Designing Risk Transfer Instruments for Internet Risk

InternetPerils, Inc., Mason & Mason, AIG

3:25 PM Thursday 17 Feb 2005 San Francisco

Outline

What's missing from Internet risk management

How to make it as easy and conventional as fire or flood

Perspectives:

Broker: Steve Schoenberger, Mason & Mason

Insurer: Bob Parisi, AIG eBusiness Risk

Client: John S. Quarterman, InternetPerils

What's Missing

Any technical solution can fail (and many have recently)

Need strategies to manage problems IT can't fix

Financial risk transfer instruments

tried-and-true in other industries

import them to the Internet

Insurance policies and beyond

Slow Outside the Firewall

Nonredundant

Making it Easy and Conventional

Assessments: Internet security solutions as sprinkler systems

Adjustments: Internet forensics

Financial capacity: catastrophe bonds

Beyond outages: performance bonds

Broker Perspective:
Steve Schoenberger, Mason & Mason

The perils

Brief history of CyberInsurance

Beyond traditional insurance coverage

Broker Perspective: the Perils
Fire, flood and earthquake
vs. virus, hack, and external connectivity

What are the “insurable” cyber risks?

First party loss

Lost, damaged, or corrupted data

Loss of income

Extra operating expense

Extortion

Third party loss

Content Injury

Failure to deliver services

Other network liabilities: spread of virus, host DDS, HIPAA, GLBA, Sarbanes-Oxley

Broker Perspective:
The (brief) History of CyberInsurance

Coverage litigation

Coverage exclusions

New product creation

Insurance companies providing the coverage

Market acceptance slow but increasing: why?

Insurance market conditions

Distribution of product

Organizational silos

Non-Publicised loss

New & Non-standard policy language

Broker Perspective:
Don't count on your traditional coverage
for network risk!

Traditional Property Insurance Policy

Traditional Crime Policy

Traditional General Liability Policy

Traditional Errors and Omissions or Professional Liability Policy

Insurer's Perspective:
Bob Parisi, AIG eBusiness Risk Solutions

The Basics of Coverage

The Basics of “Cyber” Insurance

Underwriting Process

Insurer's Perspective:
The Basics of Coverage

History of insurance from carrier's perspective

Gaps in traditional coverage

CGL

Property

Crime/Fidelity

E&O

Recent case law and relevant developments

Insurer's Perspective:
The Basics of “Cyber” Insurance

What it covers

What it doesn't cover

Claims

Insurer's Perspective:
Underwriting Process

Application

Assessment

Client Perspective:
John S. Quarterman, CEO, InternetPerils, Inc.

The risk: bigger than a hurricane

Internal buyers: CIO, CFO, CEO

Quantification

Security

Collective action

Client Perspective:
The Risk

``We speculate that a plausible worst-case worm could cause $50 billion in direct economic damage” (in the U.S.)

Nicholas Weaver, Vern Paxson, in a peer-reviewed paper

> Hurricanes Andrew + Charley + Ivan + Frances + Jeanne

``$100 billion global cyber catastrophe risk event for their worldwide operations that could cause masstive business interruptions for days''

chief executives and board-level decision makers within S&P 500 and FTSE-100 component companies

according to mi2g

Client Perspective:
Internal Buyers

IT (CIO, VP Eng., CTO) wants to fix it, but sometimes can't

no existing patches

outside firewall: local ISP, customers' ISPs

counterparty risk in ISPs between company and remote offices, sales, vendors, outsourcers

CFO may recognize risk, but what's the probability of losing money?

A service company going offline produces non-obvious income loss.

a few seconds too slow and customers give up for today

a few days too long and customers go to another vendor

Why did we spend all this IT money and it still fails?

Client Perspective:
Coordinating Issues

CEO needs to coordinate business and technical perspectives

and get outside help; some things are not core competence

self-insurance is a possibility, but buying insurance is often better

external validation

Quantification

for policies

for quality of services

Security

moral hazard, vs. insurance beneficially increasing security

adverse selection, or does quality determine price?

Client Perspective:
Collective Action for Aggregate Damage

Aggregate damage

Caused by force majeure events beyond the control of any one enterprise

Affecting multiple enterprises

Collective action

Quantify perils and anomalies

Leverage technology with non-technical risk instruments

2005-01-06T08:34:35