Cyber Risks & Insurance

Size: px

Start display at page:

Download "Cyber Risks & Insurance"

Myles Vernon Long
5 years ago
Views:

1 Cyber Risks & Insurance Bob Klobe Asst. Vice President & Cyber Security Subject Matter Expert Chubb Specialty Insurance

2 Legal Disclaimer The views, information and content expressed herein are those of the author(s) and do not necessarily represent the views of any insurers of the Chubb Group of Insurance Companies. This presentation is advisory in nature and necessarily general in content. No liability is assumed by reason of the information provided. Whether or not or to what extent a particular loss is covered depends on the facts and circumstances of the loss and the terms and conditions of the policy as issued. The precise coverage afforded is subject to the terms and conditions of the policies as issued. The information provided should not be relied on as legal advice or a definitive statement of the law in any jurisdiction. For such advice, an applicant, insured, listener or reader should consult their own legal counsel. Slide 2

3 Electronic Fraud Today - Exposure of Confidential Information Data Breaches - Business Interruption & Extortion Denial of Service Attacks Electronic Theft of Funds Account Takeover & Other Wire Transfer Schemes Duty to Notify Related Extortion Threats Heightened Authentication Requirements Other Costs & Activities Extra Expenses & Loss of Income Responsibility or Not Insurance Response Insurance Response Insurance Response Slide 3

4 What is a Data Breach? Unauthorized access or disclosure of private or proprietary information Hacking Rogue employees Negligence Third Party Vendors

5 What Is Data? Data when used in the context of a data breach generally means: A person s name in conjunction with: A Social Security Number; A Driver s License Number or State ID Number; A Financial Account Number, in conjunction with the security code, password or other mechanism needed to access the account; or Medical Information, when such information is not encrypted or redacted. But, different States may define it differently! Slide 5

6 Exposure of Confidential Information Slide 6

7 A Few Statistics Between January 10th, 2005 and January 7th, 2015, there were 4,478 Data Breaches, allowing unauthorized access to 932,729,111 Records. Source: Privacy Rights Clearinghouse, Chronology of Data Breaches, February 2 nd, Slide 7

8 Data Breach Causes Source: Privacy Rights Clearing House; Slide 8

9 Key Costs to a Data Breach Cost per Record $207 (2015) Direct Costs $44 Victim Costs $29 Indirect Costs $134 Discovery Data Forensics Audit/Consulting Notification Call Center Identity Monitoring Identity Remediation Lawsuits Regulatory Fines Reputational Damage/Lost Business Source: Ponemon Institute and IBM Cost of Data Breach Study U.S. Feb. 2016

10 But, For Banks... Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice Federal Register / Vol. 70, No. 59 / Tuesday, March 29, 2005 / Rules and Regulations Slide 10

Consultation Notification Design & Mailing Public

11 The Data Breach Response Cycle Breach Coach Consultation Forensic Analysis Breach Coach Consultation Notification Design & Mailing Public Relations Credit/Fraud Monitoring Call Center Operations Slide 11

12 Notification, If Not Done Correctly... May Invite Notification Litigation Slide 12

13 Litigation Various Types Civil Litigation Brought by affected natural persons, individually or as a class. Brought by affected organizations (e.g. banks) individually or as a class. Regulatory Actions Brought by: Federal Trade Commission; Other Federal or State Regulators (e.g. HHS) State Consumer Protection Departments; and/or State Attorneys General. Slide 13

14 State Breach Notification Statutes California was the first state to enact security breach notification legislation July 1, 2003 [SB 1386]. Currently, 47 additional states have enacted some type of security breach notification legislation, plus: The District of Columbia, Puerto Rico and the U.S. Virgin Islands. Slide 14

15 Cyber Insurance Response Privacy Injury Liability Defense Expenses & Damages for Claims or Suits Alleging Unauthorized Access to Confidential Personal or Business Information Notification Related Expenses, Including Call Center & Credit Monitoring and Remediation Other Crisis Management Expenses Slide 15

16 Business Interruption & Extortion Slide 16

17 Principal Causes of E-Business Interruption Employee or someone with authorized access corrupts, deletes or destroys Data, or otherwise impairs the operation of the System. Hacker corrupts, deletes or destroys Data, or otherwise impairs the operation of the System. Distributed Denial of Service [DDoS] Attacks Slide 17

18 Slide 18

19 Cyber Risks Are Increasing! Denial of Service Risk Privacy Risk Extortion Risk Slide 19

20 Denial of Service... May Result In Litigation Slide 20

21 Cyber Insurance Response Business Interruption & Extra Expense + E-Threat + E-Vandalism Extra Expense & Business Income Loss from Denial of Service Extortion Related Loss Corruption or Destruction of Data Impaired Access Injury Liability Defense Expenses & Damages for Claims or Suits Alleging Unauthorized Access to Confidential Personal or Business Information Slide 21

22 The Perfect Storm First Party Loss of Private Data Notification Costs Publicity Costs Crisis Management Expenses Business Continuity Expense Extra Expenses to continue operations Business Income loss Cyber Extortion Ransom Payment Other Expenses Third Party Client Suits - Privacy Suits from customers alleging negligence in protecting information and other causes of action Client Suits Denial of Service Suits from customers alleging negligence in protecting the network against denial of service Slide 22

23 Electronic Theft of Funds Slide 23

24 Account Takeover - A significant and growing threat for banks and their BUSINESS CUSTOMERS. A. Crooks target small to medium size businesses. B. Utilizing increasingly sophisticated types of malware or phishing techniques they either take control of the victim s computer, or they obtain the victim s online banking information. C. Once they have control of the computer, or they have the necessary log-in information, they loot the victim s demand deposit account by sending wire or ACH instructions to the bank. Slide 24

25 Your Customer May Be A Target! In 2014, 50 percent of all targeted attacks were aimed at businesses with fewer than 2,500 employees. In fact, the largest growth area for targeted attacks in 2014 was businesses with fewer than 250 employees; 36 percent of all attacks targeted them. Symantec Corporation, Internet Security Threat Report 2015, Volume 20, page 4., Slide 25

26 Who s Responsible - The Business Customer... Or, the Bank? Slide 26

27 What s The Bank s Responsibility? The bank s responsibility may be addressed through: Regulation E of the Federal Reserve Act Uniform Commercial Code State Laws or Regulations Customer Agreements Vendor Agreements Legal Precedents Federal Financial Institution Examination Council [FFIEC] Guidance on Authentication In An Internet Banking Environment (2005 and 2011) Slide 27

28 Insurance Response - For Customer: Commercial Crime Policy Computer Fraud or Funds Transfer Fraud Coverage For Bank: Financial Fidelity Bond Computer Crime Coverage Cyber Insurance - E-Theft Coverage Slide 28

29 Financial Fraud... May Result In Litigation Slide 29

30 Insurance Response - Specialized Liability Coverage on Fidelity Bond Professional Liability Insurance Slide 30

31 Watch For Policy Limitations! Some policies exclude coverage for claims related to the Insured s failure to maintain or upgrade their security! Some policies exclude coverage for claims alleging fraudulent or malicious acts by employees! Some policies exclude certain operations of the Insured, or may not cover various types of computer or peripheral device! Some policies exclude claims for unfair and deceptive trade practices

32 Watch For Policy Limitations! Some policies exclude coverage for notification expenses when not mandated by law Some policies do not cover first party exposures such as the theft of money Some policies exclude the Insured s intentional failure to disclose the loss of Personal Information in violation of any law or regulation Some policies exclude claims attributable to sections 605 and 616 of the Fair Credit Reporting Act, 15 U.S.C et seq., or any other similar federal or statutory provisions

33 Slide 33

34 A Comment On The Cyber Fortress Firewalls Authentication Virus Protection Vulnerability Scans Intrusion Detection Policy Administration Active Content Filtering Slide 34

35 The Fortress Won t Protect Against - Advanced Persistent Threats Negligence Employees, vendors Rogue Employees Outsourcers Zero-Day Exploits Slide 35

36 Incident Response Plans Critical for an effective and efficient response to an intrusion or data breach; Should be tested using tabletop exercises; and Should be updated to reflect any changes in the organization. Slide 36

37 So, Please Consider Insurance - Risk Identify Assess Control Transfer Slide 37

38 Are There Any - Slide 38

Cyber Risks & Cyber Insurance

Cyber Risks & Cyber Insurance Terry Quested Executive Director Associated Risk Managers of Ohio Darren Faye Vice President Leonard Insurance / Assured Partners Legal Disclaimer The views, information and