INSURANCE CYBER RISK Tine Olsen, Willis

Transcription

1 INSURANCE CYBER RISK Tine Olsen, Willis

2 CYBER RISICI Agenda: Introduction to Willis What are Cyber risks? Exposure and cases Risk management Risk transfer Insurance Closure and questions 1

3 Part 1 WILLIS

4 WILLIS DENMARK The largest insurance broker in Denmark Partner-owned company ( Willis International is majority shareholder) 6 locations and more than 470 employees Manage more than DKK 9 billions in premiums Øvrige 25% Willis 38 % Marsh 15% AON 22 % Andel af FMF s omsætning i DK 3

5 WILLIS INTERNATIONAL Key figures +400 offices Roughly employees in 110 countries +600 Multinational costumers Premium volume > 30 billions USD 4

6 Part 2 WHAT ARE CYBER RISKS?

7 CYBER RISKS CYBER RISK Cyber risk can be defined as the risk connected to activity online, internet trading, electronic systems and technological networks, as well as storage of personal data HACKER ATTACK DATA BREACH VIRUS TRANSMISSION CYBER EXTORTION EMPLOYEE SABOTAGE NETWORK DOWNTIME MULTIMEDIA LIABILITY HUMAN ERROR

8 RELIANCE ON THE INTERNET 73 % OF THE EUROPEAN COMPANIES 7

9 CHARACTERISTIC One-man hacker Organized Hacker Crime- Associations Hacktivists Spy Whom? How? DDoS Malware/virus/botnets Hacking Espionage via hacking Theft of computers/smartphones Money (directly/indirectly) Personal/business data Public attention Extortion Vandalism Gain? Target All companies can be a target - its just a matter of how and when. 8

10 Part 3 EXSPOSURE

11 EKSPOSURE Any company and organisation that Stores Personal Identifiable information Are reliant on: Digital info FACES CYBER RISKS Webpages The internet / Networks/ Computers 10

12 EXPOSURE IN FEBRUARY 2013, PRESIDENT OBAMA DECLARED THAT THE CYBER THREAT IS ONE OF THE MOST SERIOUS ECONOMIC AND NATIONAL SECURITY CHALLENGES WE FACE AS A NATION AND THAT AMERICA'S ECONOMIC PROSPERITY IN THE 21ST CENTURY WILL DEPEND ON CYBER SECURITY. In Denmark One of the 10 biggest risks. April the Danish Emergency Management Agency (Beredskabsstyrelsen) declared that Cyber-attacks are among the top 10 biggest threats for Denmark! 11

13 WILLIS FORTUNE 500 CYBER DISCLOSURE REPORT, 2013 This report on the Willis Public Company Cyber Exposure Disclosure Study with a Focus on the Fortune 500 (Study) highlights three key disclosure areas in the SEC s guidance: The significance of the organization s cyber exposures and how these are qualified How the exposures are likely to manifest themselves What the company is doing to mitigate these risks. COMPANIES THAT SAID THEY WERE EXPOSED TO CYBER RISK WERE SPECIFIC AS TO THE TYPE OF CYBER RISKS THEY ARE FACING 95% OF THE TIME. THE TOP THREE RISKS IDENTIFIED BY THE FORTUNE 500 ARE: 1) LOSS OR THEFT OF CONFIDENTIAL INFORMATION: 65% 2) LOSS OF REPUTATION: 50% 3) DIRECT LOSS FROM MALICIOUS ACTS (HACKERS, VIRUSES ETC.): 48 %. THESE RISKS ARE CLOSELY FOLLOWED BY EXPOSURE TO LIABILITY FOR SYSTEM BREACHES OR FAILURES (40%). 12

14 WILLIS FORTUNE 500 CYBER DISCLOSURE REPORT, 2013 The companies that used a term such as critical to describe their cyber risk seem not to have any particular relationship to one another (e.g., an auto manufacturer, a food and drink company, a distributor of petroleum products, two utilities, a large machinery manufacturer, a health care insurer, a life insurance company and a computer manufacturer). QUANTIFYING CYBER RISK Our study found that: 38% disclosed that a potential cyber event might impact or adversely impact the business An additional 36% (180 companies of 500) may face material harm to their businessdue to cyber attacks 2% (12 companies) specified their potential cyber risk as critical 13

15 CASES - DENMARK April 2013: Ddos in DK: Patient data social security numbers Virus attack - Danish municipality DDoS attack Danish Travel site 14

16 CASES - INTERNATIONAL Hacking Tax division South Carolina US Media Company Lost a laptop counselling 15

17 The EFFECT Dissatisfied costumers Claim for damages / compensation Bad public attention PR costs/crisis management costs Loss of data Loss / notification Uncertainty Extortion Lock-out Data recovery Work barriers Consultant costs (legal/it/forensic) 16

18 Part 4 RISK MANAGEMENT

19 RISK MANAGEMENT 18

20 RISK MANAGEMENT Analyse your risks Describe your risk strategi Implementing risk solutions Monitor the performance Transfer your risks 19

21 Part 5 CYBER INSURANCE

22 CYBER INSURANCE A cyber Insurance provides coverage for a double burden: - Hacking - Virus or Ddos - Extortion - Theft of data Security - Fines/penalties - Company loss - Violations of sanctions - Loss of data Primarily first party loss Netbankbanking PR Data - Distribution of false information - Wrong information on webpages. Liability Primarily third partyloss /claims made against the company - Privacy violation, - Disclosure of business information - IPR Infringement - Service failure 21

23 CYBER INSURANCE What is generally covered by a cyber insurance? Defence costs Liability regarding to: - Publication of personal data / breach of privacy law - Unintentional distribution of confidential information and trade secrets - Transfer of virus to an other computer or network Repair of reputation Notification costs Recovery costs Investigation costs Business interruption Extensions: - Intellectual property infringement (e.g. unintentional deep-linking or framing ). - Publication of credit card information - Extortion (Ransom) - Electronic theft (e.g. Internet banking) - Monitoring - Multimedia liability 22

24 CYBER INSURANCE Exclusions What is generally not covered? Prior or pending claims Conduct Improvement costs Bodily Injury and property damage Contractually liability Business interruption caused by other things than the listed cyber incidences. Violation of patent-rights. Unauthorised trading Unlawfully collected data Contractual liability 23

25 CYBER INSURANCE Take notice off: How is the insurance adaptable for you business?. Which extensions are relevant for you? Is there an emergency team / a hotline? Does it give you coverage to investigate the incidents? NO EXCLUSION FOR : Terror Hammer clause Employees mistakes Employees criminal act Infringement of intellectual property Contractual liability (unless there is a carve back) Does it provide coverage for professional fee of independent advisors (e.g. legal advice, cyber risk specialists) 24

26 Benchmark Revenue ($) Limit ($) Deductible ($) Insurance 45,000,000,000 40,000,000 1,000,000 E&O, Cyber 25,000,000, ,000,000 5,000,000 Cyber 24,000,000,000 50,000,000 1,500,000 Cyber 22,000,000,000 80,000,000 5,000,000 Cyber 21,000,000,000 30,000,000 2,500,000 Cyber 16,800,000,000 20,000,000 1,000,000 Cyber 15,256,230,000 25,000,000 1,000,000 Cyber 15,000,000,000 50,000,000 1,000,000 Cyber 13,794,000,000 60,000,000 1,000,000 Cyber 12,000,000,000 5,000, ,000 Cyber 5,000,000,000 25,000, ,000 Cyber 25

27 Part 6 CLOSURE AND QUESTIONS

28 For further information contact: FINEX Head of FINEX in Willis: Klaus Stubkjær Andersen Phone: or Legal Consultant in FINEX Tine Olsen Phone: or Visit