Cyber Insurance

The Basics of a Cyber Insurance Policy

by
Cyber Insurance Policy

What are the basics of a Cyber Insurance Policy?

This specialist form of policy provides coverage for internet based risks and data related exposures of a business.

It consists of third party and first party section where insurers follow a modular format, breadth of coverage varies from insurer to insurer. It is therefore important that you obtain the appropriate coverage once your cyber risks have been identified.

Cyber Insurance should not be considered in isolation and should form part of a businesses cyber risk management program.

The Basics of a Cyber Insurance Policy:-

1. Third Party Section

Network Security Liability

This provides coverage for a businesses liability to a third party as a result of the destruction of a third party’s electronic data. This also encompasses an inadvertent transmission of a computer virus to a third party.

Data Privacy Liability

This relates to liability to a third party which may cause unauthorized disclosure of personally identifiable information or corporate information.

Multimedia Liability

Your liability arising from content on your website as a result of a defamatory comment, infringement of copyright or invasion of privacy.

2. First Party Section

Network Business Interruption

This represents coverage for the interruption or suspension of your computer systems as a result of a network security breach or network failure , the later of which may not be automatically included. Insurers will reimburse a businesses and any expenses incurred in order to mitigate this.

Data Asset Protection

This provides coverage arising out of the corruption or destruction of your computer systems. The loss covered is the replacement and restoration costs.

Cyber Extortion

A threat to the computer network where a ransom has been demanded, this will include negotiation costs.

Crisis Management

Costs associated with responding to a data breach including forensic costs, credit monitoring, call center costs and public relations costs.

Vendors

In addition to the policy coverage , it is important that the insurer is able to provide “vendors” who will manage a data breach , this should include as a minimum a solicitors , a forensic investigation company and a crisis response team.

Possible extensions to a Cyber Insurance Policy:-

Certain extensions are available generally for an additional premium , such as coverage where network interruption that has been caused by an outsourced service provider or that outsourced service provider has suffered a system failure that impacts on a business.

Further extensions can include coverage where there has been a cloud service failure that affects a business and criminal reward fund that allows for a reward for information that leads to the successful conviction of a hacker.

The Policy Limit 

The policy will be on an “aggregate” policy basis, i.e. the total number of claims made in any one policy year will not exceed the annual aggregate.

The Policy Excess 

A self – insured excess will be imposed by insurers which is the first part of any claim that the policyholder will need to pay.

The business interruption module will also be subject to a separate excess which is normally an hourly figure. This section will be subject to an indemnity period , which is the period that the policy will provide coverage for this module.

Does a Professional Indemnity policy provide coverage for Cyber Liability?

Professional indemnity policies have developed in recent years to provide a broad basis of coverage know as “civil liability” It is generally accepted that this type of policy provides elements of coverage that would fall into the third party section of a cyber liability policy and are recognized as the following :-

  • Breach of privacy of third parties personal data or confidential corporate information caused as a result of a compromise of a computer system.
  • Defamatory comments placed on your website as a result of unauthorized access to your computer systems by a hacker.
  • Inadvertent transmission of a computer virus, logic bomb, worm or Trojan horse by an employee that causes damage or loss to third parties computer systems.

Professional indemnity policies have insuring clauses that are tied back to claims being made arising out of the professional business of firm however cyber liability requires a wider policy trigger such as those losses caused as a result of an unauthorized access of a firm’s computer systems.

Cyber Liability Extensions 

An number of professional indemnity insurers will provide various cyber insurance related extensions, such as hacker damage or cyber extortion, these are only normally for small sub-limits of the main policy. One point to bear in mind if cyber extensions are added to a professional indemnity policy which is on an aggregate policy basis, any claims made arising out of cyber claims will go towards the overall erosion of the overall aggregate policy limit.

Limitations

Some exclusions to take into account that may impact on the extent of cyber coverage under a professional indemnity policy are the deliberate acts and terrorism exclusions.

Not a substitute

The coverage for cyber liability under a professional indemnity policy should not be construed as a substitute for a stand alone cyber insurance policy and it is important that you seek proper advice from an insurance broker as to whether you have a requirement to purchase a cyber insurance policy.

 

10 Reasons to buy Cyber Insurance

by
cyber insurance

10 reasons to purchase Cyber Insurance – Here are some reasons why businesses should consider this form of insurance.

In arriving at the decision to purchase cyber insurance a business will need to carry out a full cyber risk management analysis detailing vulnerabilities and how the businesses wishes to manage their cyber exposures which may impact on its day to day trading activities.

Once this has been determined the outcome to purchase cyber insurance could be driven by the following factors :-

1.Balance Sheet Protection

Helping to help mitigate a catastrophic compromise of computer systems and network that may endanger the livelihood of a business.

2.Risk Transfer Mechanism

To cover cyber security risks that cannot be managed within the business or where the businesses chooses to insure these rather than to retain.

3.Management “Sleep Easy”

Due diligence assurance for the Board of Directors and members of staff that there is a “layer” of coverage outside of the cyber security measures that are already in place.

4. Contractual Requirements

Coverage may be required by clients being part of contractual obligations to trade with a business. Businesses entering into government contracts are required in some instances to purchase cyber insurance. This requirement is likely to increase within the business community.

5.The Regulatory Environment

The forthcoming General Data Protection Regulation will impose compulsory notification of all data breaches and regulatory scrutiny.

6. Own Experience of a Cyber Attack

A business who has already suffered from a cyber attack my require comfort going forward from the coverage provided by this specialist form of insurance.

7. Substitute for further Security Spend

Cyber insurance could be seen as a lower cost alternative rather than investing further in cyber security within the business.

8 Competitive Advantage

The purchase of this form of insurance should sit alongside Cyber Essentials and ISO 27001 accreditation and a sign to other businesses that cyber exposures are taken seriously to its clients.

9. Business Continuity

Help to get a business up and running again post breach to cover increased cost of working and loss of profits so that they maintain their trading position in their business sector.

10. Vendor Proposition

The vendor proposition included under a cyber insurance policy provides post breach legal services , forensic investigation and public relations consultancy.

Cyber insurance is an evolving form of insurance with policy coverage developing on a regular basis. The coverage provided by the insurance market does vary considerably, with over 30 insurers to choose from , it is important that you utilize the services of an insurance broker who possess the requisite knowledge and expertise to guide a business through the coverage options and has the influence within the market to negotiate bespoke policy wordings.

Cyber breaches hit UK businesses

by
Ransomware

Cyber breaches are hitting UK businesses according to a recently released commissioned report by the UK Government.

Two thirds of large businesses UK hit by cyber attack in past year

Following the high profile targeting of  TalkTalk , Vodafone , Weatherspoons it is no surprise that large businesses are still the focus of cyber breaches …… the underlying message to these businesses is that they need to improve their cyber security programs in order to combat these threats.

Main Report Findings

  1. 1 in 4 large businesses encountered a breach once a month
  2. Only one-third of all firms had a written security policy
  3. Only 10% of all businesses had an incident response plan in place should a cyber attack occur
  4. 13% of all businesses set cyber security minimum standards for their suppliers
  5. Only 20% of firms validate the providers of cloud computing services.
  6. 7 out of 10 of the attacks involved compromises by viruses, spyware or malware

Why has this happened ?

The report also highlighted the fact that many firms do not have cyber security programs in place that are in accordance with government guidance such as the Cyber Essentials Scheme and the “10 Steps Guide to Cyber Security”. This is must be a major concern to the Government as these two measures alone would install a good level of cyber security.

Cyber Essentials is generally more difficult to achieve for larger businesses as their systems tend to involve the use of bespoke software and its management. This certification is geared more to standardized systems which is more akin to SME’s . There is therefore a question here whether Cyber Essentials needs to be adapted to larger businesses?

Cyber Insurance

The report also makes reference to 37% of firms having in place some form of cyber insurance , this is either in the form of extensions to professional indemnity insurance policies or stand alone policy specific cyber insurance policies.

A concern raised by the report is that there is a lack of knowledge about what was covered under a cyber insurance policy and the insurance industry therefore has a role to play in helping businesses understand this form of insurance.

Cyber breaches will continue to impact on businesses unless they have a formal cyber security program in place to protect them from the increasingly sophisticated cyber attacks that can compromise a businesses.

Panama : The Cigar is Still Smouldering…

by
Panama

Up until recently Panama was associated with a canal , hats and cigars…..it is now known for one of the biggest data breaches ever known – the Panama Papers.

What are the Panama Papers?

These are a leaked set of 11.50 million confidential documents that provide details of approximately 214,000 offshore companies listed by Panamanian law firm Mossack Fonseca. This information contained identities of shareholders and directors of these companies and showed the wealth of high profile individuals , including the assets that were hidden from the public. Individuals included past and current heads of states, government officials and celebrities from over 40 countries. Investigations have now determined some of the companies may have been utilized for various illegal purposes.

The Panama Papers far exceeds the previous highest data breach record previously held by Wikileaks by 1500 times.

How did this happen?

An anonymous source know as “John Doe” passed the documents to German newspaper Suddeutsche Zeitung which it is understood commenced at the beginning of 2015. The quantum of data involved was 2.6 terabytes which is a vast amount of data In view of the amount of data involved the newspaper recruited the assistance of the International Consortium of Investigative Journalists (ICIJ) which distributed all the documents so that they could be investigated by various journalists and media organizations around the world. The first documents were published on 3rd April. The ICIJ will issue a full list in May of all the companies involved.

What was the cause of this huge data leak ? 

There are a number of different schools of thought as to whether this was due to an insider or outsider hacker attack , but one thing that is certain is that Mossack Fonseca did appear to have very poor cyber security procedures in place.

This has been evidenced by some of the following cyber security flaws that have since been discovered:-

  • The Outlook Web Access login had been utilized since 2009 with the client login not being updated since 2013
  • The computer systems included a high risk SQL injection vulnerability that allows anyone to remotely execute arbitrary instructions.
  • The main computer system included a version of WordPress that was three months out of date.
  • Configuration of the website was not recognized as best practice.
  • Mossack Fonseca’s e-mails were not encrypted
  • The systems were vulnerable to external scanning and possible exploitation

With the amount of data involved it is believed that it took about one year for the data to arrive at its destination. It is a wonder that no one noticed this amount of data leaving the company ? Interestingly enough very few US citizens were listed in the papers , which may be due to the fact that the US does have different corporate tax structures which negates the need for offshore tax arrangements.

www.wired.co.uk   The security flaws at the heart of the Panama papers

Why was Mossack Fonseca targeted ?

Legal firms hold a great deal of data on their clients including copies of personal data , confidential documents and legal transactions which does make them a prominent target for hackers. A high profile legal practice such as Mossack Fonseca involved in the areas that they practiced in therefore represents an ideal victim to a hacker.

With the poor cyber security procedures in place it does perhaps suggest that this data compromise may have come from an insider hacker who knew the computer systems and perhaps an employee with a point  to make or an overarching grudge.

Reputational damage is also a consequence of a breach of this nature , another possible reason for the this attack. which sometimes causes irreversible damage to a firm.

What could have prevented this data breach? 

In the current climate no one business or individual is 100% secure from a cyber security breach but certain procedures seemed to be absent from what would be expected to be standard cyber security risk management procedures:-

  • Prioritising  of cyber security
  • Regular patching of software
  • Updating of software
  • Regular login updating
  • Encryption of all sensitive documents
  • Website security

How Cyber Insurance could have helped ? 

A cyber insurance policy can provide the following coverage.

  1. Data breach costs incurred including notification costs to the appropriate regulatory bodies
  2. Regulatory costs and investigations that may arise as a result of the breach
  3. Post breach costs including investigation and forensics costs incurred to monitor and analyse the data breach which would help identify the cause of the incident.

The proposal for cyber insurance also requires certain minimum security measures to be in place at the onset prior to the policy incepting , the purchase of a cyber insurance policy therefore may have help Mossack Fonseca focus on certain areas of cyber security that may have prevented the hacker to penetrate their computer systems.

From the wider perspective the insurance market is assessing its exposure by gathering data from insurers and reinsurers in order to ascertain the consequences of this loss to the industry. One thing for sure is that insurance coverage would not respond to any illegal activities.

General Data Protection Regulations

Despite being passed the GDPR are not yet in force , but what would have been the ramifications of this on Mossack Fonseca.. ? These rules will apply to entities that carry out business with companies based in the EEC , whether the complicated legal structures put in place by Mossack Fonseca would have implicated by this is difficult to tell , but fines of 4% of annual global turnover or E20,000,000 , which ever is the less would apply if this was the case.

Lessons to be learned 

  • Robust cyber security measures and procedures are paramount to a business armoury in protecting their mere existence.
  • Law firms will be alerted to this data breach and with recent attacks in the US , this sector is clearly currently a target for hackers
  • Cyber Insurance can help improve cyber security and mitigate the effects of a data breach

The biggest data breach ever experienced is still being uncovered, further revelations will no doubt come to light in the coming months… the cigar is still smoudering.

 

Malvertising…..the hidden threat

by
Malvertising

Malvertising …… the hidden threat – last week a number of major news websites saw their advertisment hijacked by a malicious angler campaign that attempted to install ransomware on users computers. The attack, which was initially targeted at US users, hit websites including the BBC, AOL, New York Times and the NFL ……the combined volume of traffic for these websites totalled billions of visitors.

http://www.theguardian.com/technology/2016/mar/16/major-sites-new-york-times-bbc-ransomware-malvertising

It is understood that the malware was delivered through multiple ad networks, and used a number of vulnerabilities, which included a recently-patched flaw in Microsoft’s former Flash competitor Silverlight.

The Daily Mail , Skype and and the Premier League Fantasy website have all been targeted within the last month with malvertising campaigns.

Malvertising uses advertising networks to spread malicious flash objects and other pieces of malicious code to other websites. Hackers will then upload these malicious flash objects and other pieces of malicious code to ad networks, paying the network to distribute them like as if they are real advertisements.

For example you could visit a newspaper’s website and an advertising script on the website would download an ad from the ad network. The malicious advertisement would then in turn try to compromise the web browser.

Malvertising takes advantage of flaws in software that the user is utilizing in order to infect the user on a legitimate websites, this reduces the need to fool the user to visiting a malicious website.

The most popular times for these attacks are on a Friday when there is less monitoring being carried out for suspicious activities and when there is heavy web surfing during the weekends.

There are a number of methods used for injecting malicious advertisements or programs into webpages such as :-

  • Pop-up ads
  • Drive by downloads
  • Web widgets
  • Malicious banners on websites
  • Third party advertisments on websites
  • Third party forums such as forums or help desks

There are a number of ways of protecting websites from malvertising attacks such as keeping plug-ins and web browsers updated. Risk management also has an important role to play in particularly management and surveillance of the supply chain.

A cyber insurance policy can provide coverage for an attack of this nature through the disruption it may cause to a business and also the vendor services provided via monitoring and forensic investigation.

Cyber Security risks face education sector

by
cyber security risks

Is the education sector facing cyber security risks?

In the US last week a hacker broke into the University of California’s computer system which contained 80,000 students. This apparently occurred in December whilst the university was in the process of patching a security flaw in their financial management system.

University of California

This followed a similar breach earlier this year at the University of Florida where private information of current and former employees were accessed going back to 1980. A lawsuit has been issued which is seeking a class action status. There was also criticism on how the breach was managed.

On this side of the Atlantic in December university students were unable to submit work as a result of the academic computer network called “Janet” coming up against a distributed denial of service (DDOS) attack causing reduced connectivity and disruption. The University of Manchester was one of the universities impacted by the DDOS attack.

Earlier, last year the University of London Computer Centre (ULCC) was hit by a cyber attack which again left millions of students unable to access the organisation’s IT services. The centre provides services to over 300 UK institutions and supports over two million higher education and further education students on its open-source learning platform Moodle.

The education sector accounted for nearly 10 per cent of all breaches in the past year, according to cyber security company Symantec.

Symantic Internet Threat Report 2015

Personal Data

Universities and colleges contain an abundance of personal data which makes them attractive to hackers, such as credit card details, medical information of current and former students and employees. This also becomes complicate to manage as students come from many different parts of the world bringing with them wide ranging data protection regulations.

Multiple Entry Points

The education sector traditionally provides multiple entry points with a huge spectrum of users having access to its networks. The access is also available 24/7 365 days a year via many devices that may not be secure such as laptops logging in from remote wi-fi locations.

Social Media

Within the education framework social media features prominently and in the absence of social media policies with specific standards in place this can leave a university vulnerable in terms of the inadvertent sharing of information that may not be meant for the public domain.

Separate Networks

A college or polytechnic may consist of a number of separate networks which may not contain a high level cyber security and therefore present a number of cyber security risks.

Intellectual Property

Certain establishments contain highly sensitive research information in the fields of science, health , defense  and aerospace. This could make them a target for hackers and terrorist organisations.

Cyber Security Research

Cyber security research itself could also be a target with the Global Centre for Cyber Security Capacity building  in Oxford University’s Martin School. A number of universities have been awarded Academic Centres for Excellence in Cyber Security Research, such as the Bristol and Kent Universities which means that they will work more closely with the Government Communications Headquarters (GCHQ).

Cyber liability insurance can play a very important role in supplying an extra layer of comfort in the event of a cyber attack to education establishments, providing coverage for a significant number of the potential cyber security risks that exist in this sector.