Chubb Insurance Executive Urges Cooperation Between Corporate IT and Risk Management Departments.

Business Editors & Technology Writers

WARREN, N.J.--(BUSINESS WIRE)--July 31, 2002

Says Information Sharing is Essential to Insurers Providing Real Cyber

Security Solutions

An executive with a leading commercial insurer is urging information technology departments to share information regarding attacks on corporate Web sites and computer networks with risk managers and insurers.

Without knowing the full extent and nature of these attacks, he said the insurance industry would not be able to develop products that are essential to helping protect businesses from the potentially significant operational and financial consequences of a wide-scale or targeted cyber attack.

"Many of you probably have not met your company's risk manager. Not only can he or she help prevent IT-related losses throughout the enterprise, he or she also is your company's direct link to the insurance industry. Your job and your company's well-being may depend on whether the industry can provide the financial backstop should state-of-the-art information security products fail to defend the enterprise against a cyber attack," said Alan Driscoll, senior vice president of Chubb & Son. Driscoll heads the risk management group in Chubb Commercial Insurance.

He warned that IT security tools aren't a full-proof way of keeping hackers away from corporate and government Web sites and networks. He noted that a story in a recent issue of BusinessWeek, "Cybersecurity's Leaky Dikes," concludes that "Increasingly, high-level assailants are finding ways to camouflage their cyberattacks" and breach conventional security. One chief technology officer told the magazine, "The systems we are trying to protect are becoming so complex that we're all losing ground." As a result, the number of security incidents appears to have doubled in the past year alone, according to the article.

"Insurance offers businesses an effective way to fill the risk gap that exists between the latest and greatest tech security tools and the smartest and most devious tech intruders," Driscoll warned. Yet, he said the development of cyber insurance products has been slow thus far due to the lack of cyber loss data. Unable to model cyber loss potential, insurers are unable to underwrite or price appropriate insurance products. Nor can reinsurers provide the capacity necessary to enable insurers to take on substantial amounts of cyber exposures.

Only a relatively small number of insurers have put cyber products on the marketplace, and most do not address adequately - if at all - the severest cyber perils, Driscoll said. "Chubb is one of the few companies actually providing financial protection against cyber-related business interruption losses, extortion and thefts. And even in Chubb's case, we typically are not providing that solution to all our commercial customers, but mainly to our financial institutional customers, because they represent a very distinct group with substantial e-commerce experience and regulation," he said.

"I'm sorry, but the marketing-related exposures of running a Web site, such as intellectual property infringements and libel and slander, in many cases, don't compare to a thief or terrorist shutting down all or part of your business by invading your cyberspace," he explained.

Some insurers' marketing efforts and inaccurate news reports have exacerbated the problem. "The other day I read a news wire story about an insurance product that enables companies to help protect their customers from the costs of identify theft. That was wrong: It protects companies when customers sue them for loss of their identity due to a Web-site break-in," said Driscoll. "The marketing campaigns, and in some cases, the accuracy of the reporting are unfortunately obscuring the real issues here."

Driscoll said the industry needs more information about the risks to be able to develop the actuarial tables to price products that would provide substantial cyber risk protection. By passing along security-related information to risk managers, IT managers can help speed up insurers' product development efforts.

Insurers, including Chubb, have been working with federal officials to encourage cyber threat and incident information sharing among businesses through industry groups and between businesses and the government. Anti-trust laws, privacy concerns and fear of reputational damage if the information were leaked publicly have hampered such efforts.

Whether or not safe harbors in legislation now under consideration are enacted into law, businesses could share vital exposure information with their insurers, which are typically privy to confidential information on their customers and act as the repository for loss information.

The member insurers of the Chubb Group of Insurance Companies form a multi-billion dollar organization providing property and casualty insurance for personal and commercial customers worldwide through 5,000 independent agents and brokers. Chubb's global network includes branches and affiliates throughout North America, Europe, Latin America, Asia and Australia.