Privacy / Network Security Liability Insurance Discussion. January 30, Kevin Violette RT ProExec

Transcription

1 Privacy / Network Security Liability Insurance Discussion January 30, 2013 Kevin Violette RT ProExec 1

2 Irrefutable Laws of Information Security 1) Information wants to be free People want to talk, post, and share 2) Code wants to be wrong We will never have 100% error free software 3) Services want to be on Some background processes will need to be on 4) Users want to click If they are connected to the internet, people will click on things 5) Even a security feature can be used for harm Laws 2, 3, 4 even apply to security capabilities Compromise is inevitable under any compute model Managing the risk and surviving is the key *Presented by the CIO at Intel Malcom Harkins. Credit also to Phil Venables 2008, adapted from Scott Culp 2000, Pete Lindstrom 2008, and other sources 2

3 Loss Trends and Development Claims Data of ACE Most Common Policy Triggers : 39% 18% 15% 8% 7% 7% Lost or Stolen Device Network Security Attack Employee Theft Paper Employee Error Privacy Policy 3

4 Loss Trends and Development Claims Data of ACE Industry Breakout Medical / Health Care 15% Financial 11% Government / Military 17% Educational 21% Business 36% Source: 4

5 Ponemon Institute: Cost of a Data Breach Study 5

6 Recent Studies/Reports Javelin Strategy & Research % of customers changed their relationship after breach 30% never purchase goods again from that organization Ponemon Institute % of indirect costs is loss of business due to customer churn (Average of $4.5M) 31% of attacks are criminal or malicious Average cost per record is $214 Average cost of breach has risen to $7.2M Verizon Data Breach Report 2011 Sources of breach 83% external sources, 7% internal Internal breach sources 85% employee, 22% Acct/Finance, 3% Senior IT Admin, Cause of breaches 50% malware/hacking, misuse 17%, social 11% Timeframe from compromise to discover 74% weeks to months Discovery methods 86% notified by a third party!! 6

7 Bridging the Coverage Gap Unless specifically addressed, Privacy and Network Security Liability falls between the cracks of coverage provided by traditional insurance policies: General Liability (may provide limited coverage) for publication of material that invades a person s right to privacy Commercial Property electronic data extension only covers replacement of destroyed or corrupted data. Indirect or consequential loss excluded Commercial Crime / Computer Crime generally excludes loss from theft of confidential information & excludes indirect or consequential loss D&O Policy D&Os unlikely to be named and Entity coverage is limited to Securities Claims. Some policies have invasion of privacy excluded in BI/PD Exclusion. No 1 st party coverage E&O Policy generally respond only to loss from a defined professional service and typically no first party expense coverage 7

8 Privacy insurance coverage detail Privacy/Security Liability First Party First Party Third Party Third Party Other Business Costs Breach Notice Costs Civil lawsuits Regulatory Actions Business interruption Data repair /replacement Cyber-extortion Notification/credit monitoring costs ($ or person sub-limits) Crisis management/pr Forensic Investigation Consumer class action Corporate or financial institution suits Credit card brands State AG investigations FTC investigations Health & Human Services Foreign Privacy Entities 8

9 Insurable Losses First Party Expense Costs (typically sub-limited): Data Forensics Expenses Customer Notification Expenses Crisis Management Expenses Credit/Identity Monitoring Expenses Cyber extortion ransom payments and expenses E-Business Interruption due to network security event PCI Fines Third Party Liability Defense costs and settlements for breaches of privacy and network security Regulatory Defense and Penalties 9

10 Two Approaches to Breach Response Monetary sublimit approach: Dedicated sublimit for responding to breaches Carriers have preapproved vendors, but allow flexibility in choosing vendors Better for Insureds that have existing vendor relationships or more sophisticated in house privacy departments Number of persons approach: Breach response coverage provided for a given number of affected individuals (not tied to the limit of liability) Insured must use vendors approved by the carrier Better for smaller Insureds that do not have existing vendor relationships, and want a streamlined approach to breach management. 10

11 Choosing a Privacy Insurance Carrier Financial stability Coverage terms and conditions Appetite for clients in your industry Appetite for the size of your client s business Commitment to the product Claims paying reputation and infrastructure Industry expertise Industry association participation & education Relationships with expertise attorneys, security firms, forensic specialists 11

12 Carolinas HealthCare Breach Carolinas HealthCare System will notify approximately 5,600 patients that their private information may have been compromised. The Charlotte-based health-care system says the breach potentially affects patients of CMC-Randolph. It also intends to notify an additional 700 patients as a precaution. Those patients have been sent personal letters explaining the type of information that may have been released. In a statement posted to its website, Carolinas HealthCare says incoming and outgoing s were obtained by an "unauthorized electronic intruder." Those s were accessed from a health-care provider's account between March 11 and Oct. 8. The security breach was discovered on Oct. 8 following an upgrade in the hospital's security software. Most s include one or more of the following: patient names, dates and times of service, provider and facility names, internal hospital medical record and account numbers, dates of birth and treatment information, such as diagnosis, prognosis, medications, results and referrals. Five contained Social Security numbers of patients. Carolinas Healthcare says it took immediate steps to prevent further access to the affected account. It has hired a forensic investigator and notified federal law enforcement of the incident. The U.S. Department of Health and Human Services and the N.C. Attorney General are also being notified. 12

13 Carolinas HealthCare Breach (Con t) "At this time, Carolinas HealthCare System has no evidence that the information has been misused, and based on the investigation, no other accounts or other computer systems (including the electronic medical records system) were found to have been affected by this incident," the statement reads. Carolinas HealthCare did not immediately respond to a request for additional comment Friday evening. The health-care system says it has taken measures to contain this incident and prevent similar situations from happen again. That includes additional security safeguards to prevent unauthorized access and monitoring systems for unusual activity. The health-care system is offering affected patients free credit monitoring and insurance services through AllClear ID, a company that specializes in this area. Patients with questions or who would like additional information can call (877) , or visit Source: Charlotte Business Journal 12/07/

14 Managing Privacy Risks Contracts Cloud providers and Data Holders - Review Vendor Agreements Insurance Requirements, Indemnify - Limitations of Liability / Indemnifications Privacy controls/procedures - Access to electronic information only as needed for employees - Information is encrypted whenever possible - Review of physical security procedures used at various locations - Privacy policy in place, monitored for compliance, updated - Sharing of customer information with any 3rd parties - International privacy rules for data transfers Claims, legal matters, and insurance - Broker Interaction Let us help with the process - Provide leverage and discussion about coverage intent with carrier - Use previous experience - Work with coverage and outside counsel as necessary 14

15 If you think technology can solve your security problems, then you don t understand the problems and you don t understand the technology. - Bruce Schneier, World Famous Security Consultant & Author 15