Data breach, cyber and privacy risks. Brian Wright Lloyd Wright Consultants Ltd

Transcription

1 Data breach, cyber and privacy risks Brian Wright Lloyd Wright Consultants Ltd

2 Contents Data definitions and facts Understanding how a breach occurs How insurance can help to manage potential exposures Proposed next steps About Miller We want to help you understand data breach exposures and the risk transfer options available. 2

3 What is a data breach? A data breach is a security incident in which sensitive, protected or confidential data is: Copied Transmitted Viewed and/or potentially used by an unauthorised individual Stolen Lost

4 Facts about breach law A classification of a data breach can vary depending on the US state Of the 50 US jurisdictions, 46 states currently have public disclosure laws Governments around the world, including the EU are discussing reporting requirements

5 Current data breach legislation Listed below are just some examples of cyber related legislation: Gramm Leach Bliley Act (GLBA) Health Insurance Portability Accountability Act (HIPAA) ISO PCI DSS Sarbanes Oxley Act COBIT CAN SPAM Act FFIEC Guidelines COPPA Amendment to S.B (California) effective January 1st 2012 Red Flags Rule Amendment Privacy Act of 1974

6 Facts about data breaches Nearly half of all breaches involve a third party vendor or contractor Breaches involving lost or stolen laptops, computers or other mobile devices remain a constant and expensive threat. 69% of breaches are spotted by an external source, 9% by clients. USD194 is the average cost to a company for every stolen or misplaced record. 75% of attacks are opportunistic, and the majority are financially motivated. Costs per record lost average at USD20 per person for notification, call centre, credit monitoring, and fraud resolution. This figure does not include forensics or privacy counsel. Sources: Ponemon annual study: US cost of a data breach Verizon Data Breach report, Lloyd s market underwriters

7 Privacy risks for organisations Store Collect Hold Handle Organisations that do any of the above with information about clients, customers or employees are potentially exposed to the legal and regulatory ramifications of a data breach. On average, an incident costs a firm USD8.9m. This figure continues to rise.

8 How do internal breaches occur? Communications transmitted to the incorrect recipient Non-encrypted file transfer protocol Failure of hardware and/or security Errors by independent contractors Lost laptop, PDA or other data storage device Employees including interns Small organisations have a higher proportion of cyber incidents relating to malicious code and malware. 8

9 How do external breaches occur? Hackers and activists Organised crime Government entities (19% attacks) Competitors Outsourcers Former employees Ineffective passwords Large organisations have a higher proportion of breaches resulting from disgruntled employees, stolen or lost devices. 9

10 Scenarios IT cannot defend against Breach type Organisation affected Cost New hacking techniques Sony USD70m (rising) Spear Phishing Coca Cola Unconfirmed Lost/stolen equipment AvMed inc. Unconfirmed but 1.2m records lost Partners/suppliers hacked EMC/Lockheed Martin USD66m (rising) Human error Department of Veterans Affairs USD30m Exposure in new software Administrative Office of the Courts USD192m System glitches Royal Bank of Scotland USD125m

11 Calculating potential exposure Organisations should ask themselves the following when considering their level of exposure to cyber threats: What information do we have? Where is it stored? Is it encrypted? Is it in transit? Is it available on mobile devices? How easy is it to access? (wireless networks can be easier) Is our security sufficient/up to date? Is the data accessible to third parties/ex-employees? Do we have a privacy policy/response strategy in place? (including social media) What security systems do our providers have in place? (such as clouds) Negligence is the biggest cause of data breaches at corporations according to the Ponemon 2012 annual study: US cost of a data breach. Negligence can cover anything from stolen laptops to employee errors. 11

12 Why purchase a standalone policy? Crime Commercial general liability Commercial errors and omissions Kidnap and ransom Property These covers may not be effective in the event of a data breach because: Data is not recognised as property Specific responses are required for a data breach that these policies cannot provide Specialist services are required following a data breach The only way an organisation can ensure that it is fully covered against all the costs associated with a data breach is to have a standalone policy in place.

13 Coverage available (first party) Business income loss Reimbursement of net income that would have been earned had computer systems not been suspended or data assets lost. Notification, credit monitoring and crisis management The cost of notifying the individuals whose data has been compromised and the offering of services to monitor suspicious credit activity. Data asset restoration/forensics Costs to recover, reinstate and recreate intangible assets destroyed during an attack. Forensic auditors, investigators and loss adjusters could all be hired to determine what information was stolen and who it belonged to. Cyber extortion threat Cover against a credible threat including damage or destruction, demand for funds to avoid corruption, the introduction of a computer virus, malicious code or the denial of a service attack.

14 Coverage available (third party) Privacy liability/employee liability Class actions and suits that are filed against an organisation following the unauthorised disclosure of private and confidential information pertaining to an organisation or individual (including the firm s own employees). Regulatory defence and civil penalties Costs incurred as a result of regulatory defence and reimbursement for mandatory fines and penalties that follow regulatory action due to a privacy breach (where insurable by law). Media liability Legal liability arising from the release of media content transmitted on any computer system. Harm suffered by others due to an infringement of an intellectual property right. Defamation and slander.

15 Standalone policy response Scenario Disgruntled employee posts on a blog/ social networking site Malware permitted entry to a bank s online banking system Hacker breaks into network, steals customer data, threatens to post publicly or sell it or even shut network down An employee s laptop or PDA is stolen containing customer or employee information Foreign hackers penetrate defence networks in an attempt to steal information on an unmanned aircraft Policy response Slander/defamation/liability Forensics, notifications, credit monitoring, liability Forensics, cyber extortion, data restoration, liability Notification, credit monitoring - depending on content, liability. Cyber terrorism

16 About the markets Capacity Miller has access to global privacy markets with London capacity itself of more than USD150m+ Choice Experience Tailored There are over 50 different worldwide markets offering primary and excess data breach solutions. London markets can consider full limits for all cyber coverages for certain risks. Excess capacity can be sourced through Miller s Bermuda and Singapore offices. London markets write privacy and network security cover on a worldwide basis. Where regulation does not apply, voluntary notification is obtainable on a case by case basis. What is the main driver for the client? Is it business interruption? Is it privacy? Is it defamation? We tailor policy wordings to best suit an organisation even where full limits for notification are not required.

17 Next steps Discuss exposures Complete an application form for a non-binding indication Review coverage Pre-breach network security review offered Security recommendations implemented if required Quote provided Policy bound

18 Contact us For further information, please contact: Brian Wright +44 (0)

19 About Lloyd Wright Consultants Established in 2008, Lloyd Guidry is organised into specialist market-facing business units, and managed so that we can rapidly assemble multi-skilled service teams. Key facts Independent specialist insurance and reinsurance broker 100% growth over the previous year Continual investment in people, products and technology Utilising Lloyd s of London and London Market providing A Grade security Placing platforms in London, Houston and Riga.

20 Other breach examples PHH Corp Sutter health Briar Group TRICARE SAIC A temporary worker potentially gained access to employees' personal information, Social Security numbers and dates of birth. Letters sent to former and existing employees, cautioning them of the breach. The company had roughly 6,700 employees at the end of They also offered identity protection services through a company called AllClear ID until Nov. 15, m individuals information stolen. Class actions combined and pending. Notifications at a cost of USD1-4 per each individual. No Credit monitoring as no financial information stolen. A group of restaurants in Boston who failed to patch a security hole. They were fined USD110,000 plus ordered to improve data security by implementing a password management system. Related costs and counsel costs not public information. 4.9m military, clinic and hospital patients information impacted. Total limits paid USD50m+ to date.