Cyber Risk Network @cyberrisknetwork - Tumblr Blog

Average cost of cyber breach claim is $674K: study

The average cost of a cyber breach in 2015 was nearly $674,000—for now, according to NetDiligence’s latest cyber claims study.

Revealed at its Cyber Risk & Privacy Liability Forum here, the claims study is based on a sampling of 160 cyber liability claims, with a claim range of zero to $15 million. Claims involving the loss of records containing personal identifiable information made up the most (45 percent). Nearly a third involved hackers.

NetDiligence said the dataset, received from about 20 insurers, includes some claims that have not yet been paid. The average could rise to $1.1 million assuming self-insured retentions are met.

Read more at http://www.cyberrisknetwork.com/2015/10/07/average-cost-of-cyber-breach-claim-is-674k-study/

#cyber breach #cyber claims study #cyber liability claims #netdiligence #symantec

No LOL’ing matter: Cyber “war kittehs”

Combining the Internet’s love of cats and lack of concern for data security, one cyber researcher has come up with an adorable, furry way to show silly humans that their Wi-Fi connections can easily be hacked and potentially misused. If you’re confused by this blog post’s headline, “kitteh” is Internet for “cat.” It may seem pointless to actually add letters to a word as a form of shorthand or a nickname of sorts, but much of the Internet is, indeed, pointless.

However, the Internet is also where we all keep some fairly important information and as security researcher Gene Bransfield explained during a Defcon speech (video here), a not-insignificant number of people take no pains to properly secure their Wi-Fi connections from lurking hackers, digital miscreants, and/or roaming neighborhood cats.

Read more at http://www.cyberrisknetwork.com/2015/10/08/no-loling-matter-cyber-war-kittehs/

#cyber #data security #cybersecurity #cyber warfare #cyber war #internet cats #war kittehs

Insurance industry playing ‘catch up’ on cyber: Swiss Re’s Petrilli

The Executive Risk Network caught up with Bob Petrilli, CEO of North America for Swiss Re Corporate Solutions, to get his take on some of the current and emerging risks facing executives.

What do you see as the greatest risks facing executives?

Today, executives face myriad challenges. Most fall into the category of “Reputational Risk.”

Cyber liability is certainly a major reputational risk, and one that needs a lot of attention, but reputational risks go far beyond cyber.

Read more at http://www.cyberrisknetwork.com/2015/09/22/insurance-industry-playing-catch-up-on-cyber-swiss-res-petrilli/

#insurance industry #executive risk #executive risk network #fraud #risk #bob petrilli #swiss re #cyber #fcpa #petrilli #reputational risk

7 Cyber Risk Stakeholders and Why They Matter

Imagine you’re the CFO at a firm involved in sensitive M&A discussions with your bankers and you receive an email asking for a small bit of non-public information on your company, the kind you’ve passed on before. You send the information—and later find you were the victim of a sophisticated cyber-attack.

Now imagine you’re in charge of operations at a manufacturing facility. Out of the blue, your employees report that they have lost control of key systems. It’s impossible to shut down a blast furnace correctly, endangering the safety of employees and others and threatening massive damage. You, too, have been the subject of a cyber-attack.

These events underscore the new reality in cyber risk management: It is no longer just an IT issue. Everyone—from individual employees to risk managers to your board of directors—now has a stake in managing cyber risk comprehensively, across the enterprise.

Read more at http://www.cyberrisknetwork.com/2015/09/24/7-cyber-risk-stakeholders-and-why-they-matter/

#cyber risk stakeholders #cyber risk #cyber attack #cyber insurance #cyber risks

First Half Data Breaches up 10 Percent Over Last Year: Gemalto

According to digital security firm Gemalto, data breaches during the first half 2015 increased 10 percent compared with the same time period a year ago.

“What we’re continuing to see is a large ROI for hackers with sophisticated attacks that expose massive amounts data records. Cyber criminals are still getting away with big and very valuable data sets. For instance, the average healthcare data breach in the first half of 2015 netted more than 450,000 data records, which is an increase of 200 percent compared to the same time last year,” said Jason Hart, vice president and CTO for data protection at Gemalto.

The findings from the Amsterdam-based firm’s Breach Level Index for the first six months of 2015 reveals 888 data breaches occurred, compromising 246 million records worldwide—a decline of about 40 percent from the 2014 first half.

Read more at http://www.cyberrisknetwork.com/2015/09/11/first-half-data-breaches-up-10-percent-over-last-year-gemalto/

#gemalto #data breaches #healthcare data breach #cyberattack

Microelectronics: Small Tech, Big Risk for Businesses and Insurers

As technology gets smaller, the risks of an equipment breakdown get bigger.

The micro-circuitry in today’s electronics, which is thousands of times smaller than a human hair, makes it difficult or impossible to see the damage when equipment fails.

Because equipment is increasingly interconnected through the Internet, a breakdown can affect operations at multiple locations and result in a costly business interruption.

And technology changes so fast that damaged equipment quickly becomes obsolete, which often requires a replacement instead of repair when components are no longer available.

Read more at http://www.cyberrisknetwork.com/2015/09/01/microelectronics-small-tech-big-risk-for-businesses-and-insurers/

#microelectronics #micro circuitry #micro-circuitry #big risk for businesses #big risk for insurers #risk #insurance coverage

Gender Diversity on Boards Grows Organically If Slowly in US

While countries like Germany legislate against all-male company boards, the US chips away at the status quo without government quotas or targets.

“It’s easy to say, put a woman on the board,” said Charlotte Laurent-Ottomane, executive director of Thirty Percent Coalition and former executive vice president at Alcatel-Lucent. “We want a qualified woman.”

Read more at http://www.advisenltd.com/2015/08/26/board-gender-diversity-grows-organically-if-slowly-in-us/

#gender diversity #board gender diversity #catalyst #uk boards #us boards #women on boards

http://bit.ly/YvqOeR Cyber news discusses the latest cyber risk issues facing the insurance industry. Read about cyber regulation, cyber insurance trends, hactivism, cyber solutions and more.

#cyber insurance news #cyber risk news #cyber news #cyber solutions #cyber risk #cyber insurance

Wyndham Wake-Up Call: Become Cyber-Resilient Now

Virtually all organizations face of two daunting, unwavering facts: (1) cyber attacks will occur despite the best security; and (2) regulatory scrutiny in the wake of attacks is escalating, not lessening. (As to the first, it is abundantly clear that network security alone will not prevent all attacks; no firewall is unbreachable, no security system impenetrable.

An organization can have the best firewalls, perimeter security, end-to-end encryption, and updated antivirus software, but there will remain, among other things, a human element that is so difficult to control. As to the second, organizations face increasingly heightened regulatory scrutiny in the wake of attacks, as illustrated by the Wyndham case.

Although organizations can neither achieve fail-safe security, nor entirely insulate themselves from legal liability and regulatory scrutiny in the wake of an attack, they can become cyber-resilient and education is a critical step in that process. The Third Circuit’s decision in Wyndham underscores the necessity of education in becoming cyber-resilient.

Read more at http://www.cyberrisknetwork.com/2015/08/27/wyndham-wake-up-call-become-cyber-resilient-now/

#wyndham #wyndham case #cyber resilient #cybersecurity #federal trade commission #ftc

Appeals Court Fives FTC Another Win Against Wyndham

The US Federal Trade Commission was again told it has the authority to regulate cybersecurity practices.

In a case spanning more than three years, a US Circuit Court of Appeal in Philadelphia unanimously upheld an April 2014 ruling in district court and clears the way for the FTC to pursue a lawsuit against hotel operator Wyndham Worldwide related to three cyber breaches in 2008 and 2009.

It is the first major appellate court to weigh in on the issue of whether the FTC has authority to regulate corporate cybersecurity under Section 5 of the FTC Act. But the outcome was not necessarily surprising.

Read more at http://www.cyberrisknetwork.com/2015/08/24/appeals-court-gives-ftc-another-win-against-wyndham/

#federal trade commission #ftc #wyndham #cybersecurity practices #cybersecurity #cyber risk

Target Litigation Reveals Concern Hackers May Use Court Documents to Gain Information

Hackers have shown themselves to be resourceful in gathering information that allows them to commit their crimes. We have seen hackers use employees and other “out of wallet” information to gain access to data. Recent developments in the Target litigation provides a reminder that hackers may also use documents filed in court in data breach cases to commit crimes.

On July 24, 2015, the Financial Institutions in the Target 2013 data breach case (In re: Target Customer Data Security Breach Litigation) filed a Motion To UnsealCertain Documents Cited In And Attached To Plaintiff’s Motion For Class Certification. In the Motion, the Financial Institutions claim that “Target has taken the position that every document it has ever produced in this case is ‘Confidential’ or ‘Highly Confidential’ and should be concealed.” The current dispute stems from a Protective Order entered by the court on June 25, 2014, that allowed the parties to designate certain documents as “Confidential” or “Highly Confidential.” Of course, under this Protective Order, any document marked “Confidential” would not be accessible through the court’s electronic filing system. In its Motion, the Financial Institutions argue that it has not been able to locate a single document produced by Target that hasn’t been designated as confidential.

Read more at http://www.cyberrisknetwork.com/2015/08/19/target-litigation-reveals-concern-hackers-may-use-court-documents-to-gain-information/

#target litigation #target #target 2013 data breach #data breach #data breach cases #data breach litigation

Pressure on CISOs Increases Amid Few Resources, Deloitte Says

Chief information security officers (CISOs) face new pressures every day to safeguard data and critical assets against increasing cyber threats as well as new regulatory scrutiny, according to a new report from Deloitte.

As their job requirements multiple, CISOs find that resources and funding to address security problem do not always materialize, Deloitte research indicates. In addition, the firm found that ineffective communication and reporting can stymie proper information security efforts, as can lack of support from other executives.

Read more at http://www.cyberrisknetwork.com/2015/08/13/pressure-on-cisos-increases-amid-few-resources-deloitte-says/

#cisos #ciso #chief information security officers #chief information security officer #cyber threats #deloitte #cyber risk

Hacking in the Headlines

With the recent hack of online affair website Ashley Madison, cyber-crime is in the spotlight. However, it’s been an issue plaguing both companies and users for many years and one that shows no signs of halting.

Thanks to the increased fame of ‘hacktivists’ like the group Anonymous, who use hacking as a social justice tool, hacking is sometimes regarded as a method of extracting justice on corporations the public can’t touch.

Such is the case for Ashley Madison, who are now suffering a backlash that hinges on the negative perception of their website. To most, the hack is justified because their site promotes affairs.

Unfortunately, the idea of hacking being pro-public couldn’t be further from the truth. Despite high profile hacks against governments and businesses, the customer and average home user is still the main victim of cyber-crime. This was highlighted in 2014 when eBay was hacked and users had to change their passwords to prevent their accounts from being compromised.

Read more at http://www.cyberrisknetwork.com/2015/07/28/infographic-hacking-in-the-headlines/

#hacking #cyber crime #cybercrime #hacktivists #social justice tool #hack #hacking infographic #infographic about hacking

Opinion: Technical Aspects of Lloyd’s Cyberattack Blackout Scenario Flawed

The Lloyd’s report on cyber implications of the electric grid serves a very important need to understand the insurance implications of a cyber attack against the electric grid. There have already been more than 250 control-system cyber incidents in the electric industry including 5 major cyber-related electric outages in the US.

There have been numerous studies on the economic impact of various outage durations, but they have not addressed issues associated with malicious causes. Consequently, there is a need to address the missing “malicious” aspects of grid outages. Unfortunately, I believe the technical aspects of the hypothesized attack in the Lloyd’s study are too flawed to be used.

According to the Lloyd’s report, “the Erebos (the name Lloyd’s assigned to the malware in its hypothetical) Cyber Blackout Scenario is an extreme event and is not likely to occur. The report is not a prediction and it is not aimed at highlighting particular vulnerabilities in critical national infrastructure. Rather, the scenario is designed to challenge assumptions of practitioners in the insurance industry and highlight issues that may need addressing in order to be better prepared for these types of events…. On the given day, the malware is activated and 50 generators are damaged in rapid succession.”

Read more at http://www.cyberrisknetwork.com/2015/07/16/technical-limitations-of-lloyds-cyberattack-blackout-scenario-report/

#cyberattack blackout #lloyds #cyberattack blackout scenario #cyber attack #cyber blackout #cybersecurity risks #cybersecurity

Dealing with the Digital Con: Social Engineering Takes Businesses for a Ride

Social engineering goes by different names and comes in a variety of guises, but every single scam involves criminals tapping into personal emotions in order to create real commercial harm for organizations.

We’ve all heard of the classic email scam. A Nigerian prince sends an urgent mail requesting assistance in transferring millions of dollars – some of which can be yours! – and swindles the trusting email recipient into offering up some of their own funds. However, cyber criminals now have a new mark and they’ve become more sophisticated than ever, prompting a look at the insurance coverage available in the market for a risk that insurers say is only expanding.

Social engineers targeting businesses avail themselves of the vast amounts of public information online via LinkedIn, Twitter, Facebook, financial statements, and corporate websites in order to gain the confidence of employees, usually in the accounting department, and convincing them to release funds to a third party. Classic examples include an email from a company chief financial officer requesting wire transfers for business purposes.

Read more at http://www.cyberrisknetwork.com/2015/06/26/dealing-with-the-digital-con-social-engineering-takes-businesses-for-a-ride/

#social engineering #scam #social engineers #cyber liability #cyber masquerading #cyber insurers

All Imaginary Cyber Catastrophes Point to Cyber-Data Sharing

A new report from Lloyd’s and the University of Cambridge’s Centre for Risk Studies is the result of a hypothetical, very unlikely but entirely possible scenario in which a cyberattack cuts power to much of the US Northeast.

Insurers would take a huge hit—an estimated $21.4 billion—which is just a fraction of the total loss to the US economy of about $243 billion. And those are numbers from the low end of loss ranges in the report.

Imagine cyber hackers inject some malware that goes undetected until one day when it looks to take control of electric generators, finding 50 that it can control, overload and cause some fires and explosions. Ninety-three million people in 15 states and Washington DC are in the dark for various amounts of time. Water is cut off for many; ports are shut down; infrastructure collapses; people die.

The report, Business Blackout, attempts to assess which lines of business would be affected by such a terrible set of events. A total of 32 lines are exposed to claims—with commercial, commercial facultative, energy, general liability, trade credit and cyber property seeing major increases in claims.

Read more at http://www.cyberrisknetwork.com/2015/07/08/all-imaginary-cyber-catastrophes-point-to-cyber-data-sharing/

#lloyd #cyber attack #cyber catastrophes #cyber data sharing #business blackout

Insured’s Employees Often Overlooked When Insurers Assess Cyber Coverage

In assessing the risks related to cybersecurity, insurers have closely examined the technology put in place by insureds to safeguard data or other private information. This is because privacy and data security tend to focus on sophisticated hackers in other countries that have the latest technology at their disposal.

While professional hackers, hacktivists and terrorists undoubtedly pose an enormous threat, we have recently seen an uptick in the number of data breach stories involving employees. At present, it appears an insured’s technology is only as good as the training provided to an insured’s employees.

Just last week, it came out that employees with the St. Louis Cardinals hacked into the network of the Houston Astros. Even if the Cardinals organization had no knowledge of the hacking, the allegations against its employees still puts the Cardinals in the hot seat.

Read more at http://www.cyberrisknetwork.com/2015/07/02/insureds-employees-often-overlooked-when-insurers-assess-cyber-coverage/

#employee cyber theft #employee theft #cyber coverage #cybersecurity #data breach #hacking #tressler

Trending Blogs

Recently Viewed Blogs

Cyber Risk Network