DRAFT 1 Belfast th World Cyber Security Technology Research Summit Suren Gupta Allstate Corporation Executive Vice President Allstate Technology & Strategic Ventures

2 THE CHANGING LANDSCAPE THEIR NEW CHALLENGES AND RESPONSIBILITIES CONSUMERS AND STAKEHOLDERS WHAT WE NEED TO KEEP THEM INFORMED AND SAFE CORPORATE BOARDS CORPORATECYBERSECURITY Agenda

CORPORATE CYBERSECURITY: THE CHANGING LANDSCAPE 3

Allstate Corporation at a Glance publicly held personal lines property and casualty insurer in the U.S. by revenue million households served billion revenue in 2014 employees Exclusive Allstate Agencies and Financial Specialists Potentially suspicious cyber incidents every day 4 #1 16 $ ,200 11,900 1 billion

The number of confirmed data breaches is increasing dramatically 5 Source: 2014 Verizon Data Breach Investigations Report 1,367

Consumer trust in companies to secure personal information is tenuous 6 Gallup, June 2014

Corporate boards are under pressure to take more accountability for cybersecurity 7 “A prominent proxy adviser urged the ouster of most Target Corp. board members for failing to manage risks and protect the company from a massive data breach.” -- May 28, 2014

CEOs are elevating the importance of cybersecurity 8 CEOs now see cybersecurity technologies as one of the three most strategically important types of digital technology: #1 Mobile technologies for customers #2 Data mining and analysis #3 Cybersecurity technologies Source: PwC 18 th Annual Global CEO Survey, January 2015

The Internet of Things, tech innovation and political unrest elevate the threat level 9 50 BILLION IP devices will be connected by 2022 NON- TECH Companies are quickly bringing consumer technologies to market POLITICAL UNREST Drives both state- sponsored and lone-wolf cyber attacks Millions of access points + vulnerable technologies + politically-motivated attacks = perfect storm of corporate risk

CORPORATE BOARDS: THEIR NEW CHALLENGES AND RESPONSIBILITIES 10

Cyber threats potentially broaden a company’s risks 11 Internal Risk -Operational -Financial -Reputational External Risk -Customer -Shareholder Systemic Risk -Markets -Infrastructure Traditional Cyber

What corporate boards need to mitigate cyber risk 12 Education Information Risk Profile Assessment Governance and Controls

What corporate boards need to mitigate cyber risk 13 Outside advisors to bring in world-class best practices, outside perspective and broader knowledge of the changing threat landscape. Education 1

What corporate boards need to mitigate cyber risk 14 Access to the company’s cybersecurity capabilities and how management plans to enhance them. Information 2

What corporate boards need to mitigate cyber risk 15 The extent of the risks the company faces and how management is thinking about cybersecurity, which requires a different type of management than traditional risk. Risk Profile Assessment 3

What corporate boards need to mitigate cyber risk 16 The governance, controls and response processes in place or needed to address a breach and protect the company's reputation should a breach occur. Governance and Controls 4

17 CONSUMERS AND STAKEHOLDERS: WHAT WE NEED TO KEEP THEM INFORMED AND SAFE

Adopt the NIST framework internationally 18

Stronger international collaboration needed among private, government and academic sectors 19 Cybersecurity Universities Government Business

Questions that need urgent answers Given the increasing threat, do we need a new international body to bring greater collaboration? What would be the mission of such a body?What would be the mission of such a body? Who would govern it?Who would govern it? How would it be funded?How would it be funded? What authority would it have?What authority would it have? 20

DRAFT 21 Belfast th World Cyber Security Technology Research Summit Suren Gupta Allstate Corporation Executive Vice President Allstate Technology & Strategic Ventures