Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) E&O RISK MANAGEMENT: MEETING THE CHALLENGE OF CHANGE Limiting Exposures to Data Breaches
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) INTRODUCTION Insurance agents collect, use, and store personally identifiable information on a daily basis Agents face exposure to both regulatory penalties and potential first and third party liability for breaches of data. Liability from cyber-attacks is on the rise and the media is constantly reporting on companies being hacked, exposing protected personal information.
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) INTRODUCTION Risks include physical risks, such as: Discarding protected personal information without it being properly shredded Computers, fax machines and printers being discarded without thoroughly removing stored personal information; Physical agency break-ins where the entire agency server is stolen.
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) INTRODUCTION employee mistakes Perhaps the largest security risk arises from employee mistakes that often result from the failure to properly train them on agency procedures to protect the privacy of protected personal information.
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) GOOD BUSINESS & THE LAW Agencies have an obligation to secure protected personal information whether it is in electronic or paper form and to dispose of it appropriately
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) Data Breach Exposures Legal Responsibilities Fair Credit Reporting Act (FCRA) Gramm-Leach-Bliley Act (GLBA) Health Insurance Portability and Accountability Act (HIPAA) Various state laws (at least 29 states) require reporting of security breaches…“Security Breach Notification Chart”: These laws effectively require agencies to implement security plans, conduct training, and do security audits
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) Data Breach Exposures Data Breach Costs Average cost estimated to be $214 per record, or about $250K for the average agency Direct Costs – Cost to handle breach…legal fees, consultants, implementing new technology and training – Cost to notify and remediate affected parties Indirect Costs – Loss of trust of customers – Damage to reputation in the community
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) Data Breach Exposures Identify Data at Risk Paper files in cabinets and on desks in premises Archived files (paper and electronic) outside premises Computer hard drives, laptops, cell phones, CDs, USB drives, agency management system providers, carriers, call centers, etc.
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) Data Breach Exposures Identify Physical Threats Majority of breaches occur from stolen or lost devices Secure the building, server room, and file cabinets Screen cleaning crews Immediately prevent access to data when employees leave Practice sound password security Limit personal information on mobile devices
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) Data Breach Exposures Identify Virtual Threats Firewall Secure WiFi connections Virus and malware protection Secure data backups and archived files Connect remotely via SSL/VPN connections Use secure SSL connections (https) to collect data Secure with Transport Layer Security (TLS)
Copyright © 2012, Big I Advantage®, Inc., and Swiss Re Corporate Solutions. All rights reserved. (Ed. 08/12 -1) LIMIT YOUR RISK Only keep the data you need and for only the length of time that you need it Have written guidelines and training regarding employee use of all protected consumer information Have written mandatory procedures in place for the proper disposal of sensitive information.