyber problem can leave you helpless instantly: shipping group Maersk's systems were shut down for a full ten days following the 2017 NotPetya malware attack, at a total cost of about $300m. A company also risks the loss of commercially sensitive data, becoming the victim of cyber extortion, and huge fines for personal data breaches, to say nothing of the legal costs and brand damage.
This is not news to company boards: a survey by insurance consultancy Mactavish found 43% of UK respondents reporting that their company had suffered at least one cyber attack in the prior two years.
The insurance industry isn't set up to cope
But the odd thing is that, while most companies have cyber security on their minds, not very many are specifically insuring themselves against a systems breach. The market is growing fast: up 100% in the past year, according to the Association of British Insurers. Even so, a mere 9% of UK companies (rising to 25% in the financial sector) have specific cyber insurance.
In the US, the number is only slightly higher but is still low Dan Truman of speciality insurance firm Axis Capital puts it at about 30%, thanks in part to many states' early adoption of strict rules on reporting data breaches. Maersk did not have standalone cyber insurance one imagines this has now been rectified.
So why the foot-dragging? In the Mactavish survey, 37% say the risk isn't "serious enough"; 30% say the insurance is too expensive; some 35% argue it is "unfit for purpose"; and 22% "do not trust the insurer to pay out". The first two are silly; the second two have some merit. The utility of cyber insurance should improve as data improves and the industry gains a better understanding of the risk; the payout problem might not.
Parts of cyber risk are easily insurable, says the Association of British Insurers' Joseph Ahern. These include hackers, low level ransom attempts and data-collecting malware. Other bits are not. There is a legal battle under way between confectionery firm Mondelez and insurer Zurich, which is refusing to pay on the NotPetya attack, arguing that the damage came from a "hostile or warlike action".
The insurance industry works on the basis that bad things happen to a few people at a time. When really bad stuff happens to a large number of people at once, it struggles. The industry either goes bust or gets out of the market. Then, the government has to step in.
During and after the Second World War, the UK War Damage Commission stepped in to pay for damage to buildings and land. In the wake of the 1993 Irish republican bombing of the Baltic Exchange, the UK government created pool reinsurance to underwrite terrorist damage. The US set up the Terrorism Risk Insurance Program after the September 2011 attacks. More recently, the UK created Flood Re for homes in flood-prone areas.
Dan Hyde, author of Cyber Security: Law and Practice, doesn't expect Zurich to win the Mondelez case proving the incident was warlike will be extremely tricky. But the questions won't go away.
If North Korea and Russia are sponsoring cyber attacks across the West as a type of unprovable warfare, and if this represents a long-term persistent threat in a world where many companies share a digital architecture, that might make much of cyber risk uninsurable. You can see why the insurance industry wants to test who pays. And you can see why governments might not (after the 2008 financial crisis, they are not keen on providing backstops to the financial industry).
This fight is going to run. In the meantime, companies must look for standalone cyber coverage they really understand: Mondelez was claiming on its general insurance. A night-watchman is never going to be enough again.
This article was first published in the Financial Times
Sign up to Money Morning
Our team, led by award winning editors, is dedicated to delivering you the top news, analysis, and guides to help you manage your money, grow your investments and build wealth.
Merryn Somerset Webb started her career in Tokyo at public broadcaster NHK before becoming a Japanese equity broker at what was then Warburgs. She went on to work at SBC and UBS without moving from her desk in Kamiyacho (it was the age of mergers).
After five years in Japan she returned to work in the UK at Paribas. This soon became BNP Paribas. Again, no desk move was required. On leaving the City, Merryn helped The Week magazine with its City pages before becoming the launch editor of MoneyWeek in 2000 and taking on columns first in the Sunday Times and then in 2009 in the Financial Times
Twenty years on, MoneyWeek is the best-selling financial magazine in the UK. Merryn was its Editor in Chief until 2022. She is now a senior columnist at Bloomberg and host of the Merryn Talks Money podcast - but still writes for Moneyweek monthly.
Merryn is also is a non executive director of two investment trusts – BlackRock Throgmorton, and the Murray Income Investment Trust.
-
Do you qualify for the Winter Fuel Payment if you live abroad?
The Winter Fuel Payment will be means tested for expats living in Europe, in line with the new rules impacting those in the UK. But a quirk in the system means not all countries are eligible.
By Katie Williams Published
-
What the Employment Rights Bill means for your job
New workplace reforms are set to give employees new rights to benefits and flexible working
By Marc Shoffman Published
-
How to fight cyber-crime in your small business
Advice There are five key areas for owners of small businesses to focus on when fending off digital attacks.
By David Prosser Published
-
Why our rickety internet infrastructure needs an upgrade
Briefings The internet is an increasingly essential part of international infrastructure. Recent events have shown that it is also vulnerable to collapse.
By Simon Wilson Last updated
-
The WannaCry virus is huge news for cybersecurity stocks – and bitcoin
Features The WannaCry ransomware attack is a wake-up call. It has huge implications for cybersecurity – and for bitcoin. John Stepek explains why, and how to profit from improving computer security.
By John Stepek Published