CYBER THREATS AND HOW TO A VOID THEM AGENDA 1. Development of the cyber world 2. Threats to small businesses 3. Cyber Recovery Insurance
Y our presenters Anne Jackson Sarah Morton Gary Hibberd Sales Director, Lorega Sales and Marketing Managing Director, Manager, Lorega Agenci Lorega LTD
Increasing global internet use • 3.7 billion internet users globally • Devices not limited to desktop and mobiles • Huge increase in internet connected devices, including thermometers, refrigerators and smart watches. http://wearesocial.com/uk/blog/2017/01/digital-in-2017-global-overview Lorega LTD
http://www.excelacom.com /resources/blog/2016- update-what-happens-in- What happens online in 60 one-internet-minute seconds? https://iabuk.net/research/library/time-spent-online-july-december-2015 Lorega LTD
But what else is happening? https://www.helpnetsecurity.com/2016/04/08/dark-web-content/ Lorega LTD https://darkwebnews.com/help-advice/access-dark-web/
Motivations for cyber criminals • Cyber crime and data breaches aren’t always about money • Other motivations include hacktivism, teenage boredom and training for larger crimes http://www.hackmageddon.com/2016/02/16/january-2016-cyber-attacks-statistics/ Lorega LTD
THREATS TO SMEs What’s out there? Lorega LTD
Types of threats to businesses rd par Ro Rogue Employee 3 rd Negl Ne glige gence Ou Outsider r Thre reat party an and d vendo dor threat at • • Employee could Physical theft of • • Hacking Cloud and other send data to the data storage or data • Hacktivism wrong place or systems • Data could be source • Malware, sold to • Network interruption • Physical loss of ransomware and competitors hardware such as a • viruses Loss of data or theft of mobile phone or • Could be used data • Leads to theft of laptop for extortion • data, unauthorised Backdoor intrusions • Victims of phishing access to systems or emails total shutdown of systems and websites Lorega LTD
Types of threat: Rogue Employees • May steal data when leaving to join a competitor • Could use data for own use • Could lead to criminal convictions Avoid the threat • Ensure robust data security policies and procedures in place • Only grant access to data or certain technologies if necessary Lorega LTD
Types of threat: Negligence • PICNIC – Problem In the Chair, Not In the Computer • Rise of BYOD Avoid the threat • Ensure proper disposal of sensitive data • Password protect devices • Have backups in place Lorega LTD
Types of threat: Outsider Threats • This is what most people think about when they think of cyber security and cyber crime Avoid the threat • 10 steps to avoid cyber bugs and thugs • Protect systems • Invest in cyber security • Have a cyber insurance policy in place • Secure WIFI networks Lorega LTD
Types of threat: Phishing emails • UK the most targeted nation for phishing attacks and ransomware in 2015 • 85% of organisations reported being the victim of a phishing attack in 2015 • 30% of phishing emails are opened • 9 out of 10 phishing emails carry ransomware or malware Avoid the threat • If it looks dodgy, impersonal, it probably is • Don’t click on attachments or links from unknown senders • Don’t email personal or financial information • Never go to banking websites from emails • Turn on two factor authentication Lorega LTD
Sophisticated Google Drive phishing • Tom Scott received an email that looked like a google drive attachment • The sending address was disguised as a friend’s email Lorega LTD
Look familiar? Lorega LTD
Types of threat: CEO Fraud Lorega LTD
Types of threat: CEO Fraud • 1 in 3 companies have been victims of CEO fraud email • Over 80% of security professionals believe executives in their organisation could fall for targeted phishing scams • Often ask for bank details, but employee records have also been targeted • Can happen on the phone Avoid the threat • Would your CEO normally ask you to make that payment or send those details? • Ring to check • Be vigilant and look out for spelling mistakes, different ways of speaking or anything unusual • Always check bank statements Lorega LTD
Types of threat: Ransomware • 54% of UK companies hit by ransomware attacks last year • 37% of organisations affected have paid the ransom • 32% of UK have lost files or data • 34% of companies globally have lost money • Average of 9 hours spent on remediation • Only 4% of businesses confident in dealing with ransomware Avoid the threat • Never pay the fine • Always backup data • Don’t download .exe or other program files from unknown sources • Don’t allow macros in Excel documents downloaded from the Internet • Always keep anti-virus software up to date Lorega LTD
What do they look like? Lorega LTD
Types of threat: DDOS • Frequency of distributed denial-of-service (DDoS) attacks has increased more than 2.5 times over the last 3 years. • The average size of DDoS attacks is increasing steadily and approaching 1 Gbps, enough to take most organizations completely offline. • Globally the number of DDoS attacks grew 25 percent in 2015 and will increase 2.6-fold to 17 million by 2020. Avoid the threat • Server scripts can alert you if a DDoS attack is suspected • Overprovision site bandwidth to accommodate more traffic • Have a plan to communicate with customers Lorega LTD
What can be done? An introduction to Cyber Recovery Insurance Lorega LTD
Impact of a data breach on small businesses • Incidence of cyber attacks is rising • Any loss of personal information can be complex and time-consuming to deal with • Trading impact of loss of confidence in the business and brand • New EU regulations could mean heavy fines for your customers - businesses are currently exposed to fines up to £500K, but this could go up to $20m or 4% of annual turnover • Cost of restoring IT systems • Risk of third party claims • Threat of business failure Lorega LTD
GDPR • Businesses have a responsibility to ensure appropriate and proportionate security of personal data held • Sensitive personal data is of particular concern • Data subjects must give consent for their data to be held • Businesses must report to the ICO within 72 hours of becoming aware of the data breach • New legislation comes into play on 25 th May 2018 – businesses need to be ready now Lorega LTD
Cyber Recovery Insurance • Cyber Recovery is an insurance policy which provides and pays for the cost of a Cyber Emergency Response Team (CERT) to deal with the crisis when a system has been breached • Administered by Lorega, who have many years of experience helping customers when they need it most • Payment of certain fines, penalties, awards, damages and the cost of credit monitoring • Helps businesses recover from a covered data security breach Lorega LTD
What is a data security breach? • Occurs where ‘Personal information’ is copied, transmitted, viewed or stolen by anyone unauthorised to do so • This could include the loss or theft of a laptop, hacking or unauthorised access to computer systems or data files • Personal data which identifies an individual - even without a name associated with it • Includes exposure to identity theft or aspects of a person’s life Lorega LTD
In Inciden ent Managem emen ent In Inves estigation & Res estoration Cr Crisis Respon onse Awards, Aw s, fines s & & monitoring • Advice to ensure • • • Investigation and IT Emergency line In the event of a compliance with Data advice in respect of available 24/7, Regulatory Security Law Regulatory 365 days a year investigation: • Investigation and IT Investigation • • Initial incident Payment of Regulatory advice in respect of • third party claims Legal advice in respect notification and costs and damages • of Regulatory full assessment Legal and PR advice in • Payment of Regulatory respect of third party Investigation • Advice on fines and penalties claims and protection • Assisting with the immediate • of business reputation Payment of credit restoration of emails, actions monitoring costs online and other software systems Li Limit Li Limit Li Limit Li Limit £300 £100,000 £5000 £25000 Lorega LTD
Policy details • Underwritten by Hiscox • 24/7, 365 days a year claims helpline, with nationwide response • Provides cover for first covered data breach • Breaches must be notified within 12 hours of discovery within the period of insurance Lorega LTD
Exclusions • Excludes certain sectors – local and central government and government agencies, health service and housing associations • Any subsequent data breach, a data breach discovered outside period of insurance, or occurring outside of UK • Other exclusions, set out in Section 5 of the policy schedule, apply Lorega LTD
Recommend
More recommend
