Allianz Global Corporate & Specialty. Cyber Risks. Recent Trends. AIRMIC 15 th June 2015

Transcription

1 Allianz Global Corporate & Specialty Cyber Risks Recent Trends AIRMIC 15 th June 2015 Copyright Allianz Global Corporate & Specialty

2 Copyright Allianz Global Corporate & Specialty

3 Allianz Global Corporate & Specialty Cyber Risks Recent Trends AIRMIC 15 th June 2015 Copyright Allianz Global Corporate & Specialty

4 Legislation & Regulation DPA 1998 (Data Protection Act) implementing the Data Protection Directive (95/46/EC) PECR 2003 (Privacy and Electronic Communications Regulations) Published guidance from the ICO in respect of the obligations imposed by legislation. HIPAA (Health Insurance Portability and Accountability Act) COPPA (Children s Online Privacy Protection Act) GLBA (Gramm Leach Bliley Act) FCRA (Fair Credit Reporting Act). As of January 2013; 46 States have enacted notification laws involving security breaches of personal information. Main piece of legislation on the horizon is the Data Protection Regulation/Directive which will replace the existing Data Protection Directive. GDPR proposes up to 5% of global t/o as a fine 4

5 Exercise 1 Within your groups identify the main risks/exposures to your organisations from a cyber incident*. Select a spokesperson to present these. *a cyber incident can be an attack (external or internal), internal errors and omissions or indeed unexpected technical failures. 5

6 What are the risks? Data loss Business Interruption Property damage Extortion Theft Identity theft Reputational damage IPR loss of trade secrets and confidential information

7 What are the risks? Regulatory actions and associated fines and penalties (inc. PCI fines) Breach of contract (E&O) Product recall Terrorism Notification costs and other response costs Forensic IT costs Media liability Network security liability D&O liability

8 Cyber Threats Source: Threat Landscape: European Network and Information Security Agency The different types of threat posed by cyber criminals are nearly all increasing. When the threats are mapped to emerging areas of technology the picture becomes very concerning; In 2012 the first drive-bydownload for the Android OS was spotted so in addition to PC s this is now a threat for mobile devices as well. Cloud computing concentrates large numbers of users and huge amounts of data on a small number of logical locations, the attractiveness for criminals is obvious.

9 Exercise 2 Within your groups determine where the risks/exposures you identified are covered by insurance. Select a spokesperson to present these.

10 Potential Insurance Solutions Risks Data loss Business Interruption Property damage Extortion Theft Identity theft Reputational damage IPR loss of trade secrets and confidential information Regulatory actions and associated fines and penalties (inc. PCI fines) Cyber Insurance Solutions Y Cyber (& maybe E&O) Y Cyber (non physical damage BI) N cover in property policy? Y Cyber (& KR&E) Y Cyber (& Commercial Crime) Y Cyber (& IDT policy) Y Cyber limited cover (& Reputational policy) Y Cyber limited cover (E&O & IPR policy) Y Cyber(potentially E&O)

11 Potential Insurance Solutions Risks Breach of contract (E&O) Product recall Terrorism Notification costs and other response costs Forensic IT costs Media liability Network security liability D&O liability Cyber Insurance Solutions N (E&O policy) (Cyber partially) N (PL policy) Y (not physical damage though) Y (may also be covered in a E&O policy) Y (may also be covered in a E&O policy) Y (E&O potentially & Media liability policy) Y (E&O potentially) N (maybe under D&O)

12 Incidents Vodafone Germany hack hits two million customers German steel mill attacked causing massive damage to a blast furnace American Airlines Flights Delayed After App Issues in Cockpit Thousands of American and United airlines accounts hacked, with thieves booking dozens of free trips

13 Incidents Orange Suffers Data Breach Again, 1.3 Million Affected Morrisons employee arrested following data breach involving details of 100k staff British Gas Help Twitter account hacked, customers pointed towards phishing sites

14 Incidents Information Commissioner s Office Suffers Data Security Breach Massive Paddy Power hack: nearly 650,000 customers records stolen Syrian Electronic Army attack on Gigya affects Telegraph, Independent, Evening Standard

15 BACK UP SLIDES Copyright AGCS 15

16 Risk Management Most cyber fraud can be prevented by good risk management, indeed the GCHQ report on cyber security estimates up to 80% of attacks can be prevented by basic information risk management. 10 Steps To Cyber Security CESG (The information security arm of GCHQ) Copyright AGCS 16