Cyber Liability State of the Insurance Market & Risk Update Sept 8, ISACA North Texas

Transcription

1 Cyber Liability State of the Insurance Market & Risk Update Sept 8, 2016 ISACA North Texas

2 Agenda Introduction Cyber Liability Overview State of Insurance Regulatory Update Questions and Discussion 2

3 Speakers Kaitlin Upchurch, Managing Director, Wortham Insurance Kaitlin joined the Wortham Professional Indemnity/Bond department in 2010 and specializes in Directors & Officers Liability, Professional Liability, Cyber Liability, Employment Practices Liability, Fiduciary Liability, Crime/Fidelity Coverage, and Kidnap Ransom & Extortion insurance. In 2016, she was named a Power Broker by Risk & Insurance magazine. Prior to joining Wortham, Kaitlin was an underwriter in Chubb s Executive Protection practice, working also with Chubb s Professional and Healthcare practices. She attended Wake Forest University earning a Bachelor of Science degree in Business and a Bachelor of Arts degree in French. Kaitlin is a member of the Professional Liability Underwriting Society, serving on the Texas Chapter Steering Committee. She is also an active leader with Young Risk Professionals of Texas, serving as the Statewide Director of Finance. Brittany George, CISA, QSA, Weaver, Senior Manager, IT Advisory Services Brittany brings more than 12 years of experience performing IT audit, security and consulting services, including more than six years of public accounting experience. She has experience in oversight of the planning and performance of many of Weaver s most significant IT controls engagements, which have a heavy focus on information security. Her practice emphasis is in internal and external IT audits including risk assessment, planning and execution. Brittany has more than two years of experience in KPMG s Information Technology Advisory practice and two and a half years with TXU/Capgemini Energy. She is involved with Managed System, Integration and User Acceptance testing activities across multiple project teams for projects sponsored by ERCOT (Energy Regulatory Commission of Texas) involving market participants across Texas while at TXU/Capgemini Energy. Brittany is responsible for the oversight and management of the development and maintenance of annual IT audit and security project plans for multiple Fortune 500 companies. Her additional experience includes leading compliance engagement sections/phases, including the documentation of controls design and testing of controls. Industry experience includes: technology solutions, utilities, oil and gas, municipalities, telecommunications, financial services, healthcare, food services, banking, government. 3

4 Speakers Will Daugherty, Counsel, Baker Hostetler LLP Will is a member of the firm's Chambers USA-ranked Privacy and Data Protection Team. He works with clients to perform risk assessments, develop and implement information security compliance programs and incident response plans, and to respond to data breaches and other security incidents. Will also defends companies in regulatory actions and class actions that arise in connection with data security incidents. His depth of experience is global in scope and across many industries, including electric power, oil and gas, retail, hospitality, financial services, transportation, and technology. Will spent the first eight years of his career with an AmLaw 5 firm representing public companies, officers, and directors in government investigations and enforcement actions, as well as derivative suits and securities class actions. Will also served as senior counsel at a Fortune 250 company where he advised the board and executive team on matters of corporate governance, regulatory compliance, and data privacy and cybersecurity. Prior to practicing law, Will spent several years as an Information Technology Specialist at the Louisiana Department of Natural Resources. Mr. Daugherty graduated cum laude from Tulane University Law School, and earned his bachelor of science in International Trade and Finance from Louisiana State University. Will has also earned the designation of Certified Information Privacy Professional (CIPP/US) through the International Association of Privacy Professionals (IAPP). Nick Economidis, Underwriter, Beazley USA Nick Economidis is a professional liability underwriter for Beazley USA. Prior to joining Beazley, Nick was the Vice President and Product Manager for Media, Technology and Network Security with AIG Executive Liability. He has over 25 years of underwriting experience covering everything from workers compensation to professional liability. For the past 15 years, Nick has specialized in underwriting risk for the technology industries and technology related risk issues. Nick has an Associate in Risk Management designation from the Insurance Institute of America, a B.S. (Marketing) from Rutgers University, and an MBA degree from Villanova University. 4

5 Cyber Liability The Past... This is an IT issue. We don t have credit card data or information on our customers. My company is not a target for cyber breaches. The insurance applications are too long. The premiums are too expensive. I don t understand my risk! Source: 2015 Data Breach Trends; Risk Based Security; January

6 Cyber Liability Where are we now? No longer deemed an emerging risk. Board and c-suite level attention. Significant increase in insurance buyers + continuous expansions to coverage options. Primary concerns: Reputational damage Protection of corporate data Social engineering fraud Operational / system failure loss Internet of things How do we quantify loss? How do we manage third party vendor risk? How do we improve our response plan? What alternative methods to traditional cyber insurance can be considered? Source: 2015 Net Diligence Claims Study 6

7 Cyber Liability Who is in charge? Which department is primarily responsible for spearheading the information security risk management effort? In the event of a data breach, which department in your organization is primarily responsible for assuring compliance with all federal, state or local privacy laws, including state breach notification laws? Source: Advisen 2015 Survey On Current State of Trends and Information in Information Security and Cyber Liability Risk Management 7

8 Key Findings from 2015/16 Multiple stakeholders at organizations concerned/responsible for prevention of data breach. Cost per record in data breach is on the rise; however cost per record analysis is not an accurate reflection of true risk. Healthcare, financial services, retail, and education still remain top industry targets. Hacking/malware and employee mistakes account for top cause of breaches. Proprietary corporate data and non-financial data are still at risk in a breach, in addition to payment card data, health record data, and other personally identifiable information. Costs of a data breach are reduced if companies possess an action plan, implement training, and purchase cyber insurance. 8

9 The Threat What are the commonalities of a breach? Financial motives Targeted user devices Compromised servers Opportunistic attacks Discovery by external parties Time of discovery is multiple months Low difficulty of initial intrusion 9

10 Cyber Liability Insurance The Coverage Third Party Liability Coverages Coverage Description Privacy and Network Security Liability Protection for liability arising out of allegations of security and privacy wrongful acts against the Insured. Damages and claims expenses incurred as a result of a covered claim are included. Regulatory Defense and Penalties Media Liability Protection for those amounts Insured is obligated to pay arising out of certain privacy regulatory actions. Defense costs and certain fines/penalties included. Protection for liability arising out of allegations of multimedia wrongful acts, such as allegations of libel, slander, invasion of privacy, emotional distress, mental anguish - all in connection with the Insured s multimedia. First Party Coverages Notification Expense/Credit Monitoring Network Interruption and Data Asset Restoration Extortion Expenses Coverage Description Reimburses Insured for first party notification expenses incurred by insured following a privacy event or security breach. May extend to credit monitoring services, call center services, and other event management response expenses. Reimbursement for loss of net income and extra expenses following a security breach; also provides reimbursement for reasonable costs to restore, replace or reproduce damaged or destroyed computer programs, software and electronic data. Money and expenses paid at the recommendation of an approved service provider relating to cyber extortion demands. Additional Coverages Available in Select Policies Computer Fraud / Electronic Fraud / Social Engineering Fraud Reputational Harm Professional Liability Errors & Omissions 10

11 Cyber Liability Insurance Emerging coverage Full prior acts Computer Crime/Social Engineering Fraud extensions No sublimits (including PCI fines/penalties) Contingent business interruption System failure Failure to supply liability Theft of intellectual property/intangible assets Difference-in-conditions wording Large capacity facilities 11

12 State of the Cyber Liability Insurance Market Market continues to soften for small to mid-size businesses in perceived low risk industries as a result of abundant capacity and broadening terms and conditions. Pricing for the smallest organizations can be as low as $1,000. Online quoting and short form applications available for many insureds. Larger organizations (except for retail, healthcare, financial institutions, educational institutions, healthcare organizations and certain critical infrastructure/energy risks) are able to secure plenty of capacity, with very little touch points with underwriters; policy wording can generally be customized. Large retail, healthcare, financial institutions, and educational institutions are still seeing tightening of primary capacity (particularly those organizations with revenues in excess of $1bb); Rates are on the rise, except for those insureds who took material rate increases in 2015; heavy underwriting scrutiny, conference calls and/or underwriting meetings are typically involved. Source: Advisen 2015 Survey On Current State of Trends and Information in Information Security and Cyber Liability Risk Management Energy industry has increased uptake rate of insurance, particularly in the utility sector; alternative products for critical infrastructure risks are still being evaluated, however many insureds are pushing to remove cyber related exclusions in noncyber policies. Total market premium was estimated to be $3.25bb (compared to $2.75bb in the prior year) 1 Source: RIMS Cyber Survey May The Betterley Report; Cyber /Privacy Insurance Market Survey

13 State of the Cyber Liability Insurance Market 40+ insurance markets available (Domestic, Lloyds, and Bermuda); Lloyds retains large presence, but significant growth in domestic carrier products and competition. Development of more precise underwriting tools and improvement of risk management services. More interest by reinsurers in supporting cyber insurance products, yet concern exists over accumulation risk. Continued increase in frequency in data breaches, however it is unclear whether this could be attributed to the increased reporting and/or awareness of data breaches now occurring in the market. Source: Advisen 2015 Survey On Current State of Trends and Information in Information Security and Cyber Liability Risk Management Increase in risk mitigation and breach response services are being offered by many insurance carriers; certain carriers offering data breach prediction tools to help estimate the cost of a data breach. Companies wanting loss prediction modeling for risks such as stock drop, reputational harm, and overall loss of income. Source: RIMS Cyber Survey May

14 Data Security and Privacy Laws and Standards Federal Data Security Laws State Data Security Laws Industry Self-Regulation & Guidelines International Laws

15 Industry Regulation The Payment Card Industry Data Security Standards (PCI DSS) American Petroleum Institute Security Guidelines (2005) American Bureau of Shipping Cybersecurity Principles (2016) National Association of Realtors Data Security and Privacy Toolkit (2015)

16 International Data Security Laws Personal Information Protection and Electronic Documents Act (PIPEDA) Canada EU 1995 European Directive (95/46/EC) EU General Data Protection Regulation (GDPR)

17 Cyber Risk Considerations Key Focus Areas Intelligence-driven security and risk management Proactive versus Reactive Intelligence collections that enhance audit Are policies and controls effective? Validate internal threat and risk assessments Are our perceived threats real and did we prioritize them correctly? 17

18 Typical Data Breach Costs 2015 netdiligence Claims Study Average costs Total loss paid: $880,000 Average cost of loss for a healthcare entity: $1,300,000 Average cost of breach response costs: ~$500,000 Average legal costs for liability claims: ~ $434,000 Average cost for settlement of legal claims: ~ $880,000 Average legal cost for regulatory actions: $327,000 Average costs of settlement regulatory actions: $750,000 Average of PCI Fine and assessments: $268,780 18

19 Discussion