BEA Presentation

BREACH EDUCATIONA L L I A N C E

Breach Education Alliance:
Integrated Team Approach With Complementary Resources
Legal
Insurance
Reputation
Mngmt
Security
IT Network
2
Your
Organization

Best Practices; Retrospect from a Breach Investigation
Parameter Security

Goals of a Successful Investigation
Did an incident
Occur?
Scope of Incident Cause of Incident Assess Damages
Activate BC/DR? Consider further
Actions

Not all Malicious
Malicious Attackers
50% - 60% are internal attackers
Malicious Attacks less than 10% of all security incidents
4%
6%
90%
Security Incidents
External Internal Accidents

Goals of a successful Investigation
• Lack of Baseline
• Lack of Corporate Policies
• False-Positives
Did an incident
Occur?
Scope of the
Investigation
• Does it affect Confidentiality, Integrity, Availability?
• Is disclosure required?
• Will 3rd parties aid in the investigation?

• Was the cause internal or External?
• Did a person cause it?
• Was it Malicious?
Determine Cause
Assess Damage
• How does the incident affect Business Operations?
• Will the investigation affect Operations
• Will Business Operations impede the Investigation / Destroy
Evidence

• Take Legal Action
• Report Incident to 3rd Party
• File an Insurance Claim
• Learn from the incident and plan
Activate BC/DR
Further Actions
• Did the incident inhibit/Cease Operations?
• Has the Integrity of data been compromised?
• Has your TCB been Compromised?

Lack of knowledge of Environment
The most common mistake
 How can you identify malicious activity, if you don’t know
what legitimate activity looks like?
 Inventory software, devices and other assets.
 Software updates often fix security problems, so download
updates as soon as they become available.

Use strong Passwords or Password Phrases
 “Mary had a little lamb”.
The space bar is a unique character!
 Easy to remember, don’t have to write them down and unique to everyone!

Train your employees …
 They need to be aware of Phishing and email traps, links, downloads.
 Security Awareness training is critical.

Understand your business…
 Key areas:
• Where are you vulnerable? What IP does your company have?
• What threats should you be aware of?
• What impact would these threats have on your business?
• What does potential Regulatory Compliance require of you?
• Establish risk thresholds or tolerance levels. Will you Mitigate, Accept
or Insure those risks.

Questions / Contact Information:
John Poole
Parameter Security
Penetration Assessments | Forensics/IR | Compliance Assessments | Instruction
www.ParameterSecurity.com
John.Poole@ParameterSecurity.com
Direct: 314.442.0472 x503 | Mobile: 636.579.4393
14

Complex Issues – Here to Stay
CyberGroup/cybersecurity/data breach/privacy™
CyberGroup
cybersecurity/data breach/privacy™

Complex Issues — Here to Stay
 Sophisticated Threats, Evolving Technology, Internet of Things
 64% increase—information security incidents 2015 vs 2014
 Healthcare—frequently attacked industry
 Ransomware attacks
 100 million healthcare records compromised 2015 (credit card, email, SSN, employment, med history data)
 High price on black market “dark internet”
 Cyber thieves use data to launch spear phishing attacks, commit fraud, steal medical identities
 But no industry immune—
 Manufacturing (automotive. chemical. corp. IP networks)
 Financial Services (consumer banking, mobile apps)
 Government (IRS and HHS breaches)
 Transportation (freight, shipping, air)
 Retail/Wholesale
16

Sasha Romanosky J Cyber Secur 2016;cybsec.tyw001
© The Author 2016. Published by Oxford University Press.
Cyber incidents, and rates, by industry
17

Repeat incidents by industry.
Sasha Romanosky J Cyber Secur 2016;cybsec.tyw001
© The Author 2016. Published by Oxford University Press.
18

Costs
 Assessing/predicting costs of data breaches DIFFICULT--lack of quality data.
 High INTEREST AMONG firms at risk, insurance carriers, researchers, and social
planners.
 Based on recent survey data estimates the average cost of a data breach is
around $6.5 million (or, $217 per record; Ponemon 2015).
 Averages may be misleading: the statistical mean as a measure of the cost of a
data breach (or cyber event) pegs the loss for a data breach at almost $6 million,
but the median loss is only $170k.
 Similarly skewed values arise for phishing and security incidents.
 Privacy violations, however, account for a much larger median loss of $1.3 million.
19

Statistics Do Not Account For:
 Business interruption
 Reputational loss
 Customer retention/loss
 Cost of allocation of resources/time
 Responding to private litigation/ potential class
actions
 Responding to federal and state regulatory bodies
20

Four Types Of Threats
 Data Breaches (unauthorized disclosure of personal information)
 Security Incidents (malicious attacks directed at a company)
 Privacy Violations (alleged violation of consumer privacy)
 Phishing/Skimming incidents (individual financial crimes).
STATISTICALLY, of all cyber incidents data breaches are by
far the most common, dwarfing rates of all other cyber events.
21

Who Does This Stuff to Us?
 Next attacker—someone you thought you could trust
 Competitors
 Outside criminal element/ foreign and domestic/ bored
teenager
 State Sponsored Activity
 HUMAN ERROR
Mixed motives—financial gain, inflicting physical damage,
stealing intellectual property, spreading political protest
22

Dealing With Threats
 There is no 100%
 Compliance ≠ Security
 Prioritize business objectives w/in risk tolerance
 Management of contractual relationships/terms
 Proactive Security Plan with technology and
policy
 Coordinated and tested incident response plan
 Prepare Response to the Inevitable Attack
 Understand threat landscape
 Access right resources and skills
 Promote Culture of Security Awareness
 Train
 Avoid careless mistakes
 Protect key IP and business assets
23

Legal Management Issues
 Effective Privacy Notices
 Industry Specific Regulations
 Federal
 State
 Assessment of Legal Duties/ Disclosure
 Determination of Key Areas for Cyberinsurance
 Contractual Matters
 Indemnification
 Limitation of Liability
 Risk Transfer
 Representations & Warranties
 Acquisitions- Due Diligence
24

Legal Ramifications
 PRIVATE LITIGATION
 Suppliers, commercial customers
 Consumers, individuals, class actions
 GOVERNMENT INVESTIGATIONS
 State laws/ Attorney General Actions
 Federal Laws/ FTC and Industry Specific Regulations
 Privacy Actions
 Criminal Violations
In federal courts approximately 1700 pending legal actions over 50% are private civil actions,
17% are criminal actions.
25

Real Life Lessons From The FTC
 LABMD, A clinical laboratory, experienced unusual data breaches that compromised personal, medical
information of 9300 consumers. The FTC’s decision, relying on extensive expert testimony, found that
from 2005 to 2010 LabMD failed to:
 maintain file integrity monitoring;
 provide intrusion detection;
 monitor digital traffic across its firewalls;
 delete no longer needed consumer data;
 provide security training to employees;
 implement a strong password policy (a number of employees used the same password “labmd”);
 update its software to deal with known vulnerabilities;
 control administrative rights to employee laptops and allowed employees to download any software, business
related or not;
 prevent use of peer-to-peer software (LimeWire), which enabled download of a file containing 1,718 pages of
confidential information on approximately 9,300 consumers
26

Lessons From LABMD
 FTC has made it clear that any industry in possession of sensitive consumer data
(such as names, addresses, dates of birth, Social Security numbers, and insurance
information) will be required to maintain reasonable data security practices
 Enforcement actions may result even if there has been no identifiable harm to the subjects
of such data.
 the FTC is going to assert its authority expansively and stay in the cyber cop business.
 In a data breach case, no actual harm is necessary.
 Employers must train their employees on infoSEC
 COMPANIES MUST establish reasonable protocols commensurate with their risk profile to
try to protect against cyber intrusions.
27

Role Of Management And Board
 Duty To Maintain, Grow, And Protect The Assets Of The Company
 Public Company Risks
 Failure To Maintain Adequate Controls
 Failure To Disclose
 Failure To Investigate And Make Informed Judgments
 Shareholder Actions And Derivative Claims
 Government Focus On Individual Liability
 Indemnification Issues
28

What You Need in Place in
Before, During & After
 Management commitment
 Clear lines of communication
 Set infosec as an organizational priority
 Specialized knowledge
 Business compliance and continuity plans
 Policies and procedures for data protection
 Statutory compliance by industry/profession/location
 Employee training/ response teams
 WHEN THE INFORMATION SECURITY/CYBER
PROBLEM HAPPENS (and it will)
 24/7 responsiveness w/ resources
 Ability to contain harm/ calm management of crisis
 Guidance on legal duties/notification/reputation management
 Dealing with government bodies
 Positioning/shaping facts w/future litigation in mind
 Avoid exorbitant costs/ potential liabilities
29

THINK IN THREE PHASES
• Legal
• Insurance
• IT/Network
• PR
• Forensic
Testing
Before a
Problem
Arises
• Legal
• PR
• Insurance
• Forensic
Investigation
Responding
to a Breach
• Legal
• PR
• IT/Network
Post
Breach
30

Glenn E. Davis
Lead Partner
HBCyberGroup
www.HeplerBroom.com |
glenn.davis@helperbroom.com
Direct: 314.480.4154 | Mobile: 314.550.5122
31

InfoSec Prep: Risk, Reputation, Preparedness
1.01

Why Prepare?
 Big guys (Target, Schnucks) have been hacked
 My company is small
 I do not have to worry
You are wrong!!
33

IT Infrastructure
 Includes all components
 Not just limited to desktops or laptops
 Includes mobile devices as well
 Servers, on-site, off site or in the cloud
 E-mail records, files attached to said messages
 Internal IT infrastructure, servers, routers, copiers
34

How To Prepare-Pre Event
 Define current environment
 Decide what type(s) of attack to prepare for
 Conduct what-if scenarios
 Decide what risk factors are for each scenario
 Attack shortcomings on a priority basis
 Test systems to make sure systems work as designed
 Update on a regular basis
 Make sure the environment has an “owner”
35

Define Current Environment
 Firewall configuration
 Anti virus in-place, business grade
 Software security updates installed
 Backups in-place and functional
 Disaster recovery plan in-place and verified
 Redundant systems, connectivity
 Redundant systems, storage
 Servers contain PHI? Are they encrypted/monitored?
 Includes desktops, laptops, mobile devices
36

What Attacks To Consider
 Business dependent
 Internal employee attacks
 Phishing attacks
 Crypto Locker
 Unpatched software
 DDoS
 Malware
 Botnets
 Hacktivists, and the list goes on…
37

Conducting What If Scenarios
 Technical team needs to do this
 Hire ethical hackers
 Look at system architecture for responses
 Learn from other breaches
 Learn from industry groups
 Penetration testing at some frequency
 Test restored backup files
 Conduct disaster recovery simulations
38

Scenario Risk Factors
 What is the probability of a specific attack?
 What data, information, IP would be lost?
 What is the cost to recreate the lost information?
 Small and medium sized companies DO get hacked!
 Are there employees, current of former with agendas?
 How aware are employees of the risks?
 What company functions are the most critical?
39

Setting Organizational Priority
 Importance of potential breach area; H M, or L
 Probability of potential breach; H, M, or L
 Allowable time delay for recovery; Short, Medium, Longer
 Number of people impacted; H, M, or L
 Number of company functions impacted; H, M, or L
 Ability of company to generate revenue; H, M, or L
 Safety (all types) of the client; Critical, Medium, or Low
 Build matrix of all factors, rate 1-5, 5 being high or critical
 Address those items with the highest number first
 Implement fixes accordingly
40

Test Fixes for Verification
 Verify the fix has been fully implemented
 Design test scenario
 Testing party should NOT be that who did the fix!
 Verify desired result
 If successful retest at some frequency
 If unsuccessful, address failure, repair, retest
41

Follow up Is Critical
 Set some schedule for retesting based on criticality
 Make sure this process has an owner
 Make sure the owner has authority and support
 Include this as part of the strategic plan
 Address as part of internal SWOT analysis
 Be sure to consider legal, insurance, and messaging issues as these items are
addressed
42

Cyber Insurance: Increasingly Relevant in 2016—
Why should executives consider coverage?
Lockton Companies

What Can Cyber Insurance Cover?
Insurable assets:
 Personally identifiable information and/or protected
health information of employees or consumers
 Corporate Confidential Information
Data breach response costs to include the
following:
 Notification mailings & call center
 Credit monitoring
 Credit Correction
 IT forensics
 Public relations
 Defense costs and civil fines from a privacy
regulatory action
 Defense costs and damages from civil litigation

Corporate information technology network:
Addresses the loss of income as a consequence of network
downtime. Certain insurers will also extend coverage to
downtime of vendors on whom a policyholder is reliant. This
is commonly known as “contingent business interruption.”
 Costs to restore compromised data
 Reimbursement for costs associated with an extortion
threat
Operational technology:
A few insurers have begun to extend coverage beyond the
information technology network to also include operational
technology such as industrial control systems.

Reputation and Brand:
Insuring reputational risk from some form of cyber event remains out of the scope of the
majority of insurers. At the time of writing, the London market has begun to innovate to
address the financial loss after adverse media publicity. However, capacity remains
constrained at $100,000,000 at best.
Physical Assets:
Cyber security is no longer just about risks to information assets. A cyber attack can now
cause property damage that also could lead to financial loss from business interruption, as
well as liability from bodily injury or pollution, for example.
An assumption that coverage should rest within a property or terrorism policy may not be
accurate. Exclusionary language has begun to emerge and is expected to accelerate
across the marketplace as losses occur. Dedicated products also have started to appear.

Insuring Agreements Available in Insurance
Network Security Liability
 Claim expenses and damages arising from network and non-
network security breaches
Multimedia Liability
 Claim expenses and damages arising from personal injury torts and
intellectual property infringement (except patent infringement)
 Claim expenses and damages arising from electronic publishing
(website) and other dissemination of matter
Privacy Liability
 Claim expenses and damages emanating from a violation of a
privacy law or regulation
 Common law invasion of privacy or infringement of privacy rights
Privacy Regulatory Proceedings + Fines
 Claim expenses in connection with a regulatory inquiry,
investigation or proceeding
 Privacy regulation civil fines and consumer redress fund
 PCI DSS fines and assessments
Technology E&O/Miscellaneous E&O
 Claim expenses and damages emanating from a wrongful act in
the performance of or failure to perform technology services or
other professional services.
 Claim expenses and damages emanating from your technology
products’ failure to perform or serve the purpose intended
Data Breach Expense Reimbursement
 Expense reimbursement for third-party reasonable and necessary
costs including:
 Public relations costs
 Legal and forensics expenses
 Credit protection, mailing and tracking, call center, etc.
 Address three scenarios—mandatory, contractual and voluntary
Cyber Extortion
 Reasonable and necessary expenses and any funds paid in
connection with an extortion attempt
Network Business Interruption + Data Restoration and Reputation
Harm
 Loss of net income and Extra Expense

What Does Cyber Insurance Not Cover?
Intellectual property assets
Theft of one’s own corporate intellectual property (IP)
still remains uninsurable today as insurers struggle to
understand its intrinsic loss value once compromised.
Cyber Attack Exclusion Clause
Where this clause is endorsed on policies covering
risks of war, civil war, revolution, rebellion, insurrection,
or civil strife arising therefrom, or any hostile act by or
against a belligerent power, or terrorism or any person
acting from a political motive.
49

Brad Kosem
Lockton Companies
Insurance | Risk Management | Employee Benefits
www.Lockton.com | bkosem@lockton.com
Direct: 314.812.3818 | Mobile: 314.412.7878
50

The Risk of Risks:
Reputation Risk Resiliency
Managing the message!

A strong reputation enables your business to
meet its goals
 The intangibles can comprise more than 60% of a company’s value
 Public perception impacts profitability, book value, sales
 Strong reputation can result in strong stock price growth
 Investors use reputation in purchase decisions
 A strong reputation can be a competitive differentiator
52

Reputation risk underlies all risks
 The Economist Intelligence Unit survey:
 “Reputational risk… the most significant threat to a business.”
 Reputation is prized, vulnerable; source of competitive advantage
 Standard & Poor:
 Added reputation risk to its enterprise risk management assessment
 World Economic Forum:
 25% of company’s market value directly attributable to reputation
 Zurich:
 70% of consumers avoid buying a product if they don’t like the company behind it
 And, are 350% more likely to purchase products from companies they like and trust
53

Reputation is owned by stakeholders
 Reputation = judgments and perceptions of others
‒ Customers
‒ Suppliers
‒ Investors
‒ JV partners
‒ Agents
‒ Distributors
‒ Advocacy groups
‒ Regulators
‒ Policymakers
‒ General public
54

Organizational challenge to managing
reputation risk
Reputation literacy
not on the risk
agenda
Risk literacy not on
the reputation
agenda
55

A resilient organization manages all
types of risk
Ability to manage risks
and function/adapt
throughout the
lifecycle of operational
disruptions
Ability to maintain
good stakeholder
perceptions and
supportive behavior
at all times
Operational
Resiliency
Reputation
Resiliency
56

“Overall, costs associated with
remediating a reputational event
can be two to seven times higher
than costs related to the operational failure
that caused the reputation damage in the first place.”
Protecting reputation against risk makes good
business sense
The cost of remediation of reputation risk
far exceeds the cost of the initial failure.
RIMS 2016 (Risk & Insurance)
57

Why we’re here: Compliance Week identified
top risks to reputation (Aug. 26, 2016)
Type of risk How it impacts reputation
Culture risk Upset employee criticizes company
publicly, revealing weaknesses in the
culture,
Cyber risk Cybercriminal finds vulnerability,
enters systems, publicly demands
ransom
Third party risk Supplier doesn’t follow policy and
inadvertently releases personal medical
information
58

Data breaches come in all sizes
 Breaches are up, ransomware is up, complaints are up
 HHS said 113 million records compromised in 2015 – 8X those breached in 2014
 Healthcare has the highest cost per breached record of any industry - $402:
 80 million patient records breached at Anthem
 400 unencrypted patient records on a stolen iPhone from Catholic Health Services in
Philadelphia
 Even small breaches are expensive: Catholic Health Services breach resulted in a
$650K regulatory fine
59

 Clinical: fraudulent claims processed; inaccurate diagnosis; bad data in research
 Operational: Cost of new hires; cost of training; cost of reorganization
 Legal/regulatory: OCR fines; state fines; loss of accreditation; cost of lawsuit
 Financial: Remediation; communication; insurance impact; changing vendors;
business distraction
 Reputational: Loss of patients (average 7%); loss of current/new customers; loss
of partners; loss of staff; negative press; see all other costs above.
True cost of a healthcare breach:
$700/compromised record (Ponemon Institute 2016)
60

Build
enterprise-wide
reputation
competence.
The key to protecting reputation
61

Internal
Risk
Analysis
External
Risk
Analysis
Strategy
Development
and Alignment
Risk Scenario/
Crisis Planning
Reputation
Risk Audit
Prepare before a reputation risk event so you
can manage during and after the event: Key
steps
62

Prioritize the risks that are likely and have high
impact
Ability to
attract &…
Advisors give
faulty
projections
Cont'd pressure
from small
employers on
cost
Data breach/data…
Don’t deliver on
promises
Don’t develop exec.
leadership
Economic
environment
Ext. belief we can be replaced…
Ext. political
environment
Federal govt involved
in healthcare
Financial integrity…
Investment…
Legislative/regulatory issues
Pension fund
collapses
Products
impacted by
ACA
Societal/cultural
issues
Outdated
technology
Thought of as for-
profit
Top leaders leave
0
1
2
3
4
5
6
7
8
9
10
0 1 2 3 4 5 6 7 8 9 10
LikelihoodofHappening
Severity of Impact
63

 Thinking you can wait until an event unfolds to determine how to handle it.
 It’s only a worry for the IT department.
 Everyone knows data breaches happen and that they aren’t our fault.
 We give a lot of money to the community. They know we’re a good company.
 Our budget is focused on hardening our network. We don’t need to invest in crisis
planning.
Blind spots about reputation risk and data
breaches
64

 A data breach will happen; if you plan ahead you will react more quickly and it will
cost you less.
 Invest in a strong cybersecurity program now to protect your reputation later. You
don’t want to be the organization that says publicly, “We didn’t know.”
 A strong reputation for preparedness may result in better relationships with
regulators.
 Reputation is about how you make decisions when no one is looking. It’s not just
about PR, philanthropy or advertising.
 Reputation resiliency happens when you invest as much effort in managing it
before, during and after events, just like you do for other key assets.
How to protect your reputation for the
inevitable data breach
65

Linda Locke
Standing Partnership
Building, protecting and restoring reputations
www.StandingPartnership.com
LLocke@StandingPartnership.com
@Reputationista
Direct: 314.435.3428
66

 Reputational risk a top concern for boards
‒63% of directors see reputational risk as top concern…and
concerns are growing
‒Primary concerns cover product quality, liability, customer
satisfaction
‒Secondary concerns: integrity, fraud, ethics
‒Three-fourths of directors seek broad-based risk assessment…
and they want to know more
Third Annual Board of Directors Survey 2012 - Concerns About Risks Confronting Boards – EisnerAmp
It keeps your boards up at night
67

 JPMorganChase: attract staff; regulatory compliance; confidential information;
investor confidence
 Strayer Education, Inc: license to operate (participation in federal and state
programs); data breach
 Facebook: loss of revenue; ability to grow; unfavorable media coverage; technical
performance; user metric accuracy
 Kellogg: product quality and availability; food safety
 Kraft Heinz: product recalls
 Magellan: business practices; data breach
 Monsanto: degree of public understanding
Examine what your firm has disclosed as its
reputation risks from 10K filings
68

BEA Presentation

More Related Content

What's hot (20)

Similar to BEA Presentation (20)

BEA Presentation