Trend turns, more purchase coverage for cyber crime.

Cyber crimes are on the rise-both in frequency and sophistication, according to a recent white paper, entitled "Cyber Risk and Insurance for Financial Institutions--A Reality Check" by global insurance broker Willis Group Holdings Ltd.

Cyber risk experts from Willis analyzed results of two recent industry surveys of financial institutions and other large organizations and put them in a broader context for technological, business practice and insurance industry trends. The surveys provide information, the paper said, that can assist risk managers in gaining insight into a number of fundamental questions about exposure that might aid in evaluating the option of cyber risk insurance. The two studies are the 2004 Global Security Survey by Deloitte Touche Tohmatsu and 2004 E-CrimeWatch Survey by Carnegie Mellon Software Engineering Institute/CERT Coordination Center, CSO Magazine and the U.S. Secret Service.

According to the research, respondents said they are confident that their protection, both in terms of cyber security and insurance, is adequate to the rising risk. However, many cyber exposures, especially those on the rise, aren't covered by traditional policies. And while many companies haven't in the past purchased cyber insurance products, the trend is beginning to turn.

Financial institutions generally have insurance protection against direct financial fraud by use of computers as well as some protection against viruses and hacker damage related to attempts at direct financial fraud, through they may be limited, according to the white paper. In addition, many have coverage for negligence in providing covered banking services and related services. However, most traditional insurance programs don't cover several types of risk, such as liability for theft of private or confidential information, which includes identity theft; business interruption income loss or extra expense due to hacker or virus attacks that disrupt operations (including intrusion by insiders and denial of service attacks); liability for attacks against third parties using the financial institution's information network; and theft of passwords by nonelectronic means.

U.S. respondents said in the Deloitte survey that even with the growing threat of cyber crimes, they were willing to take higher risks and lead in the adoption of new technologies.

Some other findings highlighted in the white paper include:

* A majority of Deloitte respondents (83%) reported that their systems had been breached, up from 39% in the prior year. A substantial cause of the increase was fast moving worms.

* E-Crime respondents reported a 43% increase in the number of electronic crimes and intrusions involving networks, systems or data in 2003 vs. 2002. The greatest cyber security threat in 2003, according to the survey, was hackers, with 40%; current employees, with 22%; and former employees, at 6%.

* Slightly more than 90% of organizations surveyed by Deloitte said they have IT disaster recovery or business continuity plans in place, while only 54% were very confident that their backups worked or met policy requirements for off-site storage.

* Cyber risk policies are increasingly becoming an answer to the problem for a number of financial institutes. Twenty-four percent of respondents to Deloitte's 2003 survey said they have such insurance, and 5% plan on purchasing such coverage.