[In-Depth Review] Responding to Cyber Risks Requires Cooperation Between Government and Private Sector

Song Yuna, Research Fellow at the Korea Insurance Research Institute

With the rapid advancement of information and communication technology, our society is entering a hyper-connected era where people and objects are organically connected and interact seamlessly across physical and virtual spaces.

Cyber incidents have increased accordingly. Not only cyber incidents caused by human and system errors but also cyber attacks are on the rise. The damage from cyber attacks has extended beyond information leaks and personal data breaches to include business interruptions as well as threats to physical assets and human lives.

Therefore, the demand for corporate coverage against cyber risks is also growing. However, the global insurance industry is taking a cautious stance on providing cyber insurance. While the insurance sector mainly focuses on liability coverage related to information leaks, it remains reluctant to cover property damage, bodily injury, financial theft, and mental damages exposed to the uncertainties of cyber risks and large-scale disasters.

Furthermore, following the 2017 Notpetya attack and the ensuing controversy over state-sponsored cyber attacks, the insurance industry is considering exclusions for large-scale disasters and war-related incidents in cyber insurance policies. Consequently, coverage gaps for property, bodily, business interruption damages caused by cyber incidents, state-sponsored cyber attacks, and cyber catastrophes are expected to widen.

In response, many countries worldwide are actively discussing support measures for cyber insurance supply, including government capital injections into the insurance market and support for building insurance supply infrastructure.

The United States, the United Kingdom, France, Australia, and others are reviewing plans for the government to provide reinsurance or liquidity for corporate property, business interruption, and liability losses caused by cyber attacks and to expand such coverage. By offering reinsurance or liquidity to insurance companies, governments aim to encourage market entry by insurers and reduce coverage gaps.

Meanwhile, the United States proposes establishing a Cyber Statistics Bureau within the Department of Homeland Security, forming public-private working groups for cyber risk modeling, and supporting federal government cyber insurance specialists and product development. This policy is based on the belief that premiums calculated based on high-quality empirical data reflecting risk can serve as a mechanism to encourage companies to strengthen their cybersecurity.

South Korea’s cyber incident response policy mainly focuses on proactive security enhancement. However, since cyber attacks are easier to execute than defenses and the government cannot be free from responsibility for state-sponsored cyber attacks, a policy response solely focused on security enhancement has its limitations.

So far, the government’s approach to post-incident damage recovery has been limited to personal data breaches and third-party liability, with little substantive discussion on corporate property and business interruption losses. To promote insurance companies’ market entry and improve corporate access to cyber insurance for cyber incidents expected to have coverage gaps, the government could consider providing reinsurance, payment guarantees, or liquidity support to insurers.

Additionally, to establish cyber insurance premium rates and risk assessment criteria that reflect actual risks, a data-sharing system on cyber incidents among the government, security industry, and insurance industry must be established. Aggregated statistics are the first step toward solving the problem.

Yuna Song, Research Fellow, Korea Insurance Research Institute

This content was produced with the assistance of AI translation services.