Data encryption
Transforming data into a form unreadable without a key, which does not protect against ransomware but can exempt from notifying affected people after a leak and so reduces loss severity.
Encryption makes data unintelligible to anyone who does not hold the key to decrypt it. There is encryption in transit, which protects exchanges over networks, and encryption at rest, which protects data stored on disks, backups and mobile devices. Its effect on insurance is often misunderstood. It does not protect against ransomware, which in turn encrypts already encrypted data, nor against an attacker who has obtained a legitimate user's credentials and therefore reads the data in clear. It does, however, radically change the consequences of losing or stealing a device: a stolen laptop with an encrypted disk does not expose the data on it. The General Data Protection Regulation draws a direct consequence: the obligation to inform affected people of a breach does not apply when the data has been rendered unintelligible to any unauthorized person, for example through encryption whose key was not compromised. Encryption thus reduces notification, call center and monitoring costs, and the class action risk that comes with them.
Textbook case: a salesperson has a laptop containing the contact details of 20,000 customers stolen on a train. If the disk is encrypted and the key was not compromised, article 34 of the General Data Protection Regulation exempts the company from informing customers individually; without encryption, it must notify them one by one, with the resulting costs and risk of claims.
data encryption, encryption at rest, encryption in transit
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.