The murky waters of cyber warfare and insurance coverage

Issue 3 2022 Security Services & Risk Management

South Africa has seen a dramatic rise in cyberattacks and successful breaches during the past two years, as well as an accompanying surge in ransom demands.

In the most recent high-profile attack, credit reporting agency TransUnion South Africa revealed that at least three million South Africans have been impacted by a data hack, after the agency was compromised by hacker group N4aughtysecTU.

The proliferation of these types of attacks demonstrate how vulnerable organisations can be to cyberattacks and are forcing organisations to increasingly rely on their cyber insurance policies. At the same time, many insurers are looking to remain viable amid a changing cyber insurance landscape to try to manage their own exposure.

Ryan van de Coolwijk, product head at iTOO’s Cyber Insurance division, says that as cyber insurers are trying to manage their coverage of these incidents, companies must revisit their cyber insurance policies and rethink how they respond to incidents.

Unique cover

In South Africa, state-owned Sasria is the only non-life insurer that provides special risk cover to government entities as well as to all individuals and businesses that own assets in South Africa, as well as government entities. This is unique cover against risks such as civil commotion, public disorder, strikes, riots and terrorism.

However, says Van De Coolwijk, Sasria’s cover only extends to physical incidents of unrest, riots and terrorism, thus excluding any cyberattack that may be classified as cyber terrorism or cyber warfare. “Essentially, this means that any organisation that comes under attack from state-sponsored cybercriminals, in an incident that can be classified as cyber warfare, could find itself without any cover at the present moment.

“These exclusions mean that there is a gap in current cyber insurance coverage, meaning that organisations should bulk up their cybersecurity practices and systems to mitigate their exposure to threats posed by bad actors.”

Cyber warfare is commonly defined as a cyberattack or series of attacks that target a country and has the potential to wreak havoc on government and civilian infrastructure and disrupt critical systems, resulting in damage to the state and even loss of life.

Yet, Van De Coolwijk points out, this is a complex issue, as debate continues among cybersecurity experts as to what kind of activity constitutes cyber warfare. The US Department of Defence recognises the threat to national security posed by the malicious use of the internet but does not provide a clear definition of cyber warfare. Others consider cyber warfare to be a cyberattack that can result in death.

No quick fix

“So, the question of what constitutes cyber warfare revolves around a wide spectrum of philosophical, semantic and legal questions, most of which are not likely to be resolved in the near future. Yet, the implications are more practical and immediate. Whether or not an attack that affects the private sector can be classified as cyber war can have a substantial effect on whether the incident is covered by a cyber insurance policy.”

Van De Coolwijk notes that while there are several examples of alleged cyber warfare in recent history – involving a nation-state perpetrating cyberattacks on another – there is still no universal and formal definition for how a cyberattack may constitute an act of war. This is however changing quickly following the outbreak of war in the Ukraine, with standard definitions and exclusions being developed and rolled out.

In recent months though, insurers have tried to reject cyber insurance claims on the grounds that they constitute cyber warfare, but with mixed success. These attempts at exclusion show that cyber insurers are trying to limit their coverage of these incidents.

In light of this evolving landscape, Van De Coolwijk suggests that companies need to ensure that they are aware of changes in the marketplace of cyber insurance coverage by reviewing their existing policy to see what language is included in the war exceptions. Additionally, organisations must check to see whether their insurer has issued any guidance around these exclusions, and they need to also clearly understand any changes to policy terms during ongoing or upcoming negotiations.

“Until such time as there is some universal agreement on what constitutes cyber war, I suggest policyholders check with the brokers and their policy wording to have a clear view on their possible exposure,” says Van De Coolwijk.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Employee screening trends
iFacts Security Services & Risk Management
Criminal record checks still the most popular background check conducted around the world, but global employee screening trends are changing according to iFacts.

South African business readies for a journey to the cloud
Security Services & Risk Management
There is an increasing demand for cloud services in the country, driven by the need to use advanced technologies such as AI while also providing hybrid workers access to data, regardless of their location.

What to do in the face of growing ransomware attacks
Technews Publishing Cyber Security Security Services & Risk Management
Ransomware attacks are proliferating, with attackers becoming more sophisticated and aggressive, and often hitting the same victims more than once, in more than one way.

South Africa can accelerate its move to smart cities
Security Services & Risk Management
What global smart city leaders have in common is that they have built on, and developed existing infrastructure, transforming it iteratively; South Africa is well positioned to adopt this approach.

Where does SA logistics stand as far as cybersecurity is concerned?
Logistics (Industry) Security Services & Risk Management
Lesiba Sebola, director of information technology at Bidvest International Logistics, says it is paramount to safeguard IT infrastructure given how central it has become to operations.

The Deposita Protector 3000 d-s1
Deposita Security Services & Risk Management
The Protector 3000 d-s1, designed for medium-sized enterprises, improves the level of security at the business and helps optimise resources by streamlining cash-handling processes.

Top fraud trends to watch in 2023
News Security Services & Risk Management
Even though financial concerns remain a significant obstacle for companies in implementing new anti-fraud technologies, 60% of businesses expect an increase in their anti-fraud technology budgets in the next two years.

Be cautious when receiving deliveries at home
News Perimeter Security, Alarms & Intruder Detection Security Services & Risk Management
Community reports of residents being held up at their gate when collecting fast food deliveries at home are once again surfacing.

Sasol ensures Zero Trust for SAP financials with bioLock
Technews Publishing Editor's Choice Cyber Security Security Services & Risk Management
Multi-factor authentication, including biometrics, for SAP Financials from realtime North America prevents financial compliance avoidance for Sasol.

Protecting yourself from DDoS attacks
Cyber Security Security Services & Risk Management
A DDoS attack, when an attacker floods a server or network with Internet traffic to prevent users from accessing connected online services, can be costly in both earnings and reputation.