Cyber Liability Insurance

Transcription

1 Annual Board of Directors Conference 29 April 2014

2 TOC - 1 The Cyber Risk Landscape 2 Regulation Changes 3 Case Study Why to insure 4 Page 2

3 The Cyber Risk Landscape 2013 Lloyds Risk Index : Cyber Risk ranked 3 rd (Globally) & 2 nd (USA) Drastically Moving up from 12 th position in 2011 Page 3

4 The Cyber Risk Landscape Strategic Risk Operational Risk Financial Risk Compliance Page 4

5 The Cost of Cyber Risk A 2013 study by the Ponemon Institute found that the average annualized cost for 56 benchmarked organizations was US$8.9 million a year, up from US$8.4 million in 2011 With a range from US$1.4 million to a staggering US$46 million per year. Page 5

6 Board members and Cyber Risks LAW IN THE BOARDROOM 2013 FTI Consulting Page 6 Presentation title

7 Board members and Cyber Risks Are you compliant? What about your cyber security readiness? LAW IN THE BOARDROOM 2013 FTI Consulting Page 7 Presentation title

8 Regulation EU Data Protection Directive (Directive 95/46/EC) During 2014, the European Union (EU) will begin the adaption period for the directive imposing fines for significant breaches of personal information, totaling up to two percent of a company s global revenue. Page 8

9 Insure Vs. Invest? Insurance isn t a quick fix, nor does it replace security Used as a tool of risk transfer Not all situations can be mended: Regulation Time to integrate Technological complexity Notification of a cyber breach Page 9 Presentation title

10 Case Study - Target Dec 2013 Target 40 Million credit cards POS Malware Fines up to 3.6 Billion $ Assuming Target would have been insured, the following would have been covered: Fines and law suits (capped) Investigating the breach Restoring their systems Handle the notification Customer service costs related to the breach Lost profits from downtime Page 10

11 Corporate insurance policy, aimed at handling: 1 st party damages covering cost of digital forensics and expenses related to damages due to cyber security breach on the company s network. 3 rd party damages - covering expense that insured due to a cyber related incident at a 3 rd party service provider that have hosted the policyholder s PII, sensitive data. Over 50 insurance carriers are currently offering Cyber Liability Insurance (DHS Cyber security Insurance Workshop Readout Report) Page 11

12 Coverage Data Liability Loss of Personal Information Loss of Corporate Information Outsourcing Network Security Administrative Obligations Data Administrative Investigation Data Administrative Fines Reputation and Response Cost Forensic Services Repair of the Company s Reputation Repair of Individual Reputation Page 12

13 Coverage Reputation & Response cont Notification to Data Subjects Monitoring Electronic Data Cyber/Privacy Extortion Network Interruption Insurance Page 13

14 Cost of Premiums Average premiums $100,000 for a limit of indemnity of $10 million (USA) 30,000 for a limit of indemnity (with no US exposure) of 1 million Primary limits of between 5 million and 10 million are purchased (UK) Page 14 Presentation title

15 Bottom Line We see that insurers are more aware to the cyber risks Insurance companies, once decided to enter a market will help improve it. We can transfer some of the cyber risk to the insurance companies. But cyber insurance is not a substitute of proper cyber defense measurements. Page 15 Presentation title

16 Thank You! Hacktics Advanced Security Center