Think You’re Covered? Think Again: Cybersecurity, Data Privacy, and Cyber Insurance

12020 WithumSmith+Brown, PC
Think You’re Covered?
Think Again:
Cybersecurity, Data Privacy and Insurance
CapitalOne | Withum | McElroy, Deutsch, Mulvaney & Carpenter, LLP

BE IN A POSITION OF STRENGTH
Housekeeping
• This is a CPE session – 1 CPE Credit in Information Technology
• Webinar is being recorded
• 45 minutes session
• 15 minutes Q&A
• Send in your questions!
• Slides and recording will be emailed after the webinar

32020 WithumSmith+Brown, PC
The contents contained within this slide deck may contain basic
and preliminary observations. We also refer to some generally
accepted principles for forensic investigations.
All observations are subject to further investigation and
explanation of facts and are therefore subject to change.
Additional evidence and forensic analysis may be required to
support any findings or observations.
This presentation is protected by U.S. copyright laws. Reproduction and/or distribution of the presentation without written permission of Withum is prohibited.
©2020 WithumSmith+Brown, PC All rights reserved.
Disclaimer

What We Do…

Withum Cyber Team

Cyber Attacks Increase Across All Areas
• Finance
• Healthcare
• Manufacturing
• Real Estate
• Non-Profits
• Automotive
• Transportation
• E-Commerce
• Datacenters
• Cloud Computing…and much more

What is the ‘New Normal’

COVID-19 Related Cyber Attack Statistics
Since COVID-19 pandemic began:
• Phishing Websites: Increased 350%
• Banks: 238% increase in cyberattacks
• Ransomware attacks: Increased 148%
• Average Ransomware Demand: Increased by 33%

COVID-19: Remote Work Force
• Phishing attacks: Increased 667%
• Remote Workforce Metrics
• Attack Surface Increase
First Line of Defense…God Help Us.

Cyber Security Stats and Facts
• Cybercrime economy in profits:
• Cybercrime Damages:
• Ransomware Attacks:
• Top Country Targeted:
• Est. Records Exposed 2018 - 2023:
• Est. Cost Per Record Exposed:
• Average Cost of Data Breach:
• Dark Web Cybercrime Toolkit Cost:
Source: IBM/Ponemon
$1.5 Trillion
$6 Trillion by 2021
14 Sec. | 11 Sec. 2021
USA
146 Billion
$242 per record
$8 Million

COVID-19 Related Cyber Attack Statistics (Cont.)
Cyber attacks: Increased 600%!!

Results of Recent Cyber Attacks

Modern Warfare

ü CONFIDENTIALITY
ü INTEGRITY
ü AVAILABILITY
What is Cyber Security in Today’s New Normal…

Confidentiality
Zoom: 500k Stolen Passwords
Twitter Hack: Phone Spear Phishing
Marriott Data Breach: 500M Guests
MGM Data Dump: 142M Guests
FireEye: Recent Data Breach

Data Integrity

Availability

Incident Response Plan
Call Govt. – they’ll solve it.

Cyber Insurance

The Next Cold War is Here, and it’s all about
Data

Modern Business Threats
(Internal Threats)
Cyber Criminals
Organized Crime
Cyber Terrorism
Hacktivism
Regulatory | Legal Sanctions
Nation State Actors targeting SMBs – Enterprise Environments
Modern Business
Competitors

Understanding Data Privacy Considerations
and Reducing Compliance Failures
Cyber Insurance

Understanding Data Privacy Considerations and
Reducing Compliance Failures
Ø Why do privacy compliance failures occur?
q No adequate understanding of data flows
§ Know what data you have and who you share it with
q No understanding of regulatory landscape
§ Understand thresholds that can trigger liability under certain privacy laws such
as CCPA, Biometric Information Privacy Act or COPPA
q Institutional Idiosyncrasies
§ Smaller entities are particularly vulnerable

Data Privacy
Considerations
Reducing Compliance Failures
Ø Multitude of Federal and State Laws
q Competing compliance requirements
may overtax resources of respondents
§ Regulated entities may focus exclusively on first
tier HIPAA, GLBA and ignore secondary
regulations (e.g., COPPA, CAN SPAM, Model
Insurance Data Security Act, New York DFS
Cybersecurity Regulation).
§ Regional or National Laws (CCPA/CPRA, GDPR)

Scalable Universal Compliance Infrastructure
Getting the Basics Right
Triangulation Approach to Multi-Jurisdictional Compliance Requirements
qAvoid institutional conflicts of interest (IT, Marketing)
qMulti layered privacy organization with appropriate KPIs
Organizational Foundation. Privacy Belongs on the C-level

Invest in top-notch Privacy Notice
qYour calling card in terms of privacy compliance
qOne step towards § 5 FTC Act Compliance
qUse basic fair processing principals, such as Transparency, choice, limited data
collection for specific purposes
qPrivacy notice can double as a basic check list for a variety of regulatory schemes

Ø Invest in a professional risk assessment of your security
risk
Ø Adopt reasonable security measures. FTC considers failure
to do so potentially as “unfair business practice”
Ø Invest in high-end employee training

Regulatory Risk Management
ØCompliance as Incremental Process
qAllocate limited compliance resources based
on enforcement risk
§ Who is my primary regulator?
§ Enforcement Priorities
§ Is there a leniency program? What are the criteria to qualify?
Are there cure periods?
§ All politics is local – and so is compliance
§ Use attorneys or consultants with background knowledge of the
regulatory agencies in each state

Civil Litigation
Ø Recent trend towards courts holding that
businesses have a common law duty to use
reasonable security measures to protect
personal information
Ø Moreover, businesses may face litigation under
theories such as breach of contract, breach of
fiduciary duty, and consumer fraud in the
event of a cybersecurity incident
Ø For public entities, cybersecurity incidents can
lead to class action shareholder derivative
lawsuits against directors and officers

Cyber Insurance
Ø Typically covers business interruption, remediation, and
civil liability.
Ø Doesn’t cover reputational harm and loss of consumer
confidence.
Ø Cyber insurance may be causing a spike in ransomware
since cyber criminals may believe that victims covered by
cyber insurance that potentially covers ransomware
payments will quickly pay demanded ransoms.

Acts of War Exception
Ø Some insurers have taken the position that cyberattacks
perpetrated by foreign governments are not covered
pursuant to insurance policies’ exceptions for “Acts of
War.”
Ø There are pending lawsuits challenging insurers’ denial of
coverage for the NotPetya ransomware attack on the basis
that it was an “Act of War” perpetrated by Russia.

Cyber
Insurance and
Ransomware
A recent Indiana Court of Appeals case
held that a cyber insurance policy that
covered “property loss” did not cover a
ransom paid to a hacker in order to
unlock the insured’s computer system
after a ransomware attack.

What’s Really Going On…What You Need to Do

Local & Hybrid Networks

Cloud is the Solution!

Sample Suspicious Sessions
Origin: Iran | Industry: Automotive

Sample Suspicious Sessions: Firewall Traffic Patterns
Origin: Russia | Industry: Automotive

Sample Incidents
Target: Major Tri-State Hospital | Timeframe: Onset of COVID-19 Origin: Iran

Dormant Accounts / NO PW Change Since 2010

Switches Not Patched
Firmware was released in 2017.
Switch Has not been updated in
~3 years.

Inner and Outer Perimeter Findings
• Exfiltration of 5 terabytes+ of confidential SAMPLE data.
• Data to Paper Equivalency 5TB = 375,000,000 Pages
• Multi-Billion Dollar Business Identified without a Single firewall
• Medium Sized operating their entire network on Guest Wi-Fi
• No Network Segmentation / Flat Environment
• Passwords Digitally Stored in Clear
• No 2FA
• Computers without ANY Anti-Virus
• Saved Credentials
• No Active Monitoring, DLP, Syslogging, Limited to No Firewall Rules
• Highly Susceptible to Phishing Attacks, Rooting, Priv. Escalations, Long
Term command and controls of environment.
• Ability to jump into DMS and attack other networks.

• Sharing Computers w/Family Members
• Passwords left in open; taped to monitors
• Personal Identifiable Information (“PII”) and financial records left exposed
• No Incident Response Experience
• Server rooms left accessible to the public.
• No security controls to restrict browsing/downloading malware- no web
filtering
Security Assessments Summary Findings

• No Anti-virus (“AV”) on some systems
• No data controls to secure data; Able to easily extract data from
environment
• Patching not current on some systems
• No Business Continuity plan, Incident Response Plan or network or data
diagrams for IT infrastructure
• Systems and Data Well Beyond Lifecycles
Security Assessments Summary Findings

How to Protect Your Business
“Know your enemy and know yourself - Sun Tzu”

Protect Your Business Before the Downpour
§ Threat Emulation aka Red Teaming
§ vCISO / vCCO Analysis of Sec. Control Framework
§ Business Continuity & Incident Preparedness
§ Data Privacy Review & Analysis
§ Cyber Insurance Review & Analysis
§ Seek Additional Advice on Available Services from CapitalOne

51
SM
Want to Get in Touch?
Withum’s Cyber Team
Wcyber.info@Withum.com
CapitalOne
Edward Dewalters
edward.dewalters@capitalone.com
McElroy Deutsch:
Diane Reynolds
DReynolds@mdmc-law.com

Think You’re Covered? Think Again: Cybersecurity, Data Privacy, and Cyber Insurance

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Think You’re Covered? Think Again: Cybersecurity, Data Privacy, and Cyber Insurance

Ähnlich wie Think You’re Covered? Think Again: Cybersecurity, Data Privacy, and Cyber Insurance (20)

Mehr von Withum

Mehr von Withum (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Think You’re Covered? Think Again: Cybersecurity, Data Privacy, and Cyber Insurance