Internet Liability. Social Networking. Cyber Liability & Social Media Risks Paula Burns, CIC, CRM 7/10/2014. Cyber Risks / Top 3 Exposures

Transcription

1 Cyber Liability & Social Media Risks Paula Burns, CIC, CRM Cyber Risks / Top 3 Exposures Internet Liability Network Security Social Networking Cyber Liability Challenges Cyber Risk is ever evolving and hard for people to grasp. Not tangible like risk to property or people Insurance policies are expensive 1

2 Can you see the tangible risk here? How about here? We can definitely see the risk here 2

3 Scope of this class: Discuss the top 3 Cyber Liability Exposures Identify risk and define it Discuss loss control techniques SIMPLIFY: practically apply this to the nonprofit s operations Discuss Internet Liability and the exposures related to it. We will learn how to reduce this risk for the non-profit organizations we work with Definition of Internet Liability: The display, transmission, dissemination or other use of Matter in a cyberspace environment. Matter is defined as printed, verbal, numerical, audio or visual expression. Church / School Internet Liability Risks Computer Virus Intellectual Property Invasion of Privacy Security Breaches s Torts in Cyberspace Wrongful Conduct of Employees / Students Posting of Photos 3

4 Computer Virus Internet Liability Risks / Computer Virus Computer Virus Accidental introduction of virus or malicious code Can cause damage to organization s computer network and systems ( First party loss) Discuss possibility of third party loss Reducing the Risk of Computer Virus Anti virus software installed Employee Training / Awareness of Risk Internet-Use Policy Do not open suspicious s or chain letters Do not download from other than approved sites. ( Screensavers, etc ) 4

5 The Gatekeeper Reducing the Risk of Computer Virus Gatekeeper They approve downloads Monitor computers / virus alerts Virus software and downloads up to date Are aware of the risks associated with computer viruses and operations. The Gatekeeper Who is the gatekeeper for your organization? 5

6 Intellectual Property Intellectual Property 2 Categories of Intellectual Property 1.Industrial Property 2.Copyright Intellectual Property Industrial Property: Trademark Infringement falls under the category of industrial property Defined as a word, phrase, logo, design, or anything that is used to identify that product. 6

7 Intellectual Property / Trademark Infringement / Industrial Prop. It distinguishes it from other competitors products. Some Examples are: Like a Good Neighbor. Just Do It. Who s add campaign is this? Good to the last. Maxwell House Good hands people. Who s slogan is this? The umbrella. What insurance company is this? Reducing the Risk of Trademark Infringement Training the Gatekeeper Limit access to your webpage Do not put slogans or other distinguishing product identifiers on your website unless you have written permission! (Example of our website & Travelers) Intellectual Property / Copyright Infringement Copyright Infringement Copyright Defined: form of protection for authors of original works of authorship. Website b Linking ( You Tube) Clip Art or Images Posting of Songs on Internet Site Be Cautious of Using Copyrighted Text 7

8 Intellectual Property / Copyright Infringement Sermons are Intellectual Property Original i Works of Authorship hi Subject to Copyright Laws Reducing the Risk of Copyright Infringement Training the Gatekeeper Limit access to your webpage Do not post any copyrighted material on your website without getting written permission! Invasion of Privacy 8

9 Invasion of Privacy Invasion of Privacy- May consist of any one or more of the following. Disclosing to the public private facts about a person Using another person s name or likeness Placing someone in a "false light" in the public eye Intruding upon another's seclusion (illegal search of home, eavesdropping, etc.) Invasion of Privacy / Posting Photos Online / Or Videos Express Consent written consent. Always get this form of consent when dealing with posting photos of a minor online. Texas as well as most states have passed the Uniform Electronic Transactions Act. Allows web based consents to be enforceable, just like written consent. Church must verify their online procedure complies with the act. Invasion of Privacy / Posting Photos Online / Or Videos Online Consent / Be sure NOT to use this method of express consent when getting a medical release signed. Hospitals and emergency centers have their own guidelines and may not take a copy of this electronic acknowledgement, many require the parents signature. 9

10 Invasion of Privacy / COPA COPA was established to protect children and applies to commercial websites. While churches are not in this category, voluntary compliance reflects due diligence and care to protect children that the church should always exhibit. Invasion of Privacy / COPA Children s Online Protection Act Recommend that the church comply with this act as a best practice. Can not post identifying information next to the photo of a child. Their name, address, phone number Where they go to school Where they live Any other identifying factors Invasion of Privacy / Posting Photos Online / Or Videos Express consent is almost impossible to gain for the videoing of services: Implied Consent consent gained by posting regular announcements in the church bulletin that state the church will be video taping and photographing services. These may be used in publications, released online, in video or photo format. If anyone should object, please see the church office. 10

11 Prayer Requests Invasion of Privacy / Prayer Requests Prayer Lists / Requests If posting these online, get express consent! Train leadership in this area. Ex: of issue with Sunday school class (facebook). Gatekeeper keeps a list of those NOT wanting requests posted. Discussion Boards / Blogging 11

12 Discussion Boards / Blogging Can lead to claims of : defamation of character, libel, slander, infliction of emotional distress, disparagement to the character of a person or organization. Huge Risk to the Ministry! Don t post comments on site that would encourage disparaging remarks Mandatory registration required for posting on website Must have Gatekeeper! Blogging Hazards / Employees Private affairs of a member Slander or libel another individual Reveal a trade secret of the church. ( unlisted phone number, private address, member s address) Could spend work hours blogging and not working Could post copyrighted material Implement a Blogging Policy Points to consider: Employee must notify church if they are going to maintain a personal blog. Put a disclaimer on site Prohibit employee from posting church s policies and procedures or trade secrets. Prohibit use of racial slurs, personal insults, obscenity Avoid using names of members Limit employees time blogging 12

13 Electronic Policy Electronic Policy Be sure your church has an Electronic Mail Policy in Place: Points to consider: Do not open s from unknown senders. Limit s to business use only. The church prohibits inappropriate s, including cyber bullying. Electronic Policy Do not forge an . To create an policy specific for your church contact an attorney to assist and review your guidelines. Do not send or open junk or send chain letters. 13

14 Wrongful Conduct of Employees Theft of Employee Privacy Information or Members Private Information: We will discuss this in detail in the Network Security Section. Wanted to point it out here as it is an overlapping risk. Most of the time theft of private information comes from within the organization. Wrongful Conduct of Employees Harassment of a Third Party by This is an emerging risk that we need to pay attention to. Discussion on safeguards. This is a form of cyber bullying. Ask your insurance advisor to include third party liability in your employment practices liability quote to cover this exposure. Wrongful Conduct of Employees Introduction of Computer Virus: Disgruntled employees can release computer viruses into computer systems for retaliation. 14

15 Wrongful Conduct of Employees Personal Web Surfing: Daily Hours? Define Network Security; discuss related exposures and how to reduce this risk. Network Security: the process of protecting your computer network from any security breach. Network Security Security Breach Defined: 1.Unauthorized Access of Your Computer 2.Failure of Computer Security System. ( Hacking) 3.Infection of Church Computer by Virus/ Malicious Code. 4.Infecting Third Party Computer. 15

16 Network Security Risk from unauthorized access / Security Breach Identity Theft Theft of Employee private information: Social Security Number, Name, DOB, Address, Etc. All of this private information is normally stored on the server. Network Security Third Party Data Breach Stolen credit card information or account numbers from church members or student s parents who may have reoccurring payments scheduled. These would be losses that occur, not handled by a TPA. Network Security Resulting Damages Possible Could result in fraud / damages paid out. Expenses to comply with Privacy Regulations. Counseling/ Pro-active monitoring services. Public Relations expenses. How can this apply? Discuss this. 16

17 Network Security Forensic Analysis Costs Costs to determine any deficiencies in your systems, procedures or physical security that may have contributed to data breach. Network Security Online Giving Normally contracted with a TPA (third party administrator). Transfer of risk via contract. What does the contract say? Are they insured? Get a certificate of insurance. Be sure they have crime / employee dishonesty coverage. Remember most theft of data comes from an internal source. Financial Stability of TPA. Discuss the phenomenon of Social Networking and the related risks for organizations. What are some benefits of social networking for the church today? Discussion: 17

18 Social Networking What are some risks associated with social networking? Discussion Time: Facebook / Texting Social Networking / Mitigation Sample disclaimer for Facebook page: The opinions expressed on this site are the opinions of the participating user. church acts only as a passive conduit for the online distribution and publication of user-submitted material, content and/or links and expressly DOES NOT endorse any use-submitted material, content and/or links or assume liability for any actions of the participating user. Social Networking / Mitigation Methods to control risk: Site Security Settings Checks & Balances System (Gatekeeper) Get written consent to post photos! Procedures in place for adults communicating with minors through social networking. (Buddy system) Employee handbook amendment with a Social Networking policy. 18

19 Social Networking / Mitigation Employee Handbook Amendment Recommended Points to Include: Staff will conduct themselves in a respectful manner when posting to any social networking site. Do not list comments that could defame another person or provoke inappropriate statements. No confidential, sensitive or privation information disclosed! Ever! We re Done! / Questions Contact Information Paula Burns, CIC, CRM Insurance One Agency 9303 New Trails Drive, Ste. 475 The Woodlands, TX Office#: (281)