02.05.2018 Views

Indagard Insurance Services Guide to Cyber Risk and Insurance

A helpful guide to how the Notifiable Data Breach scheme affects your business, the threats of cyber risk and the role insurance plays to keeping your business open for business.

A helpful guide to how the Notifiable Data Breach scheme affects your business, the threats of cyber risk and the role insurance plays to keeping your business open for business.

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

HOW TO STAY<br />

PROTECTED AGAINST<br />

CYBER THREATS


INDAGARD INSURANCE SERVICES<br />

Copyright © 2018 John Catibog<br />

Disclaimer: This publication is for information purposes only. The<br />

information in this publication does not take in<strong>to</strong> account the<br />

objectives, financial situation or needs of any person <strong>and</strong> should<br />

not be taken as advice. Before making any decision, please consult<br />

with a qualified professional.<br />

A CYBER INSURANCE GUIDE - PAGE 3


INDAGARD INSURANCE SERVICES<br />

CONTENTS<br />

INTRODUCTION 4<br />

MANDATORY DATA BREACH SCHEME 7<br />

COMMON CYBER ATTACKS AND CULPRITS 12<br />

STAYING SAFE ONLINE 19<br />

THE COST OF CYBER SECURITY 24<br />

WHAT DOES CYBER INSURANCE COVER? 29<br />

BUT I ALREADY HAVE INSURANCE 34<br />

GETTING CYBER PROTECTED 37<br />

A CYBER INSURANCE GUIDE - PAGE 2


INDAGARD INSURANCE SERVICES<br />

Did you know<br />

that 60% of<br />

businesses<br />

close down<br />

within 6<br />

months of a<br />

data breach<br />

incident?<br />

A CYBER INSURANCE GUIDE - PAGE 3


INDAGARD INSURANCE SERVICES<br />

Introduction<br />

<strong>Insurance</strong> is an essential item on any business’s balance<br />

sheet.<br />

Depending on the industry you are in, your clients,<br />

vendors <strong>and</strong>/or the government may require you <strong>to</strong><br />

carry certain types of insurance. Chances are that you are<br />

well familiar with these: public liability cover, builders<br />

insurance, commercial au<strong>to</strong>, key person insurance, just <strong>to</strong><br />

name a few.<br />

In this e-book, however, we will shed light on a different<br />

type of insurance that is becoming more <strong>and</strong> more critical.<br />

With data breaches on the rise, <strong>Cyber</strong> <strong>Insurance</strong> is the type<br />

of insurance that deserves your attention.<br />

It is not contractually required (yet) in most cases but the<br />

lack of it can (<strong>and</strong> most possibly will) have devastating<br />

consequences.<br />

We’ll take an in-depth look at what cyber insurance is, the<br />

covers it provides <strong>and</strong> the privacy laws that impact you.<br />

Not only will we look at <strong>Cyber</strong> <strong>Insurance</strong> but we’ll also<br />

discuss the most common cyber attacks/hacks you could<br />

face.<br />

A CYBER INSURANCE GUIDE - PAGE 4


INDAGARD INSURANCE SERVICES<br />

According <strong>to</strong> Ponemon Institute, an average cost<br />

Australian business incurs, is $139 per affected record.<br />

If you had just a 1000 records (that could include<br />

cus<strong>to</strong>mer information, vendor information, email<br />

subscribers, anyone who signed up <strong>to</strong> your website with a<br />

password), your average cost would be $139,000.<br />

Do you have this money set aside <strong>to</strong> cover a cyber breach<br />

incident?<br />

If not, read on.<br />

What exactly is cyber<br />

insurance?<br />

<strong>Cyber</strong> <strong>Insurance</strong> is designed <strong>to</strong> help offset your costs in the<br />

event of a data breach.<br />

Like any other insurance, it’s a risk mitigation technique<br />

that allows you <strong>to</strong> transfer some of that risk <strong>to</strong> the<br />

insurance company.<br />

Let’s face it; every business nowadays uses technology.<br />

Whether you sell online, or simply have your cus<strong>to</strong>mer<br />

information on a server in a cloud, if your computer is<br />

connected <strong>to</strong> the internet, the data is at risk.<br />

A CYBER INSURANCE GUIDE - PAGE 5


INDAGARD INSURANCE SERVICES<br />

The truth is, the data you are responsible for is never 100%<br />

secure, <strong>and</strong> hackers make it their mission <strong>to</strong> breach your<br />

computer’s defences.<br />

Technology has massively changed the way business<br />

is done <strong>to</strong>day. While technology in business has many<br />

advantages, it has opened the door <strong>to</strong> many new dangers<br />

<strong>and</strong> risks that didn’t exist before the digital era.<br />

You may be a local business, but your reach is global the<br />

moment you’re online <strong>and</strong> at risk.<br />

<strong>Cyber</strong> insurance will cover costs associated with notifying<br />

the individuals whose data has been s<strong>to</strong>len, forensic<br />

investigation costs <strong>and</strong> will protect you from lawsuits by<br />

people affected by the data breach whose records you were<br />

responsible for.<br />

Of course, no policy is the same, so it’s important <strong>to</strong> look<br />

at each quote you receive <strong>to</strong> determine what exactly is<br />

covered.<br />

A CYBER INSURANCE GUIDE - PAGE 6


INDAGARD INSURANCE SERVICES<br />

MANDATORY<br />

NOTIFICATION<br />

DATA BREACH<br />

SCHEME<br />

A CYBER INSURANCE GUIDE - PAGE 7


INDAGARD INSURANCE SERVICES<br />

Are there any laws that make<br />

<strong>Cyber</strong> <strong>Insurance</strong> necessary?<br />

The new Notification Data Breach (NDB) scheme has<br />

changed the requirements for companies <strong>and</strong> agencies in<br />

protecting the Personal Identifiable Information (PII) they<br />

collect <strong>and</strong> s<strong>to</strong>re.<br />

This new law made <strong>Cyber</strong> <strong>Insurance</strong> even more critical as<br />

there are new (costly) obligations <strong>to</strong> deal with if the breach<br />

happens.<br />

On February 22, the Office of the Australian Information<br />

Commissioner (OAIC) established the NDB scheme as part<br />

of the Privacy Act.<br />

What does this mean for you?<br />

If your business, agency or non-for-profit organisation has<br />

an annual turnover of $3 million, it is now m<strong>and</strong>a<strong>to</strong>ry for<br />

you <strong>to</strong> report any data breaches <strong>to</strong> the OAIC.<br />

Additionally, you must notify any individual whose<br />

sensitive information has been accessed <strong>and</strong> is likely <strong>to</strong><br />

be harmed within 30 days of becoming aware of a data<br />

breach.<br />

A CYBER INSURANCE GUIDE - PAGE 8


INDAGARD INSURANCE SERVICES<br />

Why do I need cyber insurance?<br />

If you recall, the introduction <strong>to</strong> this book gave an<br />

alarming statistic – an average cost the business incurs, is<br />

$139 per affected record.<br />

With NDB in place, this average is sure <strong>to</strong> climb up for<br />

compliant businesses due <strong>to</strong> now m<strong>and</strong>a<strong>to</strong>ry notification<br />

<strong>and</strong> regula<strong>to</strong>ry costs.<br />

Simply put, the damages <strong>and</strong> consequences from a cyber<br />

attack can significantly hurt your business.<br />

Keep in mind, that your costs will be far higher than the<br />

m<strong>and</strong>a<strong>to</strong>ry regula<strong>to</strong>ry costs.<br />

Consider this. If the data breach happens, will you want <strong>to</strong><br />

hire a PR firm <strong>to</strong> mitigate the reputational damage <strong>and</strong> bad<br />

press?<br />

Of course, you would.<br />

What about the income that lessens due <strong>to</strong> your cus<strong>to</strong>mers<br />

not trusting you anymore?<br />

Wouldn’t you need some kind of financial supplement <strong>to</strong><br />

keep you from shutting the doors due <strong>to</strong> no income?<br />

<strong>Cyber</strong> <strong>Insurance</strong> attempts <strong>to</strong> keep your business running<br />

while you deal with the fallout from the breach. Business<br />

A CYBER INSURANCE GUIDE - PAGE 9


INDAGARD INSURANCE SERVICES<br />

Interruption, Media & Relations <strong>and</strong> more are all covers<br />

available under the policy.<br />

If you don’t have the protection <strong>Cyber</strong> <strong>Insurance</strong> provides<br />

against cyber risks, then there is a real chance that you will<br />

be the one who foots the bill from cyber damages along<br />

with any loss of data.<br />

If you are a contrac<strong>to</strong>r, you may start <strong>to</strong> see the<br />

requirement of having a <strong>Cyber</strong> Liability <strong>Insurance</strong> policy<br />

included in your future contracts. People are beginning <strong>to</strong><br />

realise that a cyber threat is real <strong>and</strong> everyone wants <strong>to</strong> be<br />

protected in case anything happens.<br />

Do you:<br />

<br />

Have your employees use computers,<br />

smartphones, <strong>and</strong>/or the internet as part of their jobs?<br />

<br />

Create, keep <strong>and</strong> use sensitive cus<strong>to</strong>mer<br />

information from cus<strong>to</strong>mers, employees <strong>and</strong> suppliers?<br />

<br />

As a consultant recommend or implement any<br />

security measures for your client?<br />

If you answered yes <strong>to</strong> any of those questions, then you<br />

need cyber insurance.<br />

A CYBER INSURANCE GUIDE - PAGE 10


INDAGARD INSURANCE SERVICES<br />

I’m just a small business. Why<br />

would hackers want <strong>to</strong> target<br />

me?<br />

According <strong>to</strong> various studies, at least 45% of all cyber<br />

attacks target small businesses.<br />

Look, the tech giants like Apple, Yahoo, Facebook <strong>and</strong><br />

more, all anticipate data breaches <strong>and</strong> have whole<br />

departments that deal with data security.<br />

A big corporation will have teams of people moni<strong>to</strong>ring<br />

their security <strong>and</strong> susceptibility <strong>to</strong> attacks 24/7, <strong>and</strong> even<br />

they are not immune.<br />

Just think of Equifax data breach sc<strong>and</strong>al that affected over<br />

143 million Americans.<br />

Small businesses are often targeted because it’s easier.<br />

Their data is less secure, they don’t invest enough (or at all)<br />

in<strong>to</strong> security countermeasures <strong>and</strong> thus is seen as an easier<br />

job for the hackers.<br />

Sometimes, the hackers themselves don’t even<br />

intentionally target you. They may have au<strong>to</strong>mated<br />

malware r<strong>and</strong>omly flooding vulnerable systems, <strong>and</strong> your<br />

business happens <strong>to</strong> be one of the victims.<br />

A CYBER INSURANCE GUIDE - PAGE 11


INDAGARD INSURANCE SERVICES<br />

COMMON<br />

CYBER<br />

ATTACKS<br />

AND<br />

CULPRITS<br />

A CYBER INSURANCE GUIDE - PAGE 12


INDAGARD INSURANCE SERVICES<br />

What are the most common<br />

types of cyber attacks?<br />

There is a wide range of methods cyber criminals use <strong>to</strong><br />

breach your system <strong>and</strong> steal your data.<br />

A short list of common techniques these criminals might<br />

use includes malware, phishing, DDOS, SQL Injection, <strong>and</strong><br />

Social engineering.<br />

To give you a better underst<strong>and</strong>ing of the threats you<br />

could potentially be facing online, please see below the<br />

brief overview of each of these methods.<br />

Malware<br />

This is one of the most common ways for cyber criminals<br />

<strong>to</strong> breach your system.<br />

Malware is a harmful software intended <strong>to</strong> be used<br />

maliciously against your machine; once installed, it can<br />

spread <strong>and</strong> disable your computer, overload your servers,<br />

<strong>and</strong> steal your records.<br />

Common types of malware include viruses, ransomware,<br />

worms, <strong>and</strong> spyware.<br />

Attackers will disguise malware as harmless links or email<br />

attachments <strong>to</strong> trick you or your staff in<strong>to</strong> clicking.<br />

A CYBER INSURANCE GUIDE - PAGE 13


INDAGARD INSURANCE SERVICES<br />

Once clicked, malware can be used <strong>to</strong> gain control of your<br />

system, spy on your activities, moni<strong>to</strong>r keystrokes <strong>and</strong><br />

passwords, create vulnerabilities <strong>to</strong> be accessed further or<br />

crash your computer <strong>and</strong> network.<br />

Phishing<br />

Phishing is a cyber attack where the perpetra<strong>to</strong>r pretends<br />

<strong>to</strong> be someone else <strong>to</strong> trick you in<strong>to</strong> providing passwords<br />

or financial details.<br />

They may pretend <strong>to</strong> be a reputable business or<br />

organization, a regular person who is in a rough situation,<br />

or a group that is in charge of giving you some kind of<br />

prize or award.<br />

DDOS<br />

Short for distributed denial of service, DDOS attacks are<br />

used <strong>to</strong> crash computers, servers, or networks.<br />

They work by overloading the system with incoming data<br />

from multiple sources; often the attacker will use a group<br />

of people or bots <strong>to</strong> send repeated information <strong>to</strong> the<br />

system from numerous different connections.<br />

They might enlist the help of people from a website or else<br />

use various different servers <strong>to</strong> hit your system from many<br />

entry points.<br />

A CYBER INSURANCE GUIDE - PAGE 14


INDAGARD INSURANCE SERVICES<br />

SQL Injection Attack<br />

St<strong>and</strong>ard query language (SQL) is a management language<br />

that is used <strong>to</strong> query <strong>and</strong> h<strong>and</strong>le information within<br />

databases.<br />

In an SQL Injection attack, the attacker will use code <strong>to</strong><br />

“trick” a database in<strong>to</strong> providing them sensitive or valuable<br />

information by exploiting vulnerabilities in the system.<br />

Before you have any chance of reacting, the attacker has<br />

copied this information from your database <strong>and</strong> now has<br />

full access <strong>to</strong> it.<br />

Imagine if your system s<strong>to</strong>red medical files, credit card<br />

details, or tax file numbers <strong>and</strong> fell victim <strong>to</strong> this kind of<br />

attack!<br />

Social engineering<br />

Social engineering involves an elaborate ploy <strong>to</strong><br />

manipulate an individual in<strong>to</strong> giving up sensitive<br />

information.<br />

<strong>Cyber</strong> attackers will use human interaction <strong>to</strong> coerce<br />

the individual <strong>to</strong> break procedure <strong>and</strong> either directly or<br />

indirectly give them access <strong>to</strong> valuable information.<br />

Attackers often use tactics that, on the surface, seem<br />

completely innocent <strong>and</strong> harmless but that, in actuality,<br />

can seriously jeopardize the safety of your data.<br />

A CYBER INSURANCE GUIDE - PAGE 15


INDAGARD INSURANCE SERVICES<br />

Who commits cyber crimes?<br />

<strong>Cyber</strong> crime has evolved dramatically in the last decade.<br />

Back in the 90’s a typical hacker was a lone wolf who wrote<br />

a virus <strong>to</strong> show everyone what he could do.<br />

These days cyber crime is a “legitimate business” for many<br />

criminal organisations that devote considerable resources<br />

<strong>to</strong> writing viruses <strong>and</strong> creating scams <strong>to</strong> get access <strong>to</strong> your<br />

private data.<br />

The type of people who commit these crimes go by many<br />

names: Hackers, identity thieves, organized criminals, <strong>and</strong><br />

cyber terrorists, just <strong>to</strong> name a few.<br />

Whatever they are referred <strong>to</strong> as, these attackers have a<br />

common goal: <strong>to</strong> steal your data.<br />

The threat, however, can sometimes come from much<br />

closer <strong>to</strong> home – your data can be s<strong>to</strong>len by competi<strong>to</strong>rs,<br />

your employees, or even be a simple human error.<br />

Competi<strong>to</strong>rs<br />

This one isn’t hard <strong>to</strong> believe. The perpetra<strong>to</strong>rs can be<br />

your competi<strong>to</strong>rs wanting <strong>to</strong> give themselves an edge over<br />

you.<br />

There are numerous, unethical <strong>and</strong> creative ways<br />

A CYBER INSURANCE GUIDE - PAGE 16


INDAGARD INSURANCE SERVICES<br />

unscrupulous competi<strong>to</strong>rs can try <strong>and</strong> get access <strong>to</strong> your<br />

data.<br />

They might contact your employees, use theft or hack in<strong>to</strong><br />

your computers <strong>to</strong> get the information <strong>and</strong> disrupt the<br />

operation of your business.<br />

You can’t underestimate how far a competi<strong>to</strong>r might<br />

be willing <strong>to</strong> go <strong>to</strong> gain an advantage. Whatever their<br />

motivation or strategy is, competi<strong>to</strong>rs represent a real risk<br />

<strong>to</strong> your system <strong>and</strong> your sensitive information.<br />

Employees<br />

<strong>Cyber</strong> threats aren’t just outside your organisation.<br />

Employees can also pose a threat.<br />

Employees, both past, <strong>and</strong> present, could hijack your<br />

proprietary information <strong>to</strong> sell it <strong>to</strong> another party or use it<br />

<strong>to</strong> start their own business venture.<br />

They might steal important financial data for their own<br />

benefit. Whether they are out for revenge or simply<br />

looking for financial gain, it is essential <strong>to</strong> have processes<br />

in place <strong>to</strong> safeguard your data.<br />

Human Error<br />

Data breaches aren’t always the work of cyber criminals.<br />

Sometimes a data breach can simply be a result of basic<br />

human error.<br />

A CYBER INSURANCE GUIDE - PAGE 17


INDAGARD INSURANCE SERVICES<br />

For example, an employee might dispose of paperwork<br />

by throwing it in the bin. Unbeknownst <strong>to</strong> the employee,<br />

those papers contained valuable information that gets in<strong>to</strong><br />

the wrong h<strong>and</strong>s.<br />

It’s not uncommon for business owners <strong>to</strong> completely<br />

underestimate or even ignore the risks posed by members<br />

of their own staff with inside access <strong>to</strong> their data <strong>and</strong> key<br />

information.<br />

Another human error example is an employee losing his<br />

work lap<strong>to</strong>p (or it being s<strong>to</strong>len).<br />

Is it employee’s fault?<br />

Usually no.<br />

But it can be a severe risk in the wrong h<strong>and</strong>s.<br />

A CYBER INSURANCE GUIDE - PAGE 18


INDAGARD INSURANCE SERVICES<br />

STAYING<br />

SAFE<br />

ONLINE<br />

A CYBER INSURANCE GUIDE - PAGE 19


INDAGARD INSURANCE SERVICES<br />

<strong>Insurance</strong> should be seen as the last line of protection for<br />

your business when all other measures fail.<br />

After all, prevention is better than cure.<br />

Insurers also look more favourably upon businesses that<br />

are taking precautions <strong>to</strong> prevent a data breach <strong>and</strong> could<br />

result in better premiums <strong>and</strong> terms for cover.<br />

You cannot s<strong>to</strong>p a cyber attack because if a criminal really<br />

wants <strong>to</strong> access your system, they’ll find a way, but you can<br />

make it as hard as you can for them. Often, that would be<br />

enough of a deterrent.<br />

After all, most would rather do a quick hack, get in <strong>and</strong> get<br />

out rather than spending considerable amount of time <strong>and</strong><br />

resources hacking a well protected business that they don’t<br />

know what they’ll find in.<br />

Besides having cyber insurance, here are some ways <strong>to</strong><br />

minimise a cyber hack <strong>and</strong> the damaging aftermath.<br />

Invest in security software<br />

Security software is a must for keeping your data secure<br />

<strong>and</strong> protecting the information you are responsible for<br />

from cyber attacks.<br />

Security software is a worthwhile investment, <strong>and</strong> both<br />

antivirus <strong>and</strong> firewall should be installed <strong>to</strong> protect you<br />

A CYBER INSURANCE GUIDE - PAGE 20


INDAGARD INSURANCE SERVICES<br />

against the most common forms of cyber attacks.<br />

An antivirus protects you against malware.<br />

A firewall helps prevent any unauthorised access.<br />

Make sure that you are continually upgrading your<br />

software, as newer <strong>and</strong> more sophisticated viruses <strong>and</strong><br />

methods are developed every day.<br />

Antivirus software can only be truly effective when it<br />

is prepared for the latest <strong>and</strong> most high-risk malware<br />

floating around on the web.<br />

Encrypt your data<br />

Encryption is a simple but highly effective way <strong>to</strong> make<br />

data harder <strong>to</strong> access by hiding its readability. You’d be<br />

surprised at how much more secure your data can become<br />

using simple encryption software.<br />

Update your software <strong>to</strong> the latest<br />

versions<br />

When software is updated, the developers add code <strong>to</strong><br />

protect against the latest forms of cyber attacks. It’s best<br />

<strong>to</strong> update your software <strong>to</strong> the latest versions on a regular<br />

basis. Often, vulnerabilities or exploits that were present in<br />

earlier versions will also be patched up by the developers.<br />

A CYBER INSURANCE GUIDE - PAGE 21


INDAGARD INSURANCE SERVICES<br />

Restrict access<br />

For highly sensitive or valuable information, it is a very<br />

good idea <strong>to</strong> restrict access so that only those who you<br />

trust <strong>and</strong> who need <strong>to</strong> see it can use it. After all, it doesn’t<br />

make much sense <strong>to</strong> let sensitive information be accessed<br />

by people who don’t need <strong>to</strong> see it, right?<br />

Regular backup<br />

For crashes <strong>and</strong> other more obvious cyber attacks, regular<br />

backups will be a lifesaver in protecting <strong>and</strong> res<strong>to</strong>ring your<br />

data against damage or deletion.<br />

Utilize both cloud <strong>and</strong> physical backups <strong>and</strong> update<br />

them regularly. This will ensure that your backup is<br />

always relatively current <strong>and</strong> that you don’t lose any key<br />

information due <strong>to</strong> an attack.<br />

Regular backup <strong>and</strong> safe s<strong>to</strong>rage of the backup is often<br />

a condition insurers want <strong>to</strong> see in a business they are<br />

assessing for cover.<br />

Implementing Security Awareness<br />

programs<br />

Security Awareness Program is a training for your<br />

employees <strong>to</strong> educate them on proper online use, who <strong>to</strong><br />

contact if they discover a security threat <strong>and</strong> that data is an<br />

important corporate asset.<br />

A CYBER INSURANCE GUIDE - PAGE 22


INDAGARD INSURANCE SERVICES<br />

Stay Smart Online program, an Australian government<br />

initiative, has collated tips on safe online behaviour<br />

<strong>to</strong> help you stay secure online. You can get it on the<br />

StaySmartOnline.gov.au website.<br />

Some good precautionary measures for online use would<br />

be <strong>to</strong> restrict the use of social media during work hours<br />

<strong>and</strong> disallowing sending work-related data <strong>to</strong>/from<br />

employee’s personal email.<br />

The amount of time it takes <strong>to</strong> teach your staff some of<br />

the basics of safe online use is well worth the risks it might<br />

protect your organization against.<br />

Change your password regularly<br />

A very easy way <strong>to</strong> protect against cyber attacks<br />

is <strong>to</strong> change your password regularly. Some good<br />

recommendations would be <strong>to</strong> increase the complexity of<br />

your passwords <strong>and</strong> <strong>to</strong> not write them down anywhere.<br />

It’s not at all uncommon for an attacker <strong>to</strong> gain access <strong>to</strong> a<br />

system due <strong>to</strong> an easily hacked password.<br />

A CYBER INSURANCE GUIDE - PAGE 23


INDAGARD INSURANCE SERVICES<br />

THE COST<br />

OF CYBER<br />

SECURITY<br />

A CYBER INSURANCE GUIDE - PAGE 24


INDAGARD INSURANCE SERVICES<br />

How much damage can a cyber<br />

breach do?<br />

According <strong>to</strong> the findings from the 2017 Cost of Data<br />

Breach Study: Australia conducted by IBM <strong>and</strong> the<br />

Ponemon Institute, notifications due <strong>to</strong> a cyber breach<br />

have an average cost of $500,000.<br />

Activities that are involved with notifications include<br />

the building of contact databases, checking <strong>to</strong> see if the<br />

business meets regula<strong>to</strong>ry requirements, discussing the<br />

breach with outside experts, <strong>and</strong> miscellaneous costs<br />

related <strong>to</strong> the communication <strong>to</strong> those affected.<br />

Those are just the costs of notification activities!<br />

We haven’t even started <strong>to</strong> fac<strong>to</strong>r in other costs related <strong>to</strong><br />

the damages.<br />

Additionally, consider these numbers:<br />

<br />

<br />

<br />

The <strong>to</strong>tal cost of a data breach averages out <strong>to</strong><br />

$2.51 million<br />

The cost per lost or s<strong>to</strong>len record is an average of<br />

$139<br />

The financial, services, technology,<br />

communications, industrial, <strong>and</strong> education industries have<br />

greater costs due <strong>to</strong> the sensitive information they use.<br />

A CYBER INSURANCE GUIDE - PAGE 25


INDAGARD INSURANCE SERVICES<br />

Another thing <strong>to</strong> keep in mind, is the fact that often the<br />

breach is not discovered immediately.<br />

Usually the attack runs in the background getting all the<br />

incoming information straight <strong>to</strong> the bad guy on the other<br />

end.<br />

The longer the attack happens, the higher the cost.<br />

Multiply those costs by hundreds or thous<strong>and</strong>s of records<br />

<strong>and</strong> you can see how quickly the numbers grow.<br />

THE HARDEST COST TO<br />

QUANTIFY IS THE LOSS OF<br />

CUSTOMER TRUST<br />

If you knew your best friend’s data was compromised<br />

because he was doing business with Company A, would<br />

you willingly give them your personal information?<br />

Of course not.<br />

I wouldn’t either.<br />

So that company has already lost you <strong>and</strong> me as their<br />

potential cus<strong>to</strong>mers.<br />

It’s easy <strong>to</strong> see how this could snowball quickly resulting<br />

in no new cus<strong>to</strong>mers, reduced or non existent business<br />

A CYBER INSURANCE GUIDE - PAGE 26


INDAGARD INSURANCE SERVICES<br />

income all while incurring unexpected expenses.<br />

Recent examples are the worldwide trending<br />

#DeleteFacebook <strong>and</strong> Mark Zuckerberg in damage control<br />

as an impact of the lost of the trust. Target <strong>and</strong> Yahoo! are<br />

other recent examples that made headlines.<br />

There’s no doubt the damage <strong>to</strong> the trust amongst their<br />

cus<strong>to</strong>mers would have a negative impact on their business.<br />

How much cyber insurance do I<br />

need?<br />

It depends.<br />

Some fac<strong>to</strong>rs <strong>to</strong> consider are your industry, how <strong>and</strong> where<br />

you operate your business, the size of your business <strong>and</strong><br />

the type of information you keep.<br />

The limits you need can also be dictated by the contract<br />

requirements you have with your clients or vendors.<br />

A CYBER INSURANCE GUIDE - PAGE 27


INDAGARD INSURANCE SERVICES<br />

How much does cyber liability<br />

insurance cost?<br />

Again, it depends.<br />

This is like asking “how much would it cost me <strong>to</strong> buy a<br />

house?” You can’t give a cookie-cutter answer because<br />

the fac<strong>to</strong>rs involved is different for everybody. You have<br />

<strong>to</strong> consider the location of your house, the size of it <strong>and</strong><br />

many more fac<strong>to</strong>rs that are unique for every buyer.<br />

As with buying a house, when purchasing an insurance<br />

policy the cost depends on several fac<strong>to</strong>rs.<br />

The most important being the size <strong>and</strong> nature of your<br />

business, as well as, the level of cover you wish <strong>to</strong> have.<br />

The cost of cyber liability insurance is never a certain until<br />

your risks are properly reviewed by the underwriters,<br />

however a rough, indicative starting range of cyber<br />

insurance premiums can be between $900 <strong>to</strong> $2,500, for<br />

cover between $500,000 <strong>to</strong> $2 million for a small business.<br />

Corporate businesses that have larger operations or across<br />

border will have much greater costs but they also have a<br />

great deal <strong>to</strong> lose.<br />

It may seem like the unnecessary cost but the cost of the<br />

yearly premium is so much less than what a business<br />

would have <strong>to</strong> pay if the incident was <strong>to</strong> happen.<br />

A CYBER INSURANCE GUIDE - PAGE 28


INDAGARD INSURANCE SERVICES<br />

WHAT DOES<br />

CYBER<br />

INSURANCE<br />

COVER?<br />

A CYBER INSURANCE GUIDE - PAGE 29


INDAGARD INSURANCE SERVICES<br />

First party damages<br />

This covers the costs incurred by your business.<br />

It’s important because it provides you the money needed<br />

<strong>to</strong> respond <strong>to</strong> a breach <strong>and</strong> get you back <strong>to</strong> operating at the<br />

same level before the breach occurred.<br />

A policy can include:<br />

Privacy Notification & Crisis Management Expenses<br />

<br />

Notification of the data breach <strong>to</strong> those affected.<br />

A vital cover <strong>to</strong> the cost of complying with the new NDB<br />

scheme.<br />

<br />

<br />

Hiring a forensic firm <strong>to</strong> investigate the breach.<br />

Hiring a PR firm <strong>to</strong> manage the bad press <strong>and</strong><br />

res<strong>to</strong>re your cus<strong>to</strong>mer’s faith.<br />

<br />

Providing credit moni<strong>to</strong>ring <strong>to</strong> those affected<br />

MULTIPLE BREACHES<br />

A travel agency with 4 locations experienced 3 separate<br />

breaches over a year’s period. Over 250,000 records were<br />

compromised including credit card <strong>and</strong> passport information.<br />

The <strong>Cyber</strong> Liability policy paid $1.75M in forensic <strong>and</strong> legal<br />

costs <strong>and</strong> the cost of notifying those affected.<br />

A CYBER INSURANCE GUIDE - PAGE 30


INDAGARD INSURANCE SERVICES<br />

Business Interruption Costs<br />

This cover your loss as a result of a hack <strong>and</strong> <strong>to</strong> get you<br />

back in business again.<br />

<br />

Loss of income - compensating the business for<br />

lost income while it is dealing with the fallout from the<br />

breach.<br />

<br />

res<strong>to</strong>ration.<br />

<br />

The cost <strong>to</strong> recover the data <strong>and</strong> system<br />

Ex<strong>to</strong>rtion <strong>and</strong> ransom payments – payments<br />

<strong>to</strong> the ex<strong>to</strong>rtionist that is holding your data hostage or is<br />

threatening an attack.<br />

Social engineering damages<br />

A cyber insurance policy can cover offline damages<br />

sustained due <strong>to</strong> the use of deception in manipulating<br />

individuals in<strong>to</strong> divulging confidential, personal<br />

information which can be used for illicit purposes.<br />

Third party liability costs<br />

This covers the costs you will incur <strong>to</strong> compensate those<br />

that have been negatively affected as a result of your<br />

system being breached.<br />

Let me demonstrate. Imagine your business was <strong>to</strong> clean<br />

A CYBER INSURANCE GUIDE - PAGE 31


INDAGARD INSURANCE SERVICES<br />

one-of-a-kind widgets. You take the widget from the<br />

cus<strong>to</strong>mer <strong>to</strong> be cleaned at your workshop. Overnight, a<br />

fire starts <strong>and</strong> destroys the dirty, but functioning, widget.<br />

You are liable for the costs <strong>to</strong> replace the widget. However,<br />

you may also be liable for the costs incurred by the client<br />

as a result of losing the widget.<br />

<strong>Cyber</strong> Policy works in a similar same way – third party<br />

portion of the cover protects your business against a legal<br />

action <strong>and</strong> costs incurred by others as a results of their data<br />

being compromised in your possession.<br />

SHOPPING, INTERRUPTED<br />

A large online retailer’s ($5M turnover) website was hacked<br />

<strong>and</strong> included a link <strong>to</strong> a competi<strong>to</strong>r’s website when the hackers<br />

got access <strong>to</strong> their cus<strong>to</strong>mer’s sensitive data. Business<br />

Interruption portion of the policy paid $800,000 <strong>to</strong> repair<br />

the website, comply with regulations <strong>and</strong> notify affected<br />

individuals.<br />

Multimedia costs<br />

Coverage can extend <strong>to</strong> social media damages; for<br />

instance, libel <strong>and</strong> sl<strong>and</strong>er. Additionally, it can also cover<br />

the costs of copyright infringement.<br />

A CYBER INSURANCE GUIDE - PAGE 32


INDAGARD INSURANCE SERVICES<br />

It’s important <strong>to</strong> look through a policy <strong>and</strong> see if it meets<br />

any needs you might have in this area.<br />

What should I look for in a<br />

cyber insurance policy?<br />

It is vital that you underst<strong>and</strong> the definitions <strong>and</strong> wordings<br />

within the agreement. Some of the covers we discussed<br />

may not be included in a package. One insurer might<br />

define something as a cyber event while another would<br />

not.<br />

Other important details <strong>to</strong> note are limits, sub-limits, <strong>and</strong><br />

time frames.<br />

Finally, you will want <strong>to</strong> consider the unique risks <strong>to</strong> your<br />

business, what exclusions are present in the policy, <strong>and</strong><br />

whether or not you want <strong>to</strong> consider extensions for third<br />

parties.<br />

Businesses that need more.<br />

Some businesses, due <strong>to</strong> their real or perceived level of<br />

risk, will be more difficult <strong>to</strong> organize a policy for.<br />

Examples of types of businesses that are included in this<br />

category are adult content sites, application development,<br />

credit card processing sites, government <strong>and</strong> medical<br />

professions with a large number of records, online retailers<br />

with a large online presence <strong>and</strong> restaurant franchises.<br />

A CYBER INSURANCE GUIDE - PAGE 33


INDAGARD INSURANCE SERVICES<br />

BUT<br />

I ALREADY<br />

HAVE<br />

INSURANCE<br />

A CYBER INSURANCE GUIDE - PAGE 34


INDAGARD INSURANCE SERVICES<br />

I have public liability insurance.<br />

Doesn’t it cover cyber crime?<br />

Yes <strong>and</strong> no.<br />

While there are certainly some business insurance policies<br />

that cover cyber-related instances, there are also many that<br />

don’t.<br />

Even with a cyber liability endorsement <strong>to</strong> a liability<br />

policy, you will never get the same limits that you would<br />

with a st<strong>and</strong>alone <strong>Cyber</strong> policy.<br />

Typically, the endorsements have an aggregate limit of<br />

$50,000 which will vanish very quickly leaving you <strong>to</strong> foot<br />

the rest of the bill.<br />

Also, the extension endorsements often do not include<br />

first party cover - basically you may not be covered for PR<br />

/ Media relations cost, forensic investigation <strong>and</strong> incidents<br />

covered by multimedia cover or social engineering cover.<br />

My financial officer organises<br />

our insurance. What’s there <strong>to</strong><br />

be concerned about?<br />

While financial officers play a very important <strong>and</strong><br />

necessary role in a company, it’s worth keeping in mind<br />

A CYBER INSURANCE GUIDE - PAGE 35


INDAGARD INSURANCE SERVICES<br />

that their performance may be measured in terms of<br />

saving money.<br />

As a result, they may opt for the cheaper insurance policy<br />

that doesn’t adequately cover your business against cyber<br />

risks in order <strong>to</strong> meet their cost objectives.<br />

As the direc<strong>to</strong>r, you could be the one held accountable in<br />

case of a data breach <strong>and</strong> subsequent lawsuit. Because of<br />

this, you are going <strong>to</strong> want <strong>to</strong> make sure you are covered<br />

for events like a cyber breach.<br />

My IT people say my system is<br />

rock solid. Is there any reason<br />

<strong>to</strong> worry?<br />

While they may truly believe that’s the case (in which<br />

case, get their word in writing so that they will accept<br />

responsibility in the event of a breach), the fact of the<br />

matter is that no system, no matter how secure, is immune<br />

<strong>to</strong> breaches or vulnerabilities.<br />

You also might want <strong>to</strong> review your agreement with your<br />

IT service providers <strong>and</strong> see what happens in case of a<br />

breach.<br />

It’s a good idea <strong>to</strong> have clarity in your contract <strong>and</strong> find<br />

out exactly what would happen were your system <strong>to</strong> be<br />

exploited.<br />

A CYBER INSURANCE GUIDE - PAGE 36


INDAGARD INSURANCE SERVICES<br />

GETTING<br />

CYBER<br />

PROTECTED<br />

A CYBER INSURANCE GUIDE - PAGE 37


INDAGARD INSURANCE SERVICES<br />

How do I get a cyber insurance<br />

quote?<br />

Our process for getting you a quote has been streamlined<br />

<strong>and</strong> is made very easy.<br />

For most small businesses, getting a quote can be started<br />

here with our online quote request.<br />

We genuinely believe it’s one of the most important covers<br />

a business can have <strong>and</strong> we are on a mission <strong>to</strong> bring<br />

awareness of those risks, <strong>and</strong> how <strong>Cyber</strong> Policy can solve<br />

them <strong>to</strong> every business we can.<br />

Because not every business is the same, we will have a<br />

necessary conversation where we find out more about your<br />

operation, your risks <strong>and</strong> verify any additional information<br />

an insurer will ask <strong>to</strong> provide the quote. Then we’ll take it<br />

from there <strong>and</strong> present you with a proposal, approved by<br />

one of our highly rated insurers.<br />

Please contact us at 0456 456 085.<br />

Which product is right for me?<br />

With the influx of new products on the Australian market,<br />

it can be difficult <strong>to</strong> know which one is the right fit for your<br />

business.<br />

A CYBER INSURANCE GUIDE - PAGE 38


INDAGARD INSURANCE SERVICES<br />

This is a situation where having an experienced insurance<br />

broker can pay off.<br />

Once we get an adequate underst<strong>and</strong>ing of your business’s<br />

particular cyber risks, needs, <strong>and</strong> goals, we will work hard<br />

<strong>to</strong> match your requirements with the right product <strong>and</strong><br />

insurer.<br />

We will be your guide in the confusing (<strong>and</strong> new) world of<br />

<strong>Cyber</strong> Liability <strong>Insurance</strong>.<br />

READY FOR A<br />

QUOTE?<br />

A CYBER INSURANCE GUIDE - PAGE 39


INDAGARD INSURANCE SERVICES<br />

Conclusion<br />

At the end of the day, there are numerous high-cost risks<br />

being posed <strong>to</strong> nearly every business in the world by cyber<br />

attackers. Your business could potentially be facing huge<br />

issues with data breaches <strong>and</strong> system attacks.<br />

No system can be 100% protected from these kinds of risks,<br />

<strong>and</strong> no business can spend all of their time moni<strong>to</strong>ring<br />

their computers <strong>and</strong> data <strong>to</strong> make sure everything is fine.<br />

It makes much more sense <strong>to</strong> simply take out a cyber<br />

insurance policy so that, if such a breach or cyber event<br />

were <strong>to</strong> happen, you know your business would not be<br />

financially culpable for the damages.<br />

Contact us <strong>to</strong>day, <strong>and</strong> we will show you your options <strong>and</strong><br />

set you up with the right policy for your business. We<br />

will make sure that you have a peace of mind that your<br />

business is protected in the event of a cyber attack.<br />

A CYBER INSURANCE GUIDE - PAGE 40


INDAGARD INSURANCE SERVICES<br />

About The Author<br />

John Catibog is the direc<strong>to</strong>r of<br />

<strong>Indagard</strong> <strong>Insurance</strong> <strong>Services</strong>. He<br />

has a degree in Computer Science<br />

with Deakin University <strong>and</strong> is an<br />

experienced insurance broker with<br />

in-depth knowledge of <strong>to</strong>day’s<br />

insurance marketplace.<br />

Phone: 0456 456 085<br />

hello@indagard.com.au<br />

www.indagard.com.au<br />

A CYBER INSURANCE GUIDE - PAGE 41


Have you ever wondered if you’re getting the best insurance<br />

cover for you at the best price? Or felt that your insurance broker<br />

shouldn’t take that long <strong>to</strong> respond <strong>to</strong> your email?<br />

As a business owner, you’re constantly juggling, every single day.<br />

Staff <strong>to</strong> manage, marketing strategies <strong>to</strong> implement <strong>and</strong> financials<br />

<strong>to</strong> deal with are just some of the balls in the air.<br />

Business insurance is an essential part of your business’ financial<br />

stability but getting different quotes, comparing prices, researching<br />

the covers is time consuming.<br />

Let us free up your time so you can focus on running your<br />

business.<br />

<strong>Indagard</strong> <strong>Insurance</strong> <strong>Services</strong><br />

www.indagard.com.au<br />

Call: 0456 456 085<br />

Email: hello@indagard.com.au<br />

Write: PO Box 155<br />

Fleming<strong>to</strong>n Vic 3031


INDAGARD INSURANCE SERVICES<br />

References<br />

The Office of the Australian Information Commissioner (2018),<br />

Notifiable Data Breaches scheme, https://www.oaic.gov.au/privacy-law/<br />

privacy-act/notifiable-data-breaches-scheme<br />

Ponemon Institute (2017), 2017 Ponemon Cost of Data Breach Study,<br />

https://www.ibm.com/security/au/en/data-breach/<br />

Rapid7, Common Types of <strong>Cyber</strong>security Attacks, https://www.rapid7.<br />

com/fundamentals/types-of-attacks/<br />

Stay Smart Online (2018), Security Awareness Implementation <strong>Guide</strong>,<br />

https://www.staysmar<strong>to</strong>nline.gov.au/get-involved/guides/securityawareness-implementation-guide<br />

Simpson, K. (2017), Top 10 Tips for Data Theft Prevention, Inc., https://<br />

www.inc.com/thehartford/10-data-theft-prevention-tips.html<br />

Dual Australia (2014), DUAL CLAIMS EXAMPLES - CYBER &<br />

PRIVACY PROTECTION, http://www.athoc.com.au/news-<strong>and</strong>-info/<br />

athoc-content/uploads/2014/10/Dual-<strong>Cyber</strong>-Privacy-Protection-<br />

Claims-Examples-03-14.pdf<br />

Birkett, R. (2018), Business Law Breakfast on Privacy, Aitken Partners,<br />

Lecture 7 March 2018<br />

Joseph, M. (2018), Austbrokers <strong>Cyber</strong> Pro, Austbrokers <strong>Cyber</strong> Pro Pty<br />

Ltd, Lecture 22 March 2018<br />

A CYBER INSURANCE GUIDE - PAGE 43

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!