Where does the liability lie?

Security professionals often say: "Either you have been breached or you just do not know that you have been breached." There is nothing clear-cut about long-tail cyber risks and hackers prefer it that way. They want to access networks, cause damage and then exit while covering their tracks.

Everybody has heard of Stuxnet now, but for years engineers just thought the centrifuges were being set to the wrong frequency by human error. The virus also included a rootkit component designed to hide all the malicious files and processes. In other words, we weren’t supposed to find out about Stuxnet.

Accumulated risks and the Internet of Things are increasing the scale of potential liability and helping to obscure where a liability event actually started. Furthermore, as hackers grow more sophisticated and the cyber jungle becomes denser, there will be more opportunities to remain hidden. Extensive interconnected networks could harbour a host of dormant threats. So how do you assign liability?

Defining the root cause of a cyber loss is fundamental to cyber liability insurance. Data forensics firms can be hired to do that and normally they succeed. However, it isn't always easy. Hackers are always changing their methods. They may also leave a false trail so that liability is initially assigned to one event and then turns out to have started somewhere else.

Assigning liability may already be beyond the capabilities of many small and medium-sized companies. It is an area where industry needs to cooperate with the insurance sector to ensure it stays on top of the situation.

How strong is your company's IT department in data forensics? If it is not one of your strengths, you should consider engaging an external provider.

A data breach doesn't mean game over. After a cyber-attack we get you back in business.

Learn more about our Cyber insurance solutions.