Cyber insurance, security and data integrity - EY

1 Cyber insurance , security and data integrityPart 1: Insights into Cyber security and risk 20142| Cyber insurance , security and data integrityContents3 Executive summary5 Pillars of information security7 Introduction to emerging Cyber threats9 data breach in Cyber liability15 Big data security challenges for insurers17 A wake-up call to re-evaluate and retool analytics 1 Cyber insurance , security and data integrity |2| Cyber insurance , security and data integrityToday, executives are acutely aware that their information is under constant attack as Cyber threats become more pervasive, persistent and insurance , security and data integrity |This is the first in a two-part series on cybersecurity that focuses on both the data and risk aspects of this topic.

2 It provides a broad view of why information security and Cyber risk are so important for insurance companies and how they can protect their businesses from rapidly emerging this paper, we look at the security aspects of Cyber liability insurance , key issues that insurers face and the underlying security model that organizations should follow. data integrity presents one of the biggest challenges for the industry and is a major focus of our discussion. Our soon-to-be-published second paper will explore the risk aspects of Cyber liability insurance and look at how insurers and reinsurers are using mitigation in their risk are increasingly exposed to Cyber thieves and are the victims of corporate espionage (also known as the Insider Threat) caused by both internal and external security breaches .

3 Fraudsters can be extremely capable of exploiting enterprise weaknesses and corporate defenses to steal intellectual property (IP), compromise corporate strategy, target customers, and pilfer or manipulate confidential and regulated information. In the wake of numerous recent data breaches , much has been published on Cyber liability insurance . Professional liability policies for companies providing computer hardware and software services have grown to include not just technology providers but all those collecting, storing and processing electronic data from their summaryKey Contacts.

4 Shaun CrawfordGlobal insurance Piesse International insurance Society (IIS) Ambassador for Asia Pacific and insurance Lead at Guardtime Cyber insurance , security and data integrityExecutives need to commit to improving information security if they are to achieve the intended benefits and demonstrate the value of their insurance , security and data integrity | security breaches can be categorized by a triad of confidentiality, availability and integrity , as shown in Figure 1. Confidentiality prevents the disclosure of information to unauthorized individuals or systems.

5 Close to 95% of all enterprise networks have been compromised by external attackers. Researchers revealed that only 3% of organizations felt safe against insider threats. Hundreds of millions of consumers have had their identity information compromised. The financial and reputational losses to businesses and shareholders stretch into tens of billions of dollars annually. Availability is making sure that computing systems, security controls and communication channels are functioning correctly. There are multiple security solutions on the market that address confidentiality and availability (denial of service).

6 Large organizations have been amassing these solutions to address their operational risk. integrity is maintaining and ensuring the accuracy and consistency of systems and data over the entire life cycle, and it remains the most nebulous, yet critical, pillar of the data security triad. integrity is the gaping hole in security today. There is a media focus on confidentiality as it is easy to understand (a loss of customer information), but almost all losses of customer information have been caused by a breach in integrity (the introduction of malware compromising the integrity of the system used to secure the data ).

7 integrity is a pre-requisite for ensuring confidentiality. Without it, encryption is worse than useless, bringing a false sense of security that almost always leads to downfall. integrity brings auditability and transparency of evidence to governance frameworks that allow the public and private sector to mutually audit each other s activities in accordance with an agreed-upon governance 1: security triadPillars of information securitySecurity modelPreventing the disclosure of information to unauthorized individuals or systemsMaintaining and assuring the accuracy and consistency of systems and dataMaking sure that the computing systems, the security controls, and the communication channels are functioning correctlyAvailabilityConfidentialityInte grity6| Cyber insurance , security and data integrityCyber liability insurance has evolved to include everyone collecting.

8 Storing and processing electronic data from their insurance , security and data integrity |Financial institutions have developed innovative mobile applications that enable mobile payment transactions for their customers. While these applications represent innovation, the institutions never planned on supporting mobile banking. Consequently, digital exchanges via the mobile transaction network are at a higher risk of compromise and/or manipulation by exploiters with increasingly sophisticated tools and skills. Moreover, infrastructure and storage outsourcing efforts supporting these applications put organizations further at risk as unregulated cloud service providers have highly differentiated security mechanisms that may not address threats to their customers.

9 Other challenges for insurers There is a stunning gap between the nature of new threats and the capabilities available to detect attacks, monitor (and stop) unauthorized exfiltration, and secure information. Few insurers have direct insights into the Cyber liabilities surrounding intangible digital assets. Many do not have the tools to provide the direct real-time awareness necessary to calculate risks to insured digital assets stored by cloud service providers or enterprise networks. There is increased awareness that companies should be accountable for private records and the security of data collected from their customers.

10 Insurers should make the fundamental assumption that any insured infrastructure will at some point be compromised, if not already. The more important and valuable the intangible ( data ) assets are (IP, customer and supplier base, etc), the more likely a and security measuresAs exposure has evolved, so have policies. Since exposure exists for any organization that handles private information, insurance companies were tasked with creating a new type of policy. Most current Cyber liability policies (or security and privacy policies) cover personal records in any format, including paper records.