Beazley presentation masterFebruary 2008

Data Security & Beazley Breach Response

Max PerkinsOctober 4, 2013

2

• A Brief Review of Data Breaches

• What is Beazley Breach Response?

• Beazley Breach Response Timeline

• Questions?

• Appendix

Agenda

A Brief Review of Data Breaches

4

• Actual release or disclosure of information to an unauthorized individual/entity that relates to a person and that:

o May cause the person inconvenience or harm (financial/reputational)

Personally Identifiable Information (PII)

Protected Healthcare Information (PHI)

o May cause your company inconvenience or harm (financial/reputational)

Customer Data, Applicant Data

Current/Former Employee Data, Applicant Data

Corporate Information/Intellectual Property

What is a Data Breach?

5

• Improper Disposal of Data

o Paper

Un-shredded Documents

File cabinets without checking for contents

o Electronic assets

computers, smart phones, backup tapes, hard drives, servers, copiers, fax machines, scanners, printers

• Phishing/Spear Phishing Attacks

• Network Intrusions/Hacks/Malware Viruses

• Lost/Missing/Stolen Electronic Assets

• Mishaps due to Broken Business Practices

• Rogue Employees

Types of Data Security Breaches

6

Consumer Information

• Credit Cards, Debit Cards, and other payment information

• Social Security Numbers, ITIN’s, and other taxpayer records

• Customer Transaction Information, like order history, account numbers, etc.

• Protected Healthcare Information (PHI), including medical records, test results, appointment history

• Personally Identifiable Information (PII), like Drivers License and Passport details

• Financial information, like account balances, loan history, and credit reports

• Non-PII, like email addresses, phone lists, and home address that may not be independently sensitive, but may be more

sensitive with one or more of the above

Employee Information

• Employers have at least some of the above information on all of their employees

Business Partners

• Vendors and business partners may provide some of the above information, particularly for Sub-contractors and

Independent Contractors

• All of the above types of information may also be received from commercial clients as a part of commercial transactions or

services

• In addition, B2B exposures like projections, forecasts, M&A activity, and trade secrets

Many people think that without credit cards or PHI, they don’t have a data breach risk. But can you think of any

business without any of the above kinds of information?

What Kinds of Information are at Risk?

7

A Simplified View of a Data Breach

Handling the Long-Term

Consequences

Managing the Short-Term

Crisis

Evaluation of the Data Breach

Discovery of a Data Breach

Theft, loss, or Unauthorized Disclosure of Personally Identifiable Non-Public

Information or Third Party Corporate Information that is in the care, custody or control of the Insured Organization, or a third party for whom the Insured Organization is legally

liable

Forensic Investigation and

Legal Review

Notification and Credit/Identity File

Monitoring

Class-Action Lawsuits

Regulatory Fines, Penalties, and

Consumer Redress

Public Relations

Reputational Damage

Income Loss

What is Beazley Breach Response for the Commonwealth of Virginia?

Network / Data Liability

Insurance

+ Breach ResponseServices

_____________________

Beazley Breach Response

Beazley Breach Response is more than an insurance policy

• Based on current, state-of-the-art Beazley Information Security & Privacy Insurance

• Notification/Credit or Identity Monitoring indemnification is replaced with Privacy Breach Response Services

• Integrated Breach-Handling Services using top industry experts and vendors

• Privacy Breach Response insurance has a limit of coverage that is separate from and in addition to the third party limit of liability

• A comprehensive solution to the risks of security breaches, data loss and unauthorized disclosures

• A unique insurance product tailored to the needs of data owners, including higher education, healthcare, retail and other consumer-facing organizations

• Insuring Agreement A

o Information Security and Privacy

1. theft, loss or unauthorized disclosure of personally identifiable non-public information or third party corporate information

2. failure of computer security to prevent a security breach

3. failure to timely disclose a breach

4. failure to comply with privacy policy

10

Beazley Breach Response

• Insuring Agreement Bo Breach Response Services

1. Computer forensics to determine existence and cause of breach.

Includes costs of a PCI Forensic Investigator, when applicable to the

suspected incident

2. Legal fees to determine the applicability of and actions necessary to

comply with breach notice laws or in responding to credit card system

operating regulation requirements (PCI)

3. To provide notification to individuals required to be notified under a

breach notice law or if a potential risk of financial, reputational, or other

harm exists to the individuals

4. Call center services to the notified individuals

5. One year credit or identity file monitoring and reasonable third party

admin costs associated with program

6. Access to educational and loss control information

11

12

• Insuring Agreement C

o Regulatory Defense and Penalties• Claims expenses and penalties insured is obligated to pay

because of a claim in the form of regulatory proceedings – (HIPAA, HiTech)

• Insuring Agreement D

o Crisis Management and Public Relations• Public relations and Crisis Management Expenses incurred as

a result of a the publication or imminent publication in a newspaper, radio or television broadcast of a covered Claim under the policy.

• Insuring Agreement Eo PCI Fines and Costs

• Indemnity coverage of PCI Fines and Costs (Defined Term)

Beazley Breach Response:

• Pre-Breach Education and Services

• Dedicated Breach Response Services team: breaches are very different from liability claims

• Hand-picked vendors: expertise makes a big difference for breach outcome, higher education organizations are note expected to have the in-house expertise to respond to a breach

• Beazley insureds are encouraged to activate services when they think have a breach, because little breaches can turn into big problems if they aren’t handled properly

• It only takes one phone call or email (bbr.claims@beazley.com) to activate services

What Else Makes Beazley Breach Response Different?

14

• Policy Holder Services from ePlace Solutions, Inc. through nodatabreach.com to provide Data Security Risk Management services such as:

o Training and Awareness programs

o Animated Staff training Programs

o HIPAA Compliance Tools

o On-Line Compliance Materials – quick tips, links to statutes and regulations updates

o Expert Support from consultants and attorneys on data security issues including

Healthcare & HIPAA compliance issues

Contractual Considerations

Data Breach Prevention Issues

Data Security Best Practices and Corporate Policies

Computer Forensic Issues

Data Breach Prevention Guidance

Pre-Breach Response Services

15

• Alex Ricardo - Breach Response Services - Broker/Client Outreach Specialty Lines

• Alex joined Beazley in April 2011

• Graduated from Stevens Institute of Technology, BE Engineering

• Worked in privacy sector for 15 years

• Certified Information Privacy Professional (CIPP/US)

• Based in Beazley's New York City office.

• He is responsible for assuring BBR Insureds take full advantage of the professional services made available to them to reduce their risk & liability profile prior to or in the event of a privacy breach incident.

Pre-Breach Response Services Continued

16

• Dedicated Internal Breach Response Services Focus Group lead by Katherine Keefe, Esq.

o 25 years practicing lawyer with extensive experience in data privacy and security issues and related regulatory matters.

o Team responsible for providing breach response services to policyholders immediately following the report of a suspected data breach

o Development of Beazley’s risk management services designed to minimize the occurrence and impacts of data breaches.

o Client Advocacy during breach that is separate from claims staff handling regulatory and liability matters

Post Breach Response Services

Beazley Breach Response Timeline

Questions?

Appendix

• Best Practices – Breach Preparedness & Prevention

• Best Practices – Breach Response Management

22

Best Practices – Breach Preparedness and Prevention

• Encryption of Portable Devices

• PCI-DSS Compliance

• Data Segregation

• Data Mapping

• Log Files

• Data Loss Prevention (DLP)

23

Best Practices – Breach Preparedness and Prevention

• Background Screening Program

• Pre-Arrange Breach Response Services

• e-Learning Initiative

• Written Data Breach Incident Response Plan

• Tabletop Exercises

• Legislative updates

24

Best Practices – Breach Response Management

• Retain Outside Counsel

• “Notify Correctly vs.. Quickly”

• Outside Call Center When Appropriate

• Reputational Risk Advisor When Appropriate

• Investigate – Investigate – Investigate

• Leverage External Resources – Privacy Counsel, Forensics

Max PerkinsUnderwriter; Specialty Lines

BeazleyTwo Liberty Place t: +1 (215) 446 844650 S. 16th Street, Suite 2700 c: +1 (336) 549 9999Philadelphia, PA 19102 e: max.perkins@beazley.com

For More Information: www.beazley.com

The descriptions contained in this broker communication are for preliminary informational purposes only. The product is available on an admitted basis in some but not all US jurisdictions through Beazley Insurance Company, Inc., and is available on a surplus lines basis through licensed surplus lines brokers underwritten by Beazley syndicates at Lloyd's. The exact coverage afforded by the product described herein is subject to and governed by the terms and conditions of each policy issued. The publication and delivery of the information contained herein is not intended as a solicitation for the purchase of insurance on any US risk. Beazley USA Services, Inc. is licensed and regulated by insurance regulatory authorities in the respective states of the US and transacts business in the State of California as Beazley Insurance Services (License#: 0G55497).