Protecting Your Assets: How To Safeguard Your Fund Against Cyber Security Attacks

Transcription

1 Protecting Your Assets: How To Safeguard Your Fund Against Cyber Security Attacks

2 Hacks, breaches, stolen data, trade secrets hijacked, privacy violated, ransom demands made; how can you protect your data or your investors data in the modern age? Since 1995, the digital age has created a host of for you and your clients. Do you have sensitive client or employee data on your systems? Do you grant investors or third parties access to your systems? What internal controls are in place for employees to access client data or your own corporate trade secrets? How have your third party vendors limited their liability in the contracts you sign? The list continues. Firms must take the following steps to ensure that they remain safe and compliant: 1.) Develop a plan around network security through your own internal IT departments or with the help of The plan must include: Disaster Recovery Policies and Procedures for Employees (note: both internal and external if they work with/or on client systems) A Regulatory Compliance Assessment Copyright and Trademark Infringement Assessment of the web-based activities A Full Security Threats Analysis 2.) Most funds outsource their data and servers to hosted facilities, prime brokers, professional employer organizations, payroll companies and administrators. Funds need to assess their limitations concerning privacy within these contracts. Additionally, create a plan of action in the instance of a security 3.) This will help mitigate the costs during a breach and provide you with a counterparty that is adept at handling breaches and restoring your operations. Once the breach has been detected you need to contact your insurance broker who will work with the insurer to immediately respond to the threat. You will need to do the following: If it is a cyber-extortion situation, the insurer will provide services to deal with ransom demands Notify your investors and employees of the breach Purchase credit monitoring services (note: most state laws require you to procure three reports for two years) Hire Crisis Management services to help with media and public perception to help minimize the reputational risk Determine if there was any business interruption and lost revenue as a result of the breach Assess the damage to your systems and repair them as quickly as possible 2

3 A Cyber Liability policy can be designed to pay for the costs previously mentioned. The insurers have Maloy s immediate value-add is being an insurance broker to both the hedge fund and technology industries. EZE Castle Integration, Inc. Vinod Paul, Managing Director vpaul@eci.com Agio Jessica Golle, Business Development Manager jessica.golle@agio.com Gotham Technology, Inc. Chris Passaretti, Director of Sales CPassaretti@gothamtg.com esentire Mark Sangster, VP of Marketing mark.sangster@esentire.com Even after a full-scale network security assessment and implementation of the latest security protocols, what if the attack, breach or ransom still occurs? How are you protected? Many funds think you can rely on your but these policies carry exclusions for intellectual property lawsuits, breaches and viruses. Only Cyber Liability policies cover Privacy Liability, Network Security, Data Breach Fund, Internet Media Liability, Network Extortion, Business Interruption Insurance and Digital Asset loss. The ever-expanding risks and regulatory environment around privacy and breach are now at the forefront of most hedge fund IT Managers. Even the most savvy security systems may not be enough to deter or stop cers/professional Liability, Cyber Liability is a relatively inexpensive proposition with costs ranging between $3K-10K per million depending on the size and complexity of the management company and the coverage you choose. The policies are designed to a menu of optional coverage parts; you can buy the coverage parts or one coverage part depending on your risk assessment. Remember the insurance is not a replacement for sound IT policies and security strategies, but is a pivotal component in the overall strategy. Prevention is the best defense, and it is reassuring to tell the investor base you have coverage if it happens. 3

4 To better clarify what each liability entails, the following is a comprehensive list: Privacy Liability stems from the regulatory enforcement from governmental agencies over your inability to secure client, investor or employee sensitive information. The privacy laws vary by state as to the penalties and obligations imposed on a company that has suffered a privacy breach. Most states, post breach require you to monitor the credit of those affected for two years across three different credit agencies. Beyond these cedures. Not only are you ultimately responsible for your systems, but also if a third party vendor fails to secure your investor or employee information the manager is still ultimately responsible. It is important to understand what your service contracts say about privacy. Often you may see a limitation of liability within the contract and it must be negotiated to provide you with the necessary protection. Network Security covers most of the liability the manager faces out of failure to secure the network from unauthorized access, a denial of service attack or transmission of a virus. If your investors become displeased with the procedures used to secure their data, you may face gross negligence claims that would remove any Data Breach Fund covers the costs associated with a privacy breach. Possible incurred costs include: hiring forensic experts, becoming compliant with privacy regulations, provide credit monitoring services for those affected, and engaging in legal, public relations and crisis management to restore your reputation. Internet Media Liability covers litigation related to copyright and trademark infringement. It is not a very large exposure for most hedge funds due to their limited online web presence, but the cost to include the coverage is a minimal part of the overall policy. Network Extortion covers the ransom and associated expense arising out of a criminal threat to release sensitive information or bring down your network. Digital Asset Protection ty property coverage. The rest of the policy is based on liability. This is a property coverage you may expect on your commercial property policy, but the commercial property policy excludes hacks and viruses. Business Interruption and Contingent Business Interruption covers the lost revenue from downed systems as a result of a network security breach at your location (Business Interruption) or at hosted offsite third-party locations (Contingent Business Interruption). There needs to be a careful review of the hosting provider contracts for limitations of liability. 4

5 Richard A. Maloy, Jr. CIC, CRM CEO Maloy Risk Services, Inc. ABOUT US Since 1999, Maloy Risk Services Hedge Fund Practice has emerged as the leader in the industry by working with our clients, their outside counsel and the insurers to design customized solutions for Directors and Of- from our competitors. By constantly tracking and identifying industry trends from a coverage perspective, we York City, Winston Salem and Atlanta. 5