Cyber Risks in Italian market Milano, 01.10.2014 Forum Ri&Assicurativo Gianmarco Capannini
Agenda 1 Cyber Risk - USA 2 Cyber Risk Europe experience trends Market size and trends Market size and trends Kind of coverage Legal environment Loss experience 3 Sectors segmentation Ponemon Institute : 2014 Cost of data breach study in Italy Università la Sapienza - Cyber intelligence and information security center CyLab 2012 Report Segmentation 4 Risk Management Preventive measure / loss control Risk assessment 5 Overview of coverage provided Dimension of Cyber Risks Alternative products 6 Conclusion Alternative strategies available in Munich Re Group 2
1. Cyber risks USA experience US Market still have strong growth ( as cyber liability cover becomes the norm, the market will rise to something closer to USD 8 billion ) but the market is softening. US Cyber liability Market Facts 600 800 1.000 1.300 2.000 2010 2011 2012 2013 2014/2015 Gross written premium (USD mio) Source: The Betterley report (Cyber insurance market survey 2013) Forecast The market for Cyber insurance products has developed largely in response to breach notification laws which require public and private organizations to report breach information to regulators or consumer reporting agencies The primary catalyst for this reporting was the State of California, which in 2003 passed the country s first data breach (unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business) notification law As of early 2014, data breach notification laws are present in 46 out of 50 States Remarks Carriers that have been significant players in the Cyber Risk market for at least several years indicate premium growth ranged from 25% to over 100%. Most were in the 10-25% range, and only two were under 10% Growth has been dampened by some rate competition as new carriers try to gain market share Pricing model remains challenging given a lack of actuarial data There is a great deal of concern over accumulation risk, which has caused reinsurers to limit their exposure 3
1. Cyber risks USA experience US Cyber insurance allows an organization to transfer a variety of risks associated with Cyber related activities. There are two primary areas of cover: Cyber liability and Cyber Risks. 1 Cyber liability Insurance (provides coverage for liabilities that an organization causes to its customers or to others). A sizeable market exists for these products, particularly in countries that have mandatory data breach notification laws. Cyber liability insurance cover can include Data breach and crisis management Media liability Extortion liability Network security liability 2 Cyber risk insurance (is used to cover direct losses to the organization, often known as first party risk). It s less common than Cyber liability insurance. Cyber risk insurance may include some liability coverage Liability Effects of malicious code Business interruption Cyber attacks Technology errors and omissions Intellectual property infringement 4
1. Cyber risks USA experience NetDiligence Cyber liability & Data breach insurance claims study uses actual cyber liability insurance reported claims to illuminate the real costs from an insurer s perspective. Percentage of Claims by Business Sector (N=140) Measuring Costs $84m Total payout for all 88 claims $20m Largest claim payout $0,95m Average payout Source: NetDiligence Cyber Liability & Data Breach insurance Claims) Measuring costs by type of costs 13% Legal settlement 35% Legal defense 50% Crisis services: - Forensics - Notification - Credit monitoring - Legal guidance 5
2. Cyber risks Europe trends Europe growth will be positively impacted since 2015/2016 by the new legislation. Europe prospective Forecast 780 130 2012 2018 Source: AGCS Europe large accounts Gross written premium ( mio) Facts July 2014: With growing demand for cyber insurance, new policies are becoming available: Bosch Group has insured corresponding damages of up to EUR 100m July 2014: BCE has been hacked, with attackers stealing email addresses and contact data. The break-in was only discovered when the thief emeiled the bank to ask for financial compensation for the data. Jan. 2014: German federal security officials have admitted that internet hackers had stolen 16 million email passwords. Cyber criminals stole details which could compromise social media, shopping and other online services Remarks EU Commission s new rules on data will not come into force until 2015/2016; Compulsory breach notification was a key factor in the growth of the cyber risk insurance market in the US and the same might be expected in the EU following this new regime. Although cyber incidents are not covered by general liability policies, only 28% of the boards (Forbes Global 2000 companies) are reviewing insurance coverage for cyber related risks. Source: CyLab 2012. How boards & Senior Executives are managing cyber risks 6
2. Cyber risks Europe trends Changes in legal environment will push insurance demand. On the other hand some uncertainties on the coverage needs will remain unresolved until the final legislation is not in force. 1. The Regulation requires that data controllers and processors implement appropriate measures to ensure a level of security appropriate to the risk represented by the processing and the nature of the personal data protected, in light of the state of the art and the costs of implementation. 2. The draft requires that data controllers notify the supervising authority without undue delay, and where feasible, not later than 24 hours after becoming aware of a personal data breach. 3. The Regulation further provides that the data controller must inform the subject of the data breach of the incident without undue delay, when the breach is likely to adversely affect the protection of the subject s data or privacy. It provides for fines up to 1m, or 2% of annual worldwide turnover, for non-compliance. 4. The Regulation also provides that data subjects have the right to have personal data erased when no longer necessary in relation to the purposes for which it was collected, or where the data processing does not comply with the Regulation. Fines for violation of this provision range up to 500,000, or in the case of an Enterprise 1% of annual worldwide turnover. 5. Regulation provides for private rights of action for damage suffered as a result of unlawful processing of data or an action inconsistent with the Regulation. 7
3. Sectors segmentation Benchmark studies are becoming available in our market and will provide indication in respect of probability and severity of data breach occurrence. Ponemon Institute : 2014 Cost of data breach study in Italy Cost of Data Breach Probability of Data Breach (involving at least 10K records) Activities for discovery and the immediate response to the data breach, including but not limited to: 1. Investigations and forensics to determinate the root cause of the data breach, 2. Determining the probable victims 3. Preparing notice documents and other required disclosures to data breach victims and regulators Estimated probabilities have been captured from sample respondents using a point estimation technique. Chief information security officer provided their estimate of data breach likelihood for 10 levels of data breach incidents (ranging from 10.000 to 100.000 lost or stolen records) Activities conducted in the aftermath of discovering the data breach including but not limited to: 1. Legal services for defence 2. Identity protection services Costs resulting from lost business opportunities as a consequence of negative reputation effects after the breach 8
3. Sectors segmentation Benchmark studies are becoming available in our market and will provide indication in respect of probability and severity of data breach occurrence. Ponemon Institute : 2014 Cost of data breach study in Italy Remarks Probability of data breach (involving at least 10K records): Probability of data breach Higher Avarage Public sector Retail Services Hospitality Industrial Technology Financial Consumer Pharmaceutical Communication Retail companies and Public sectors organization have the highest estimated probability of occurrence. One possible explanation is the amount of confidential and sensitive information collected by these sectors combined with the lower level of security Energy and Transportation companies have the lowest probability of occurrence Cost of data breach: including both the direct and indirect expenses incurred by the organization. Transportation Lower Energy The average cost of data breach rose from 78 in 2012 to 102 in 2014 Lower Average Higher Cost of data breach Bubble size reflects the vulnerability to outliers : pharmaceutical and financial service organizations experience relatively high abnormal churn and public sector and retail organizations realize relatively low churn. Consumer product companies and financial institutions tend to have a per capita cost above the mean Services, public sector and retail companies have a per capita cost significantly below the mean 9
3. Sectors segmentation IT security level is an important indicator for a proper segmentation. Financial sector has the lowest ratio of successful attack but more or less 100% of companies have been attacked. Università la Sapienza - Cyber intelligence and information security center. Research methodology Organizations targeted The aim of this research was to provide a snapshot of the degree of risk perception and cyber security measures currently implemented in Italy The Research Center of Cyber intelligence and information security submitted an anonymous questionnaire to 68 organizations. A total of 28 fully filled-in questionnaire were collected The organizations targeted by the study where clustered in four group: 1. Public administration this group includes local administrations, central administrations and government agencies (13 entities) 2. (public) Utilities include electricity, gas, telephone and water (4 entities) 3. Financial include banks, trust companies, insurance companies and investment dealers (6 entities) 4. Industrial include mainly large IT industries and large Italian manufacturing industries (5 entities) 56,7% of these organizations have up to 10.000 employees 10
3. Sectors segmentation IT security level is an important indicator for a proper segmentation. Financial sector has the lowest ratio of successful attack but more or less 100% of companies have been attacked. Università la Sapienza - Cyber intelligence and information security center. 15% 33% 20% 77% 100% Attacked companies 75% Advanced protection 62% 75% 40% Succesfully attacked 85% 67% 80% Basic protection 25% 17% 20% 25% PA Utilities Financial Industrial Source: Università Sapienza Cyber intelligence and information security center. PA Utilities Financial Industrial Source: Università Sapienza Cyber intelligence and information security center. Remarks All financial organizations have been attacked and attacks have been successful in 17% of cases The public administration group is the one exhibiting the highest number of successful attacks 62% This should be considered as an indicator of poor security policies. Conversely, the industrial group is the least attacked. Infrastructure to detect active attacks by means of Basic protection or Advanced protection 71% of the organizations declare they own an IT infrastructure which is able to detect simple attacks. The remaining 29% of the organizations declare they own an IT infrastructure that is capable of detecting Advanced Persistent Threats (APTs1). 11
3. Sectors segmentation Assessment of the risks is necessary in order to turn research and study indications into more reliable arguments. Segmentation based upon Companies security level and commitment Remarks Security practices and policies. Security practices and policies Higher Avarage Lower Other Industries and Public administration Financial and IT / Communication Utilities and Energy sector Lower Average Higher Hardware protection level The CyLab 2012 Report confirmed the belief among security experts that: Financial sector has better privacy and security practices than other industries Respondents indicated that the financial sector paid more attention to IT and security issues. Hardware protection level. This parameter reflects the results of anonymous questionnaire submitted to 68 Italian organization sensitive to Cyber attacks. The result may provide an indication in respect of physical preventive measure applied Source: Hardware protection level - Università la Sapienza Cyber intelligence and information security center. Source: Security practices and policies - CyLab 2012 report How boards & Senior Executives are managing Cyber Risks. 12
3. Sectors segmentation IT / Communications / Financial sectors may look more than the others for an immediate risk transfer. Risk appetite should be fully driven by security level. Segmentation based upon probability of data breach and potential consequence severity High Deductibles - + Retail Public sector Limits High + Severity Too high frequency The segmentation proposed are not meant to have statistical significant, especially in terms of group representativeness. Probability of data breach Low Medium Hospitality Industrial Technology Pharmaceutical Communications Transportation Energy Services Financial Less risk transfer appetite? Rather the aim is to provide a snapshot of the hypothetical classification in terms of probability and exposures. It should be considered as a starting point for further deepen assessments. Finance, Technology and Communication sectors tends to have: the most reliable level of security policies the probability of data breach above the average value Industrial, Pharmaceutical and Healthcare might be an interesting option - Security and commitment level Lower the average 13
4. Risk management Insurance as a service. We have to built up a reliable number of partnerships in order assess and mitigate the Risks. Risk management: assess the state of an organizations cyber defenses in real time. Once a full sweep security check has been conducted, the organization can go ahead plugging any security holes. This also enables potential insurers to take a clear risk decision based on a real-time picture of the precise state of an organization's cyber security profile. Preventive measures / loss control Find a suitable partner for claims mitigation/handling: it needs to be a specialized IT company which is able to assess as from the first indication sources of breach, technological ways to keep the IT system running (avoidance of business interruption) and early communication / advise to damaged entities outside Legal Secure data storage/backup (provided as a service) Call centre services Public relation and crisis management Risk assessment Security best practices: Encryption - Physical protection - Security organization - Security training Business contingency planning: Incident management processes - Back up Responsibilities Collection strategy of personal data: Type of data Collection history Deletion of unused data Data mobility : Use of laptops Use of internet Use of external service providers Structure: Number of offices Employee mobility National/International Type of Business: Nature of business Traditional or online Reputation of Company 14
4. Risk management A different point of view, which kind of approach do we expect from potential Insured? Recommendations What should my organization do? 1 Proactively improve cyber security Improved cyber defenses help to protect against attacks and can make organizations eligible for reduced insurance premium Prepare for potential insurers to conduct a robust information security assessment of your organization in advance of writing a cyber insurance policy 2 Understand policy inclusions and exclusions Understand what cyber liability cover your organization may have already from existing policies Cyber insurance is new and policy language is not yet standardized. Inclusions, and particularly exclusions, can significantly affect the policy coverage Prepare for insurers to add cyber liability exclusions to existing policies such as Errors and Omissions, and for separate cyber insurance to be required as a result 3 Ensure sufficient coverage Existing insurance policies should be mapped to cyber risks. Only then can an organization procure coverage sufficient to meet their risks Investigate the data breach regulations of countries where your organization conducts or whishes to conduct business 15
5. Overview of coverage provided Different types of consequence from a Cyber attack, different type of coverage from primarily first-party to primarily third party. Dimensions of Cyber Risks Consequence of a Cyber incident Incident Additional costs / remediation Impact on business Legal implications 16
5. Overview of coverage provided Munich Re Group Cyber coverage could be a part of a Comprehensive Electronic Insurance up to a dedicated Cyber product. Comprehensive Electronic Insurance including software cover Extended computer policy Cyber Risk Insurance cover First party coverage Cyber liability Insurance cover Third party coverage Software Insurance Cover intends to cover losses also in case:. If an unforeseen loss or alteration of the data has occurred due to errors in operation (e.g. improper use of data media, entering a wrong command) or deliberate modification of programs or data by a third party with malicious intent (e.g. hackers) Also the new replacement value of the exchangeable data media is reimbursed Comprehensive Software Insurance Cover intends to cover for the costs incurred as a result of: Network security breach (Theft of data) and Computer virus. and may imply potentially: Loss/damage of digital assets, data, software, hardware Network downtime / lost income / Incident management costs Crisis management Reputational damage loss of intellectual property, data breach, lost customers etc Theft of money, funds and digital assets Third party liability intends to provides protection against liability arising from breaches and includes the loss of both personal consumer information and business confidential information. and may imply furthermore: Loss / breach of third party data investigation / defense and civil damages including data stored with third-party Transmission of malware Regulator action and fines Notification 17
6. Conclusion Munich Re Group is ready to provide know how, service and capacity according to the specifics needs of the Clients. We suggest dedicated meetings in order to select the best option. Benefit To do 1 Partnership with Client joint development of tailor made product Joint decisions in terms of coverage and risk appetite Joint decisions in terms of risk assessment methodologies and external services Dedicated meeting in order to evaluate which kind of product may reach better than other the expectation of the Clients Project plan and commitment 2 Cyber Risk Insurance Primarily first party coverage Ready in a short period of time Strong experience within Munich Re group Pure property coverage Insurance companies to analyze the needs of their potential Clients in order to evaluate if their expectations fit with this product 3 HSB Cyber product First party and third party coverage Dedicated Cyber risk product Consolidated experience Advanced relationship with providers of services Wider coverage Product already available in the London market for Small / Medium enterprises, needs to be adjusted for Italian environment / market 18
Thank you very much for your attention Milano, 01.10.2014 Forum Ri&Assicurativo Gianmarco Capannini