Cyber market exposed to home working amid Covid-19

March 27 2020 by Nick Ferguson

Cyber exposures are on the rise as the coronavirus pandemic confines millions of people to working from home and cyber criminals exploit peoples’ fears.

It is not new for hackers to take advantage of major events to spread malware, but Covid-19 is unprecedented in its scale, with cases now reported in 198 countries. At the same time, the extraordinary increase in remote working is making it more challenging for companies to secure their networks.

“We are helping [our clients] identify blind spots, review their coverage and increase their level of protection.” Jack Howell, Zurich

And it certainly doesn’t help that this is happening at the same time as many companies are facing multiple other challenges to their businesses, but brokers and insurers say they are responding.

“As a result of Covid-19, cyberattacks have gone up at our corporate customers and we are helping them identify blind spots, review their coverage and increase their level of protection,” comments Jack Howell, chief executive for Asia Pacific at Zurich.

Working from home has become so widespread that some online retailers are reporting shortages of headsets and webcams. Even Lloyd’s has closed its historic underwriting room in London, though chairman Bruce Carnegie-Brown has said that the market’s digital systems are holding up.

An important question for many companies is how their coverage may be affected by so much remote working, but brokers say this should not generally be a concern.

“Cover doesn’t change for most policies,” says Rory Young, a cyber and technology broker at Lockton in Hong Kong. “A good cyber insurance policy should recognise remote working, laptops, VPNs, etc as part of the wider network. If they don’t, it’s not a good policy.”

Cybersecurity specialists have noted a variety of malicious coronavirus-related campaigns since the start of the outbreak.

Of course, prevention is the first line of defence, but the speed with which companies have had to move staff out of their offices is undoubtedly creating vulnerabilities. Indeed, poorly secured remote desktop services are one of the most common ways for hackers to attack corporate networks — and the mass deployment of workers to couches, dining tables and breakfast bars is a recipe for security holes.

“The coronavirus has forced many more employees to work from home and in this pressured environment it is very important that companies take the right steps to reduce the vulnerability of their IT infrastructure,” said Katherine Keefe, Beazley’s global head of breach response, in a briefing note. “Although these attacks can be damaging and complex, some of the most effective preventative measures are relatively simple. More than ever, organisations need to ensure their IT security measures are a top priority.”

Even so, it is easy to understand why executives might dismiss cyber exposures as less important than the potential collapse of their business — not to mention the difficulty of simultaneously training an entire workforce to use a virtual private network with multifactor authentication. Easier said than done for companies that do not normally make a habit of remote working.

While prioritising security might not be top of the list during such a crisis, this is also not a good time to be taken out by a ransomware attack. Cybersecurity specialists have noted a variety of malicious coronavirus-related campaigns since the start of the outbreak, including emails that use medicines, tax refunds or charitable donations as ways to trick people into clicking links or attachments.

One of the biggest ransomware groups, Maze, even attacked a vaccine-testing facility and published some patient records online in an apparent extortion attempt.

Whether insurers will experience a significant spike in cyber claims remains to be seen, but there is a growing concern that Covid-19 could bring losses across a wide range of lines that were not previously thought to be closely correlated, at least not on a global scale.

To make matters worse, lawmakers in the US and UK are now looking at whether insurers should provide cover for uninsured business interruption costs, threatening to turn a fairly limited loss event into something more like a massive natural catastrophe — without any premium income to pay for it.

On March 26, politicians in the UK sent a letter to the country’s principal industry body asking for “details of the approach that your members are taking regarding the provision of cover for the costs to business relating to Covid-19 and where there may be some flexibility shown in respect of this element of potential cover.”

Insurers in other markets will be hoping that similar letters are not heading their way.

MORE FROM: Insights