www.berea-group.co m Cyber 101 Aaron Yates Chief Executive, Berea A crash course on cyber security, data protection and cyber insurance. Chelmsford CII Wednesday, 13th February 2019
Berea • Focused on high scale cyber support for SMEs. • Work with insurers, MGAs and insurance brokers. • Happy to explain more after our session.
Why are we here? • Is it really a problem? • What, exactly, is the problem? • What is cyber insurance? • What’s happening with distribution? • How do Berea fit in?
Let’s make it real
Pop quiz Is your website a risk? www.securityheaders.io Try us, too! www.berea-group.com
Pop quiz Is your iPhone secure? Let’s find out… Settings → Touch ID/Face ID and Passcode → Erase Data Is the setting green or grey ?
Pop quiz Have you been compromised? www.haveibeenpwned.com If you’ve been with your employer less than a couple of years try using your personal email address.
What just happened? We have evidenced We have made a These insights are that you have very small part symptomatic of a vulnerabilities of the issue visible far bigger problem
The far bigger problem “ Cyber” (Oct 17 - Oct 18) Fires (Oct 17 - Oct 18) • 1.6m offences • 167,150 attended virus/Computer Misuse Act. to nationally. • 1.5m cyber-related • Of which 15,577 were fraud offences. commercial premises. 8,493 /day. 458 /day. Probably not insured. Highly likely to be insured.
What’s the problem?
Why is it now such a problem? Competition Efficiency Profitability demands for c reating Because use of technology creates a vicious cycle
Pop quiz Have you ever sent an email after 10pm?
Governance is patchy-to-MIA for most businesses Layers of legacy systems under new technology
What’s happening, and why?
We have Who has a And uses To exploit a Creating an actor motivation a vector vulnerability an incident… Staff Website Human Accident Financial Loss/Costs Organised Crime Negligence Email Software Reputation Damage Opportunists Physical media Hardware Malice Legal/Regulatory Script Kiddies Financial Physical office Hacktivists Social media Ethical Hackers Moral Telephone Nationstate Supplier Ego Customer
Cyber Information Data Security Protection
Information Security Background Key concepts • Not legally mandated • Confidentiality • Sensible business practice • Integrity • Identify and manage risks • Availability • Risk score prioritises activity
Data Protection Background Why is legislation changing? • Legally mandated by GDPR • 20 years of change • Requires data to be stored securely • Decisions are being made about us • Honour the rights of individuals Consequences • Penalties of up to 4% GAT or €20m • Lawful basis for processing • Reputation damage • Evidence compliance activity
Information Data Security Protection Financial Legal Reputation loss issues damage
Cyber insurance?
When the worst happens 1 2 3 Identify what Stop the attack, Contend with has happened restore service the fallout
1st Party Breach/Incident Event Costs
3rd Party Privacy (Regulatory + Liability) 1st Party Breach/Incident Event Costs 3rd Party Network/Security Liability
3rd Party Privacy (Regulatory + Liability) 1st Party Crime/ “Cyber” Breach/Incident Fidelity Business Event Costs Interruption 3rd Party Network/Security Liability
3rd Party Privacy (Regulatory + Liability) Stock deterioration 1st Party Crime/ “Cyber” Breach/Incident PCI-DSS Fidelity Business Event Costs Interruption Transmit A Virus... 3rd Party Network/Security Liability
Distribution issues
+ E&O + Noise + Silent Cyber Brokers Media Insurers & MGAs Brokers Trade Assocs Insurers & MGAs Broker The client Consultants Brokers Insurers & MGAs Brokers Staff x90~ x lots
What needs to happen? 5 A better, risk managed buying journey Invest & 4 Maintain ISO 27001 3 1 2 Cyber Staff Risk insurance awareness control
Governance specifications A growing alphabet soup With road blocks • Cyber Essentials • “DIY” possible with expertise • ISO 27001 • Consultants cost >£1,000 +VAT • PCI-DSS • Too few experts • GDPR Fundamentals • Firms are unsure where to start • Insurance/client requirements
Cyber Essentials What is it? Background • Technical governance specification • Standardise procurement assurance • A recognised certification • Minimum benchmark for British firms • Reduce common threats by 70-80% • Recognised by the ICO for GDPR • Join risk management and insurance
How Berea fit in Insurers & MGAs Insurance Brokers Embed Cyber Essentials Proactively engage clients with as a risk management value Berea’s unique services as a add to your PI and SME ready-made sales journey to packaged offerings. buying cyber insurance.
Thank you Any questions?
Recommend
More recommend
