American Oil and Gas Reporter - December 2017 - 79

encryption, firewalls and data compartmentalization. Rather, businesses should
expect that every network has been or
will be compromised, which requires
shifting the principal focus from prevention
to building resilience and minimizing the
impact of cyber events when they occur.
One important way to minimize this exposure is by insuring residual risk for
cyber events.
Generally speaking, mitigating cyber
risk through insurance involves four key
coverages:
* First-party coverage, which protects
a policyholder for claims involving data
loss, business interruption, network failure
and other cyber losses suffered by the
policyholder itself;
* Hybrid first-party coverage, which
provides event management and breach
response coverage for particular
security/privacy events;
* Third-party coverage, which provides
liability and defense cost insurance for alleged security, privacy and professional
service failures arising from claims brought
by third parties such as vendors, customers,
employees and government agencies; and
* Crime insurance, which provides
coverage for dishonest acts by third parties,
including computer fraud and forgery or

alteration of financial instruments.
Most cyber insurance policies provide
several or all these coverages.
First-party cyber coverage typically
insures losses sustained directly by the
policyholder as a result of a covered
cyber event, including the cost of reconstructing or retrieving data destroyed or
corrupted by a computer attack, lost revenue and extra expense arising from a
computer attack, the cost of investigating
and paying extortion demands related to
a threatened computer attack, and certain
reputational harms (such as diminution
of business income due to lost customers).
While sometimes overlooked in the
news in favor of high-profile consumer
data breach lawsuits, system interruptions
following a cyber event can have a significant impact on operations, with very
high recovery costs. For example, in
2012, one of the world's largest oil companies was targeted by a virus that erased
data on 75 percent of its computers,
forcing the company to shut down its information technology network. Last summer, multiple oil and gas companies, port
operators and other energy facilities were
hit with the Petya virus, which disabled
computers and demanded that users pay
cryptocurrency ransoms to unlock the

compromised systems.
Each of these cyber events stopped
short of disrupting actual production or
supply operations, but they unquestionably
imposed significant direct losses in the
form of forensic investigation, data restoration and retrieval costs, and business interruption losses.
Hybrid Cyber Coverage
Hybrid cyber insurance provides coverage for particular types of security and
privacy events, such as computer system
breaches, malicious use of computer code
or "denial of service" attacks, and dissemination or compromise of personal
and confidential business information.
Costs commonly covered by these security
or privacy events include the cost of
forensic accountants to determine the existence, cause and scope of the attack;
associated legal and public relationships
costs, required (and sometimes voluntary)
breach notification costs; data restoration
costs; and the cost to implement call centers and credit and identity monitoring
services for customers following a breach.
The oil and gas industry has faced
many security and privacy breaches that
may have resulted in losses that would be
covered under hybrid cyber insurance

DECEMBER 2017 79
http://imacorp.com
American Oil and Gas Reporter - December 2017

Table of Contents for the Digital Edition of American Oil and Gas Reporter - December 2017
