Home > Insurance Products & Services > Commercial Lines > Network Security

NETWORK SECURITY / PRIVACY  LIABILITY AND CYBER RISK MANAGEMENT

AN OVERVIEW

The Internet is increasingly becoming a critical delivery channel for information, referrals, billing and research – automating traditional workflows can improve operational efficiency but can also bring new responsibilities and additional, unprecedented risks.

The accessibility of the Internet increases liability including vulnerability to the theft, alteration or accidental disclosure of personally identifiable information which can affect an organizations earnings, reputation and operations. Traditional insurance policies do not provide sufficient coverage with regards to network liability, failure to protect, or wrongful disclosure of, personally identifiable information and therefore, specific Technology Errors & Omissions policies should be considered as part of a comprehensive risk management program.

WHAT MAJOR RISKS ARISE OUT OF THE INTERNET & COMPUTER NETWORKS?

• Damage, Theft or Disclosure of Personally Identifiable Information – hackers can access a database and steal large quantities of confidential data in seconds. Disgruntled employees can also use a company’s network to destroy information or steal it to sell for a profit. Protecting client’s confidential information is paramount but this risk should not be managed by firewall technology alone.

Liability arising from a wrongful disclosure of or failure to protect information can come from a variety of areas in addition to a “physical” breach of a company’s network security - information may be stored on a lap top which is subsequently stolen, data may be stored on a server at a third party location, information may be retrieved from disposal companies charged with destroying such information – all of these scenarios may lead to third party law suits together with additional costs that will be incurred to comply with legislation governing requirements to notify all parties who may have had information compromised.

• Attacks & Malicious Code – any company connected to the Internet is susceptible to viruses which can result in legal liabilities as well as damage to, or destruction of client and other valuable information

• Intellectual Property & Content Infringement – the Internet creates new exposures for content and advertising litigation

SCENARIOS & COVERAGE GAPS IN THE TRADITIONAL INSURANCE MARKETS

• Scenario : A hacker who is an employee infiltrates the company’s computer system, stealing a significant amount of confidential information

  • Crime Insurance – typically excludes information theft

  • General Liability – GL policies covers only “tangible property” property damage and not loss of electronic data – also GL policies typically exclude intentional acts of employees (over 50% of network security breaches emanate from insiders)

   

• Scenario – A Denial of Service Attack or virus results in a shutdown of your website – you suffer extra expenses, loss or revenue and potential litigation

  • Property Insurance – Property Insurers will generally exclude coverage for computer viruses – policy will require a direct physical loss or damage to covered property to trigger business income and extra expense coverage

  • General Liability - GL policies covers only “tangible property” property damage and not loss of electronic data

Network Security / Cyber Liability Errors & Omissions

Network Security / Cyber Liability Errors & Omissions coverage can be arranged on a modular format giving the flexibility to tailor a policy to meet the individual needs of each client based on exposures – available coverage modules are as follows:

•     Network Security Liability - Coverage for damages and defense costs suffered from a suit resulting from a computer attack upon the insured’s network, including liability caused by the transmission of a computer virus, unauthorized access, denial of service, disclosure of confidential information and identity theft

•     Privacy - Extends the Network Security Liability coverage to include liability arising from a failure to protect or wrongful disclosure of private information, violation of any federal, state or local privacy statute in connection with failure to protect private information - coverage includes an additional limit for additional expenses incurred following an insured event (ie, notifying individuals of a potential issue, offering of credit monitoring services etc)

•     Internet Media Liability - Coverage for content based injuries such as libel, slander, defamation, copyright, title, trademark infringement or invasion of privacy arising from the display of materials on insured’s web site

•     Cyber Extortion - Coverage for the investigation and settlement of a cyber-extortion threat against the insured

•     Information Asset Protection - Coverage for the damage, destruction, corruption or theft of the insured’s important information assets, including bandwidth, due to a covered computer attack

•     Network Business Interruption - Coverage that protects the insured’s income, both online and offline, resulting from a computer attack. Cover will include loss for extended business interruption and dependent business interruption

CLAIMS EXAMPLES

•     Introduction of Malicious Code – a disgruntled employee of a major consulting firm downloaded malicious code onto the network of the firm, it’s clients and vendors. The code launched confidential information into the public domain and destroyed some critical corporate applications resulting in significant third party claims

•     Privacy Violations – Unauthorized Access to Customer Information – a bank employee obtained unauthorized access to the computer system in order to search for potential clients for a friend in the real estate business. The employee provided confidential information regarding consumers to the friend – the scheme was discovered after the confidential information was leaked to another party and subsequently used as part of an identity theft scheme

•     Hacking/Breach of Network Security & Extortion – Russian hackers gained unauthorized access to the computer systems of various financial institutions and others – using this unauthorized access, the hackers obtained personal financial information for over 56,000 individuals and used this information to defraud internet payment services in addition to attempting to extort money from the institutions with threats of exposing information publicly or damaging the institutions computer systems