Home > Networking

Computerworld - Thanks to a crippling series of computer attacks in 1998, Seattle-based Viznet Inc., an online merchant exchange network service provider once valued at $1 million, is now selling off its customer lists for $50,000. The worst damage occurred when the attacker spammed Viznet's 90 merchant customers, claiming Viznet was a cover for a pedophile ring. The attacker, a former programmer at the company, knew that the wife of owner/operator Jim Vizner owned a day care center.
Vizner calculates that direct losses - denials of service, replacing data that was chewed off the hard drives, customer attrition and public relations costs - amounted to $340,000. As those losses piled up, he called his insurance company.

			Read the Fine Print Because security liability insurance is so new, attorneys and buyers suggest that before you buy a policy, have someone - preferably an insurance or technical attorney - go over it with a fine-tooth comb. Some questions to ask: • Does the policy cover all areas of risk, indirect and direct damages incurred from carelessness and attacks, and viruses from within and without? • Does the insurer require a thorough security assessment? Can you get competitive bids? How does its criteria stand up against those of others? • How often does the insurer perform cybersecurity "inspections"? • Does the insurance policy pass the review of an IT and/or insurance attorney?

That ended up costing him the most dearly - 18 months of his life spent away from the languishing Viznet while he battled with the insurance company and visited insurance regulatory agents and attorneys. No payout on benefits ever materialized. And now, all his calls to the insurer are referred to an attorney.
"My business is gone. My wife's business is gone. Now, I just hope we can hold on to our house," says a disheartened Vizner.
Vizner could have protected his company with cyberliability insurance. The problem is, such insurance wasn't even around when the attacks started. Even if it had been, it would have been expensive. The average entry point for such policies is around $20,000 per year, with high deductibles.
Traditional Policy Exclusions
Insurance companies can't very well apply brick-and-mortar costing and actuaries that were framed in the 1960s to digitized assets. They're still answering some tough questions: How do you determine the value of the data at risk? How do you conduct "cyber" inspections? And how do you determine acceptable risk levels, let alone evaluate losses?
"Insurance companies, like all industries, are just now coming to grips with