Embracing Cyber Risk: Insurance Solutions

Size: px

Start display at page:

Download "Embracing Cyber Risk: Insurance Solutions"

Vanessa Parrish
7 years ago
Views:

1 Embracing Cyber Risk: Insurance Solutions ANZIIF Risk Rendezvous 15 Ian Pollard, Managing Director, Delta Insurance New Zealand Limited

2 Agenda Risk Management Risk Transfer and Insurance Cyber attacks + case studies Conclusion Questions

3 Risk Management

4 What can companies do to protect themselves? Public / Private Cooperation Risk management Cyber risk protection

5 The best practices in Cyber Risk Management What Cyber Underwriters look for People Processes Technology

6 Risk Transfer and Insurance

7 Risk Factors and Risk Transfer Insurance solution for first party/third party coverage First Party Risks Business interruption Crisis response Network extortion Data forensic expenses Data restoration costs Cyber theft/crime Damage to physical assets Public relations costs Notification costs Credit monitoring ID monitoring Third Party Risks Civil claims for damages Personal Information Civil claims for damages Corporate & Confidential Legal support/defence Fines & penalties Regulatory actions Online Media Liability Social Media Liability

costs Notification costs Credit monitoring ID monitoring Third Party Risks Civil claims for damages Personal Information Civil claims

8 Risk Factors and Risk Transfer Vendors and Crisis Management PR Support Legal Support Forensic & IT Support Notification & Crisis Support Reputational damage Breach coaching / Initial Response Data restoration Call centre Crisis management Regulatory and defence costs Forensic support Notification and mitigation Security support ID theft and resotoration Technology Support Credit monitoring

Data restoration Call centre Crisis management Regulatory and defence costs Forensic support

9 Risk Factors and Risk Transfer 3rd party cyber risks - gaps in traditional insurance

10 Risk Factors and Risk Transfer 1 st party cyber risks - gaps in traditional insurance

11 Cyber attacks and case studies in New Zealand

12 International Cyber Attacks / Data Breaches

13 Cyber Attacks / Data Breaches in NZ

14 Case study 1: SME Example of a common office-based claim paid under Cyber Insurance policy in NZ Background - Professional services firm with real-time anti-virus software - Good risk management and preventative measures Incident - Virus infection spread through network - IT service provider initially unsuccessful in eradicating virus - Finally eradicated by wiping and reinstalling all computers Exposure and Insurance Coverage - Services costs, costs for restoring data, business interruption, loss of revenue Total Loss $50,000+

network - IT service provider initially unsuccessful in eradicating virus - Finally eradicated by wiping and reinstalling all

15 Case study 1: SME Breakdown of potential loss Total Loss $50, $30,000+ data restoration and forensic fees - $20,000 estimated network loss

16 Case study 2: Retailer Global cosmetic retail chain suffers from a hack-attack Background - Retailer with 600 stores in 43 countries including NZ, USA, Canada, Australia - Online trading presence Incident - Hackers breached websites and stole customer billing information - NZ and Aus websites shut down for 2 months; 39,000 customers notified Exposure and Insurance Coverage - Business interruption, liability, PCI fines, notification costs, reputation, IT / Forensic Total Loss $2.5 million

customer billing information - NZ and Aus websites shut down for 2 months; 39,000 customers notified Exposure and

17 Case study 2: Retailer Breakdown of potential loss Total Loss $2.5 million Loss of $1m+ website down + lost reputational revenue - Liability, Regulatory fines and penalties, defence and $900k ($25 per customer) Other $300k+ - PR $20k - Call Centre $15k - Customer Notification $39k - PCI Assessments/Card re-issuance $195k - Forensics Investigations $20k - Data Breach legal guidance $15k

and penalties, defence and damages @ $900k ($25 per customer) Other Costs @ $300k+ - PR $20k - Call

18 Case study 3: NZ-based Gambling Site DDOS cost site millions of dollars Background - Crashed multiple times on Boxing Day Punters unable to place bets online, resulting in loss internet revenue - Previous Christmas week $10m online Incident - Cyber attack connecting multiple times to try to expose a flaw in system - Potentially opens up access point to data Exposure and Insurance Coverage - Network interruption & increased costs, forensic and IT costs, reputation, data loss, PCI fines, liability & legal costs Total Loss $7-10 million

multiple times to try to expose a flaw in system - Potentially opens up access point to data Exposure and Insurance Coverage - Network

19 Case study 3: NZ-based Gambling Site Breakdown of potential loss Total Loss $7-10 million Network interruption and increased costs - Revenue over period $5m-$7.5m - Increase costs would have been around $1.5m-$2m Other Costs in this event could include: - PR $250k+ - Liability & legal costs remains to be seen (business customers / lost data?) - Upwards $500k+

5m - Increase costs would have been around $1.

20 In summary

21 Benefits of Cyber Liability Insurance - Comprehensive coverage for cyber-related incidents - Addresses loopholes in existing coverage lines - Growing necessity with dependence on technology - Becoming one of the most relevant coverage lines - Affordable premiums with high customer satisfaction - Insurers Beware! - Claims In NZ Estimated 100% + LR - Fitch Report - Aggregation Concerns Global Event? - Legislative changes - impose greater penalties / costs

23 Any questions?

RISKY BUSINESS SEMINAR CYBER LIABILITY DISCUSSION

RISKY BUSINESS SEMINAR CYBER LIABILITY DISCUSSION October 23, 2015 THREAT ENVIRONMENT Growing incentive for insiders to abuse access to sensitive data for financial gain Disgruntled current and former