The murky waters of cyber warfare and insurance coverage

Issue 3 2022 Security Services & Risk Management

South Africa has seen a dramatic rise in cyberattacks and successful breaches during the past two years, as well as an accompanying surge in ransom demands.

In the most recent high-profile attack, credit reporting agency TransUnion South Africa revealed that at least three million South Africans have been impacted by a data hack, after the agency was compromised by hacker group N4aughtysecTU.

The proliferation of these types of attacks demonstrate how vulnerable organisations can be to cyberattacks and are forcing organisations to increasingly rely on their cyber insurance policies. At the same time, many insurers are looking to remain viable amid a changing cyber insurance landscape to try to manage their own exposure.

Ryan van de Coolwijk, product head at iTOO’s Cyber Insurance division, says that as cyber insurers are trying to manage their coverage of these incidents, companies must revisit their cyber insurance policies and rethink how they respond to incidents.

Unique cover

In South Africa, state-owned Sasria is the only non-life insurer that provides special risk cover to government entities as well as to all individuals and businesses that own assets in South Africa, as well as government entities. This is unique cover against risks such as civil commotion, public disorder, strikes, riots and terrorism.

However, says Van De Coolwijk, Sasria’s cover only extends to physical incidents of unrest, riots and terrorism, thus excluding any cyberattack that may be classified as cyber terrorism or cyber warfare. “Essentially, this means that any organisation that comes under attack from state-sponsored cybercriminals, in an incident that can be classified as cyber warfare, could find itself without any cover at the present moment.

“These exclusions mean that there is a gap in current cyber insurance coverage, meaning that organisations should bulk up their cybersecurity practices and systems to mitigate their exposure to threats posed by bad actors.”

Cyber warfare is commonly defined as a cyberattack or series of attacks that target a country and has the potential to wreak havoc on government and civilian infrastructure and disrupt critical systems, resulting in damage to the state and even loss of life.

Yet, Van De Coolwijk points out, this is a complex issue, as debate continues among cybersecurity experts as to what kind of activity constitutes cyber warfare. The US Department of Defence recognises the threat to national security posed by the malicious use of the internet but does not provide a clear definition of cyber warfare. Others consider cyber warfare to be a cyberattack that can result in death.

No quick fix

“So, the question of what constitutes cyber warfare revolves around a wide spectrum of philosophical, semantic and legal questions, most of which are not likely to be resolved in the near future. Yet, the implications are more practical and immediate. Whether or not an attack that affects the private sector can be classified as cyber war can have a substantial effect on whether the incident is covered by a cyber insurance policy.”

Van De Coolwijk notes that while there are several examples of alleged cyber warfare in recent history – involving a nation-state perpetrating cyberattacks on another – there is still no universal and formal definition for how a cyberattack may constitute an act of war. This is however changing quickly following the outbreak of war in the Ukraine, with standard definitions and exclusions being developed and rolled out.

In recent months though, insurers have tried to reject cyber insurance claims on the grounds that they constitute cyber warfare, but with mixed success. These attempts at exclusion show that cyber insurers are trying to limit their coverage of these incidents.

In light of this evolving landscape, Van De Coolwijk suggests that companies need to ensure that they are aware of changes in the marketplace of cyber insurance coverage by reviewing their existing policy to see what language is included in the war exceptions. Additionally, organisations must check to see whether their insurer has issued any guidance around these exclusions, and they need to also clearly understand any changes to policy terms during ongoing or upcoming negotiations.

“Until such time as there is some universal agreement on what constitutes cyber war, I suggest policyholders check with the brokers and their policy wording to have a clear view on their possible exposure,” says Van De Coolwijk.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

IoT provides assurance in ESG initiatives
Security Services & Risk Management
Environmental, social and governance (ESG) metrics can be used effectively to measure and define the impact an organisation has, the trust it engenders, and the value it takes beyond the shareholder and into the ecosystem.

The benefits of investing in whole-house surge protection
Smart Home Automation Security Services & Risk Management Residential Estate (Industry)
When you consider that the potential for equipment damage can run well into the hundreds of thousands of rands, whole-house surge protection is a worthwhile expense.

Are you your insider threat?
Technews Publishing Editor's Choice Security Services & Risk Management Commercial (Industry)
Insider threats are a critical aspect of risk management today, but what happens when it is the owner of the company acting fraudulently and making sure none of his staff can catch him?

Minimise the cost and impact of protest activity
Thorburn Security Solutions Security Services & Risk Management Industrial (Industry)
Strikes and protest actions are common in South Africa and businesses need to prepare for the worst while working for the best outcome that benefits all parties.

How to make data governance practical
Security Services & Risk Management Commercial (Industry)
For many businesses, data governance is not well received because governance programmes are often driven by supporting functions like compliance or IT, with a focus on the needs of these functions.

Passion, drive and hard work
Technews Publishing Editor's Choice CCTV, Surveillance & Remote Monitoring Security Services & Risk Management
Colleen Glaeser is a leader in the security market, having made her mark in the male-dominated security industry through determination and hard work, along with a vision of making the world a safer place.

How to react in an armed robbery or home invasion
Fidelity Services Group Security Services & Risk Management News
How you react when faced with a nervous, gun-toting criminal can save your life, or cost you your life; all family members need to know what to do in such circumstances.

Manage reckless driving while speed cameras are offline
Transport (Industry) Security Services & Risk Management
Motorists in Johannesburg have not been fined for infringing the law for almost a year, because the city hasn’t had any functioning speed cameras since May 2021.

Privacy and human rights in an AI world
Security Services & Risk Management
To find out where we stand on data privacy, Cisco conducted its 2022 Data Privacy Benchmark Study, based on an anonymous survey of 4900 security and IT professionals from 27 geographies.

Understanding the benefits of connectivity management
IT infrastructure Security Services & Risk Management
As companies embrace digital, more of their services require connectivity to keep the business running; effectively managing the increasing complexity of this environment becomes a critical enabler for success.