PREDICTIVE MODELING CONFERENCE Data Workshop Cyber Risk Models - - PowerPoint PPT Presentation

PREDICTIVE MODELING CONFERENCE

Data Workshop

• Cyber Risk Models
• Loss Aggregation Models

Advisen’s Data Assets

CYBER RISK MODELS

Cyber Case Count over Time

Cyber Cases Entered per Day

Case Type Composition

Total : 21,817

Distribution of Cyber Cases

Case Type \ Case Status Event Response Costs Economic Loss Litigated Cases Fines & Penalties Total

Digital Data Breach, Loss, or Theft 10,838 77 239 552 125 11,831 Privacy Violations 1,232 3 1,176 124 2,535 Improper Disposal/Distribution, Loss or Theft (Printed Records) 2,205 6 23 125 60 2,419 System/Network Security Violation or Disruption 2,036 22 59 33 10 2,160 Phishing, Skimming 609 1 71 34 4 719 Identity Theft/Fraudulent Use or Access 172 1 303 209 19 704 Improper Collection of Digital Data 278 1 287 42 608 Digital Asset Loss or Theft 90 14 20 2 126 Cyber Extortion 77 13 2 1 93 Undetermined/Other 51 51 Total 17,588 107 726 2,438 387 21,246

Mapping

MSCAd Case Type Insuring Agreements

Digital Data Breach, Loss, or Theft Crisis Response and Notification Expenses Electronic Theft Identity Theft/Fraudulent Use or Access Privacy Injury Liability Phishing, Skimming Privacy Event Response Improper Disposal/Distribution, Loss or Theft (Printed Records) Crisis Response and Notification Expenses Digital Asset Loss or Theft Privacy Injury Liability Loss or Damage to Insured’s Systems Electronic Theft Cyber Extortion Threats or Extortion Response System/Network Security Violation or Disruption Cyber Liability/System Security Liability Crisis Response and Notification Expenses Business Interruption And Extra Expense Loss or Damage to Insured’s Systems Improper Collection of Digital Data Cyber Liability/System Security Liability Crisis Response and Notification Expenses Electronic Theft Privacy Violations Privacy Injury Liability Privacy Event Response

Event Count by Company Size

Company Size PRV PUB GOV NPR Unknown Total (0, 1M] 1,390 12 19 89 1,510 (1M, 10M] 1,569 17 57 114 1 1,758 (10M, 100M] 1,604 133 267 122 2,126 (100M, 1B] 1,596 469 317 116 2,498 (1B, 10B] 1,031 1,431 440 77 2,979 (10B, 100B] 181 2,277 403 6 2,867 (100B, ) 31 457 700 1,188 Unknown 1,900 59 560 108 35 2,662 Total 9,302 4,855 2,763 632 36 17,588 Company Type

Case Count by Affected Count

Affected Count Range Case Count (0, 10] 2,144 (10, 100] 1,809 (100, 1K] 2,363 (1K, 10K] 2,558 (10K, 100K] 1,450 (100K, 1M] 591 (1M, ) 366 Total 11,281

INDUSTRY GROUPING

SIC Classification

Industry Event Count Litigation Count Fines/Penalties

Agriculture, Forestry & Fishing 20 3 1 Finance, Insurance & Real Estate 2959 413 81 Manufacturing 993 174 14 Mining & Construction 115 30 8 Public Administration 2706 204 51 Services 7764 1278 172 Transportation & Public Utilities 952 248 44 Wholesale & Retail Trade 1733 471 26

NAICS Classification

Industry Event Count Litigation Count Fines/Penalties

Accommodation and Food Services 455 71 Administrative and Support and Waste Management and Remediation Services 594 152 18 Agriculture, Forestry, Fishing and Hunting 7 Arts, Entertainment, and Recreation 158 32 3 Construction 80 21 5 Educational Services 1400 50 5 Finance and Insurance 2432 365 63 Health Care and Social Assistance 1836 184 40 Information 1286 410 55 Management of Companies and Enterprises 127 11 5 Manufacturing 679 99 10 Mining, Quarrying, and Oil and Gas Extraction 24 Other Services (except Public Administration) 439 43 2 Professional, Scientific, and Technical Services 855 217 23 Public Administration 2083 165 42 Real Estate and Rental and Leasing 130 35 7 Retail Trade 861 314 16 Transportation and Warehousing 189 26 2 Utilities 63 9 Wholesale Trade 232 44 1

Industry Groupings: Methodology

Look at NAICS 6 Level Does it meet the following criteria?  Case count > 90  Company count > 2,000  Revenue sum > $50B  Frequency upper percentile threshold = 50% Yes No NAICS 6 Grouping Selected Look at NAICS 4 Level Does it meet the following criteria?  Case count > 100  Company count > 15,000  Revenue sum > $300B  Frequency upper percentile threshold = 75% Yes No NAICS 4 Grouping Selected NAICS 2 Grouping Selected

• NAICS 6 Level

– Grouping is selected only if

• Case count > 90
• Company count > 2,000
• Revenue sum > $50B
• Frequency upper percentile threshold = 50%

Industry Groupings: Methodology

Example (NAICS6)

(Click industry name and get insight) 522320 - Financial Transactions Processing, Reserve, and Clea 522110 - Commercial Banking 522320 - Financial Transactions Processing, Reserve, and Clea Frequency Top Increase Top Decrease Average Affected Count Top Increase Top Decrease Industry 522320 - Financial Transactions Processing, Reserve, and Clearing House Activities has the top event frequency increase, from 30 (2014-Q2) to 32 (2015-Q2) Industry 522110 - Commercial Banking has the top average affected count increase, from 83,991 (2014-Q2) to 3,211,535 (2015-Q2) * The dots stand for the numbers of 2014-Q2, and the arrows stand for the numbers of 2015-Q2. 519190 - All Other Information Services 518210 - Data Processing, Hosting, and Related Services 611310 - Colleges, Universities and Professional Schools 519190 - All Other Information Services 518210 - Data Processing, Hosting, and Related Services 511110 - Newspaper Publishers 522320 519190 522110 522320 519190 611310 100 1,000 10,000 100,000 1,000,000 10,000,000 50 100 150 200 250 300 350 400 Average Affected Count (per event) Event Frequency (per $100B Revenue)

Top Gain/Loss Industry Compared to Last Year

2015-Q2 vs. 2014-Q2

• NAICS 4 Level

– Grouping is selected only if

• Case count > 100
• Company count > 15,000
• Revenue sum > $300B
• Frequency upper percentile threshold = 75%

Industry Groupings: Methodology

Case count threshold 100 Company count threshold (in K) 15 Revenue sum threshold (in $1B) 300 Frequency upper percentile threshold 0.75 NAICS NAICS Desc Case # Comp # (K) Rev ($1B) Rest case # Rest Comp # (K) Rest Rev ($1B) Freq/C # Freq/R SumValid Freq/C Valid Freq/R Sum Selected? 5111 Newspaper, Periodical, Book and Directory Publishers 225 29.6 701.8 130 21 416.6 6.3 0.31 6.29 0.31 TRUE 5112 Software Publishers 195 15.9 1,527.4 195 16 1,527.4 12.2 0.13 12.24 0.13 TRUE 5171 Wired Telecommunications Carriers 170 15.6 929.1 170 16 929.1 10.9 0.18 10.92 0.18 TRUE 5179 Other Telecommunications 175 19.1 689.0 175 19 689.0 9.2 0.25 9.16 0.25 TRUE 5221 Depository Credit Intermediation 1,125 74.2 4,737.7 220 35 824.3 6.4 0.27 6.37 0.27 TRUE 5222 Non-Depository Credit Intermediation 208 27.3 3,211.7 208 27 3,211.7 7.6 0.06 7.61 0.06 TRUE 5239 Other Financial Investment Activities 276 36.9 1,176.3 276 37 1,176.3 7.5 0.23 7.49 0.23 TRUE 5241 Insurance Carriers 501 19.1 8,359.3 501 19 8,359.3 26.2 0.06 26.22 0.06 TRUE 5412 Accounting, Tax Preparation, Bookkeeping and Payroll Services 116 38.2 343.7 116 38 343.7 3.0 0.34 3.04 0.34 TRUE 5614 Business Support Services 212 47.8 388.1 212 48 388.1 4.4 0.55 4.43 0.55 TRUE 6211 Offices of Physicians 504 215.8 957.1 504 216 957.1 2.3 0.53 2.34 0.53 TRUE 6219 Other Ambulatory Health Care Services 108 23.9 333.3 108 24 333.3 4.5 0.32 4.52 0.32 TRUE 6221 General Medical and Surgical Hospitals 788 26.6 4,130.8 788 27 4,130.8 29.6 0.19 29.60 0.19 TRUE 8139 Business, Professional, Labor, Political, and Similar Organizations. 220 71.3 535.0 220 71 535.0 3.1 0.41 3.09 0.41 TRUE

Example (NAICS4)

(Click industry name and get insight) 5171 - Wired Telecommunications Carriers 5171 - Wired Telecommunications Carriers 5241 - Insurance Carriers 5179 - Other Telecommunications Frequency Top Increase Top Decrease Average Affected Count Top Increase Top Decrease Industry 5171 - Wired Telecommunications Carriers has the top event frequency increase, from 46 (2014-Q2) to 59 (2015-Q2) Industry 5171 - Wired Telecommunications Carriers has the top average affected count increase, from 12,083,423 (2014-Q2) to 240,774,098 (2015-Q2) * The dots stand for the numbers of 2014-Q2, and the arrows stand for the numbers of 2015-Q2. 5112 - Software Publishers 8139 - Business, Professional, Labor, Political, and Similar Org 6221 - General Medical and Surgical Hospitals 5239 - Other Financial Investment Activities 5112 - Software Publishers 5179 - Other Telecommunications 5614 - Business Support Services 5111 - Newspaper, Periodical, Book and Directory Publishers 5171 5239 5179 5614 5111 5171 5241 5179 8139 6221 100 1,000 10,000 100,000 1,000,000 10,000,000 100,000,000 1,000,000,000 10 20 30 40 50 60 70 80 Average Affected Count (per event) Event Frequency (per $100B Revenue)

Top Gain/Loss Industry Compared to Last Year

2015-Q2 vs. 2014-Q2

• NAICS 2 Level

– Grouping is selected only if

• Case count > 50
• Company count > 1,000
• Revenue sum > $1T
• Frequency upper percentile threshold = 70%

Industry Groupings: Methodology

Case count threshold 50 Company count threshold (in K) 1 Revenue sum threshold (in $1B) 1000 Frequency upper percentile threshold 0.7 NAICS NAICS Desc Case # Comp # (K) Rev ($1B) Rest case # Rest Comp Rest Rev ($ Freq/C # Freq/R Sum Valid Freq/ Valid Freq/ Selected? 22 Utilities 66 32 2,104.6 66 32 2,104.6 2.1 0.03 2.08 0.03 TRUE 31 Manufacturing 270 100 5,220.4 270 100 5,220.4 2.7 0.05 2.71 0.05 TRUE 45 Retail Trade 382 155 8,542.6 382 155 8,542.6 2.5 0.04 2.46 0.04 TRUE 51 Information 1,409 150 ###### 299 78 9,826.5 3.8 0.03 3.82 0.03 TRUE 52 Finance and Insurance 2,667 337 ###### 444 219 3,347.7 2.0 0.13 2.03 0.13 TRUE 54 Professional, Scientific and Technical Services 1,003 774 6,432.7 887 736 6,089.0 1.2 0.15 1.21 0.15 TRUE 61 Educational Services 1,497 202 4,815.8 578 202 3,153.1 2.9 0.18 2.86 0.18 TRUE 62 Health Care and Social Assistance 1,954 584 9,313.5 554 318 3,892.3 1.7 0.14 1.74 0.14 TRUE 72 Accommodation and Food Services 441 290 2,465.1 441 290 2,465.1 1.5 0.18 1.52 0.18 TRUE 81 Other Services (except Public Administration) 531 364 2,211.3 311 293 1,676.3 1.1 0.19 1.06 0.19 TRUE 99 All Unclassified Establishments 124 20 2,296.0 124 20 2,296.0 6.1 0.05 6.14 0.05 TRUE

Example (NAICS2)

(Click industry name and get insight) 61 - Educational Services 33 - Manufacturing 31 - Manufacturing 54 - Professional, Scientific and Technical Services Frequency Top Increase Top Decrease Average Affected Count Top Increase Top Decrease Industry 61 - Educational Services has the top event frequency increase, from 13 (2014- Q2) to 17 (2015-Q2) Industry 33 - Manufacturing has the top average affected count increase, from 4,382,668 (2014-Q2) to 27,380,291 (2015-Q2) * The dots stand for the numbers of 2014-Q2, and the arrows stand for the numbers of 2015-Q2. 45 - Retail Trade 44 - Retail Trade 55 - Management of Companies and Enterprises 48&49 - Transportation and Warehousing 33 - Manufacturing 55 - Management of Companies and Enterprises 54 - Professional, Scientific and Technical Services 62 - Health Care and Social Assistance 61 48&49 33 55 54 62 33 31 54 45 44 55 100 1,000 10,000 100,000 1,000,000 10,000,000 100,000,000 20 40 60 80 100 120 Average Affected Count (per event) Event Frequency (per $100B Revenue)

Top Gain/Loss Industry Compared to Last Year

2015-Q2 vs. 2014-Q2

RELATING AFFECTED COUNT TO COSTS

Relationship between Affected Count and Response Cost

Relationship between Company Revenue and Affected Count – Data Breach

Relationship between Company Revenue and Affected Count – Data Breach (Retail)

Relationship between Company Revenue and Affected Count – Data Breach (Public)

Relationship between Company Revenue and Affected Count – Data Breach (Manufacturing)

COST CALCULATOR

Affected Count Probability Curve

Loss Probability Curve

LOSS ACCUMULATION MODELS

• What is a scenario?

– Sequence of development of events

• What is it used for?

– Scenarios can be used to create aggregation

• r loss accumulation models

– Create a composite picture of loss which highlights the interrelation between parties from events that have occurred

Scenarios

BIG BLUE COLLAPSE

Miller Park, 1999

• July 14, 1999
• Miller Park (Milwaukee, WI)
• Collapse of a giant Lampson International

crane known as "Big Blue” during the construction of a stadium for the Milwaukee Brewers Baseball franchise

• 3 men were killed when a cage

suspended from another crane was knocked over as Big Blue fell

Overview

Main Parties Involved

• Southeast Wisconsin Professional Baseball

Park District: Owner of Miller Park baseball stadium

• HCH Construction: General contractor
• Mitsubishi Heavy Industries: Under contract

with HCH – responsible for installing retractable roof

• Danny’s Construction: Ironworker

subcontractor

• Lampson: Crane services subcontractor

Property

• Southeast Wisconsin Professional Baseball

Park District sued Mitsubishi and HCH for damages of property caused by the crane collapse

• Agreement reached:

– District to receive nearly $33M – $4M to come from Mitsubishi to cover repairs for defects in the roof

Services/Operations

• Mitsubishi filed a counterclaim against

Southeast Wisconsin Professional Baseball Park District arguing that it was owed money for the extra time and materials needed to complete the roof

• Agreement reached:

– Mitsubishi to receive $22M – $6M to come from the district to cover claims of cost overruns

Property Damage

HCH Construction (General Contractor) Mitsubishi Heavy Industries America Southeast Wisconsin Professional Baseball Park District

Services/Operations Property

Lawsuits Filed Claims/Settlements

$6M $4M

Settlement with Estates

• HCH:

– Settled with estates of deceased for $2M

• Lampson:

– Settled with estates of deceased for $5M

• Mitsubishi:

– Court found them 97% responsible – Final settlement reached: $57M

Workers Compensation

Estates of: Jerome W. Starr William R. Degrave Jeffrey A. Wischer HCH Construction (General Contractor) Mitsubishi Heavy Industries America Lampson International (Crane Manufacturer)

Workplace Accident/Injury

Lawsuits Filed Claims/Settlements

$2M $57M $5M

OSHA Investigation

• Focused on general requirements relating

to safe operation of cranes and personnel platforms as well as conditions which may have contributed to the crane collapse

• Failure to take the effect of wind into

account was a significant factor in the collapse of the crane

Willful Citations

• Mitsubishi:

– crane's rated load exceeded – workers not kept clear of suspended 450 ton load – workers hoisted in personnel platforms when weather conditions were dangerous

• Lampson International:

– crane's rated load exceeded – crane's load indicator improperly calibrated

• Danny’s Construction:

– employees not kept clear of the suspended roof section while it was suspended – employees hoisted in personnel platforms when weather conditions were dangerous

OSHA Fines/Penalties

HCH Construction (General Contractor) Mitsubishi Heavy Industries America Lampson International (Crane Manufacturer) Occupational Safety & Health Administration Danny’s Construction (Subcontractor)

Fines/Penalties

Lawsuits Filed Claims/Settlements

$240K $131K $168K

Insurance Dispute

• Federal sued Travelers for breach of its duty

to defend and sought to recover defense costs it had made

• Federal sought to recover defense costs,

which it contributed an estimated $30M

• Judged ruled in favor of Federal and
• rdered Travelers to reimburse more than

$29M.

• Travelers appealed the decision but lost

Insurance Dispute

Traveler’s Insurance (Primary Carrier) Federal Insurance (Excess Carrier)

Insurance Dispute

Lawsuits Filed Claims/Settlements

$29M

Estates of: Jerome W. Starr William R. Degrave Jeffrey A. Wischer HCH Construction (General Contractor) Mitsubishi Heavy Industries America Lampson International (Crane Manufacturer) Occupational Safety & Health Administration Danny’s Construction (Subcontractor) Traveler’s Insurance (Primary Carrier) Federal Insurance (Excess Carrier) Southeast Wisconsin Professional Baseball Park District

Fines/Penalties

Lawsuits Filed Claims/Settlements

Estates of: Jerome W. Starr William R. Degrave Jeffrey A. Wischer HCH Construction (General Contractor) Mitsubishi Heavy Industries America Lampson International (Crane Manufacturer) Occupational Safety & Health Administration Danny’s Construction (Subcontractor) Traveler’s Insurance (Primary Carrier) Federal Insurance (Excess Carrier) Southeast Wisconsin Professional Baseball Park District

Fines/Penalties Workplace Accident/Injury

Lawsuits Filed Claims/Settlements

Estates of: Jerome W. Starr William R. Degrave Jeffrey A. Wischer HCH Construction (General Contractor) Mitsubishi Heavy Industries America Lampson International (Crane Manufacturer) Occupational Safety & Health Administration Danny’s Construction (Subcontractor) Traveler’s Insurance (Primary Carrier) Federal Insurance (Excess Carrier) Southeast Wisconsin Professional Baseball Park District

Services/Operations Fines/Penalties Property Workplace Accident/Injury

Lawsuits Filed Claims/Settlements

Estates of: Jerome W. Starr William R. Degrave Jeffrey A. Wischer HCH Construction (General Contractor) Mitsubishi Heavy Industries America Lampson International (Crane Manufacturer) Occupational Safety & Health Administration Danny’s Construction (Subcontractor) Traveler’s Insurance (Primary Carrier) Federal Insurance (Excess Carrier) Southeast Wisconsin Professional Baseball Park District

Services/Operations Fines/Penalties Property Workplace Accident/Injury Insurance Dispute

Lawsuits Filed Claims/Settlements

Estates of: Jerome W. Starr William R. Degrave Jeffrey A. Wischer HCH Construction (General Contractor) Mitsubishi Heavy Industries America Lampson International (Crane Manufacturer) Occupational Safety & Health Administration Danny’s Construction (Subcontractor) Traveler’s Insurance (Primary Carrier) Federal Insurance (Excess Carrier) Southeast Wisconsin Professional Baseball Park District

Services/Operations Fines/Penalties Property Workplace Accident/Injury Insurance Dispute Insurance Claim

Lawsuits Filed Claims/Settlements

Conclusion