John David

Cyber insurance: What is first-party and third-party coverage

by

Cyber insurance: What is first-party and third-party coverage

When you start looking at cyber insurance, you are likely going to encounter discussions of first- and third-party coverage. This is referring to the protection against losses incurred by first- and third-parties as a result of a cyberattack. First-party is all about you. The term refers to all of the losses you suffer directly because of the event. Third-party refers to all of the losses suffered by others as a result of the cyber event which hit your business. Generally, this is going to refer to your clients and others whose data you handled and that was compromised in some fashion as a result of the cyber event.

So, let’s take a high-level look at the risks that fall under first-party losses.

First Party losses – all about you

First-party is all about covering the direct and indirect losses that create economic loss for your business as a result of the criminal cyber event. Let’s start with the immediate consequence to your business from a cyber attack: that is the loss or damage to the electronic data you hold. That can be any electronic data that you possess, including the data of your clients. The compromising of customer data is of special concern when it includes Personally Identifiable Information (PII). PII can identify a specific individual. Examples include full name, address, social security number, birth date, etc. Cyber insurance would generally help you cover the expenses from a data breach only from a specified covered peril such as a DoS, hackers, virus, etc.

However, breaking out all of the first-party losses reveals quite a complex list of expenses. In our next blog, we will give you a breakout of the major expenses that can result from that initial criminal event.

Cyber insurance: What is first-party and third-party coverage

by

Cyber insurance: What is first-party and third-party coverage

When you start looking at cyber insurance, you are likely going to encounter discussions of first- and third-party coverage. This is referring to the protection against losses incurred by first- and third-parties as a result of a cyberattack. First-party is all about you. The term refers to all of the losses you suffer directly because of the event. Third-party refers to all of the losses suffered by others as a result of the cyber event which hit your business. Generally, this is going to refer to your clients and others whose data you handled and that was compromised in some fashion as a result of the cyber event.

So, let’s take a high-level look at the risks that fall under first-party losses.

First Party losses – all about you

First-party is all about covering the direct and indirect losses that create economic loss for your business as a result of the criminal cyber event. Let’s start with the immediate consequence to your business from a cyber attack: that is the loss or damage to the electronic data you hold. That can be any electronic data that you possess, including the data of your clients. The compromising of customer data is of special concern when it includes Personally Identifiable Information (PII). PII can identify a specific individual. Examples include full name, address, social security number, birth date, etc. Cyber insurance would generally help you cover the expenses from a data breach only from a specified covered peril such as a DoS, hackers, virus, etc.

However, breaking out all of the first-party losses reveals quite a complex list of expenses. In our next blog, we will give you a breakout of the major expenses that can result from that initial criminal event.

Should I look into cyber insurance?

by

Should I look into cyber insurance?

Among those firms who take risk management seriously, there is a growing awareness of the need to consider some manner of insurance to protect against the costs of cybercrime. Standard commercial property insurance policies do not generally include provisions for the damages from cybercrime. Cybercrime can be thought to include any digital or internet-based attack that compromises you and/or your customers’ data and/or causes disruption to business operations. A non-inclusive list might include Denial of Service (DoS) attacks, phishing scams, adware, ransomware attacks, system/website cloning, viruses, and other malware, and viruses. So what is it that so worries business leaders? In a growing number of commercial policies, cyber events are specifically excluded. The consequences can be serious. Fines and penalties, loss of customer confidence, and liability lawsuits can shut a business down for good, especially smaller businesses that lack the deep pockets to hold out until the worst of the storm passes. Cybercrime creates a large range of potential first- and third-party losses that few businesses can hope to absorb on their own. As a result, executives who recognize the catastrophic damage that a cyberattack can inflict on their business are looking at cyber insurance to transfer the financial losses to a third party.

Because of the severe consequences of cybercrime, businesses are now exploring cyber insurance policies in hopes of protecting themselves against financial ruin. However, these policies represent a bit of a minefield as this is a relatively new and unsettled area of insurance. Insurance firms trying to write policies face a lot of unknowns at this point, which means coverage may differ dramatically between insurers and there may be many areas where you remain exposed to considerable risk. Just two examples to get you thinking. Some policies may create requirements and security standards you must meet before an event will be considered a covered loss.

  • How would you handle those requirements internally to keep your company in compliance? And what about ransomware?
  • If you had to pay the ransom, would the policy cover that payout?

There are a lot of weeds to get into when looking for a cyber insurance policy and it is important you recognize the complexity of the issues. Cyber insurance has a lot of moving parts. In the meantime, cyber insurance doesn’t absolve you of the ongoing need to be vigilant about network and data security. Contact a managed service provider to learn more about what you can do to keep your business safe.

The Cloud: Are there security issues

by

The Cloud: Are there security issues?

For many, the idea of offloading their data to another physical/virtual location can seem like a security risk. It seems counter intuitive that moving data away from “ home” is safer. But is that really true? Any server stored at your location is probably more physically vulnerable than one protected in a large server farm. If you had a fire, flood, or other physical damage that included damage to your server, what would be the result? Also, are your backups stored on–site? If a major event damaged your entire physical location, those backups would be also lost.

There is a second reason the cloud may be safer: security. All of your data, no matter where it is located, may be vulnerable to cyber attacks and data breaches. However, cloud storage providers probably offer some of the most sophisticated security projection available. It is unlikely that a small or even mid-sized firm has the internal resources and research capacity to maintain an equivalent level of security.

So give some thought to the cloud as tool to preserve your data and the integrity of your business (as an added bonus, it likely will be a money saver, too).

How the cloud saves smaller firms money

by

How the cloud saves smaller firms money

OK. You pay someone to store all of your data in the cloud, as opposed to keeping it on your own server and backing it up. And you pay on an ongoing basis. How is that possibly going to be cheaper than just making a one-time investment and keeping it your self?

Let’s count the ways:

(1)  You lose the hardware expense –a capital expenditure cost.

(2)  If that hardware fails, you are out in the cold.

(3)  Someone has to maintain that hardware. In house IT labor is expensive. 

(4)  If you need more capacity, you have to ramp up at a tiered level, which means you may need to buy capacity you don’t presently need

(5)  All of that hardware runs on software, which costs money 

(6)  All of that software needs to be installed, updated, etc. (see # 3)

(7)  All of that hardware and software has to run 24/7. Are you large enough to pay for in house monitoring and support 24/7? (See again #3)

(8)  All of that data has to be protected with security software, which means skilled IT support and expensive virus protection

Ok. The list doesn’t end here, but this blog will. Talk to The Acumen Group about how the cloud can be a really budget saver for small and medium sized firms.

Data regulation and our business: You are probably regulated by these laws

by

Data regulation and our business: 
You are probably regulated by these laws

Small firms are probably aware that there are laws regulating the handling of data, but they probably assume that these apply only to larger firms and that they are too small to have any data that is worthwhile or protected under state/provincial or federal laws. Think again. Data protection laws generally worry about the content of your data, not the volume of it. That is, you don’t need to have “tons” (not the technical term) of data to be to regulated by data privacy laws. If you maintain personally identifiable information (PII) you may be regulated by these laws which may include penalties and fines for non-conformance. PII means you store a person’s first name/initial, last name and then link it to another piece of personal information, such as, but not including:

  • Social Security Number
  • Driver’s license, or state ID
  • Passport
  • Some financial account number, e.g. credit/debit card, checking account, etc.
  • Health insurance ID

You are very likely required to observe regulations regarding protection of that data, and reporting of data breaches.

This isn’t an issue for the faint of heart. Contact a managed service provider with expertise in your specific industry or field of business to make sure you are in compliance. Failure to maintain compliance can lead to some very expensive fines and penalties.

A security hack doesn’t have to mean the end of your company

by

A security hack doesn’t have to mean the
end of your company

Statistics are showing that each year over 50% of small firms are victims of a cyber attack or data breach. Why does this matter? Most smaller firms have not prepared business continuity plans to keep their IT infrastructure going in the event of an attack. Failing to do so often leads to the failure of the business. Delaying the creation of a business continuity plan is a bit like a younger person delaying writing a will, on the grounds that they are not likely to die soon. That may be true, but if the worst occurs the consequences can be severe for their heirs.

If the chance of a breach that could compromise your data or cripple your IT infrastructure is over 50%, there is every reason to immediately develop plans for how your business could maintain operation in the event of an attack on your IT systems.

This is an effort that shouldn’t be delayed. Contact The Acumen Group to help you develop a complete and holistic business continuity plan immediately. Your income and your future depends upon it.

Don’t steal… It isn’t nice and makes you vulnerable to security hacks

by

Don’t steal… It isn’t nice and makes you
vulnerable to security hacks

Don’t steal. It isn’t nice. And… it make you extremely vulnerable you security hacks if you “steal” software packages. Smaller firms often will use unlicensed software packages to save money. This is especially true if they only need a program for a specific task. Aside from the legal and ethical issues involved here, there is a very selfish reason not to do this. Software providers are constantly sending users updates to their programs, and those updates aren’t just about features. They include fixes to security holes and protections against specific new viruses that have been discovered. So, the longer you have an old, outdated software program on your PC or laptop, the more vulnerable you become. Is it really worth saving $200.00 when your entire business’s IT infrastructure could be put at risk? We suggest not.

Cybercrime: In-house protection that only YOU can provide

by

Cybercrime: In-house protection that only YOU can provide

From the political world to the corporate, all we hear about is hacking, hacking, hacking. Everyone gets hacked, data is stolen, etc. So, the cry goes up for better security protections for everyone’s data. Firewalls, virus software, etc., etc., etc.

Want to know one of the best ways to protect your data? Train your employees to stop opening any emails or links unless they absolutely know they are safe. Scam emails that try to trick you into opening a link to a bogus site, or worse, trick you into providing your password or ID for a known site are exceptionally effective ways for hackers to get into your internal system and compromise data. Yes, ransomware is a serious issue, and malware is out there, but employees naively opening phishing emails remain one of the biggest risks to data security. Talk to your employees on an on-going basis and provide training and tips on how to ID phishing scams

VoIP: A money saving solution for your company’s technology backbone

by

VoIP: A money saving solution for your
company’s technology backbone

When small business managers think about their IT infrastructure, they think about their employee’s mobile devices, cabling, Wi-Fi, laptops, a printer, and Internet connectivity. These are the basics of their IT infrastructure. However, there is one other aspect of a modern corporate IT infrastructure and that is an internal phone system that can connect “voice” over the internet, rather than traditional copper wires. Once upon a time, every office had an internal phone system that connected to the world via wire/cable/fiber. That wire/cable/fiber then connected a person in your office to a person somewhere else via the local phone company and a long distance carrier. And they did it for a per minute fee. And a very high per minute fee if you called internationally.

A VoIP phone system eliminates the phone company’s per minute connection, sidestepping them and running the voice call over the Internet.

Talk to your managed service provider about this money saving addition to your firm’s technology backbone.