Sponsored Content by Nationwide

The Rapid Evolution of Cyber Threats

As technology grows more sophisticated, so do hackers. Insurers must do their best to adapt and keep up.
By: | June 7, 2017 • 6 min read

It seems like only yesterday that the biggest cyber threat was the theft of credit card information. And in fact, it was only a few years ago when that was the case.

But recent events show just how quickly the risk has evolved. The ‘WannaCry’ ransomware attack that struck hundreds of companies around the globe in May, causing an estimated $4 billion in total losses, is a testament to how the risk has grown.

Technology forms the backbone of business for companies of every shape and size. The amount of information generated and stored on the Internet is growing exponentially, doubling every few days. And businesses are drawn closer together through reliance on interconnected systems.

As a result, there are more access points than ever for cyber criminals to exploit. System failure can impact multiple parties at a time, and companies of every size and sector are at risk.

As cyber exposures evolve, insurers are doing their best to adapt and keep up.

“We’ve come a long way from the early days when the biggest concern around cyber risk was the protection of credit card information,” said Tom Iorio, Senior Vice President of Management Liability and Specialty, Nationwide.

The Latest Threats: Phishing and Ransomware

Tom Iorio, Senior Vice President of Management Liability and Specialty

Cyber risk initially was a question of network security and data privacy, and it was focused on retailers and financial institutions.

“But now, credit card data has flooded the market and become less valuable for cyber thieves. It’s not worth their time to steal,” Iorio said.

As technology grows more sophisticated, so do hackers. Cyber attackers have turned to new, more lucrative tactics to exploit and profit from companies’ network vulnerabilities.

Social engineering scams and cyber extortion in the form of ransomware have emerged as the second wave of cyber threats.

Social engineering or “phishing” schemes don’t necessarily involve a breach of a company network or any inside access to sensitive data. Rather, phony emails purported to be sent by a senior manager, or others externally, are directed to employees, typically asking them to wire a sum of money into an external account. They can be very believable imitations of the real deal.

“I myself have received three of these “spear phishing” emails,” Iorio said. “They were supposedly sent by my former boss, asking me to pay a claim and deposit money into an external account. But there were a few problems that stuck out. For one thing, I don’t have the capability to wire money out to pay a claim, and my boss would never ask me to do so. There were also technical flaws. The email was misspelled, for example.”

When employees do fall for these tricks, however, companies stand to lose thousands of dollars. An incident like this is more likely to be covered in a crime policy than a cyber policy, since phishing is a form of computer fraud for funds transfer rather than an outright hack of proprietary information.

Cyber extortion in the form of ransomware, on the other hand, involves hijacking a company’s internal system to hold its data hostage, rendering it inaccessible and unusable until a ransom is paid. And it’s a more difficult risk to insure.

“For the sake of protecting their reputations, companies typically like to keep these incidents quiet, resolving them quickly without attracting attention of the press,” Iorio said. “Unlike theft of personally identifiable information, there is no regulatory requirement to report theft by ransomware. There could be many incidents that nobody hears about.”

“Without a solid understanding of the loss history, it’s harder to understand the risk and to write appropriate coverage. But it seems logical that someday soon, cyber and crime policies will be blended to respond to these incidents.”

When cyber attackers look to steal dollars, not just data from their victims, potential targets expand to industries beyond finance and retail. Hospitals, universities and government bodies are some common targets for cyber extortionists.

“These organizations may not have the dollars to devote to hack-proofing their systems. Many hospitals, for example, are nonprofit. They prioritize the services they provide,” Iorio said. Apart from the losses incurred from paying a ransom or fulfilling a fraudulent wire request, these institutions also have to consider the risk of downtime.

Risks on the Horizon

A ransomware attack — or any system failure that halts operations, malicious or otherwise — can incur large business interruption losses. Retailers lose sales if their websites or POS systems go down. Manufacturers lose productivity and fall behind on deadlines if computer-operated machinery fails. For some industries, network downtime can have residual effects for days.

“Airlines offer a good example. If a major airline is hit with a denial-of-service attack, or experiences some other kind of network failure, it may take several days to get planes back to their regular schedule and re-allocate passengers whose flights were cancelled,” Iorio said. “A downtime of just 20 minutes could still cost the airline millions of dollars.  That loss would be a direct result of a cyber event.”

Most cyber policies include coverage for business interruption on a contingent basis. Like first and third party liability for network security, the coverage has become fairly standard.

But as cyber exposures continue to evolve, the question of liability will be up for debate.

Property damage and bodily injury resulting from a cyber event, for example, is on the horizon, especially as the Internet of Things grows.

“IoT comes down to cloud exposure. With so much interconnectivity, and so many access points, the exposure is huge. But there are still questions around where the liability will fall,” Iorio said.

He pointed to autonomous cars. If a car gets hacked and is driven off the road, who is liable? The manufacturer? The software creator? The driver’s auto insurer?

Staying Steady through Changes

“We’re experiencing not just an evolution of cyber risk, but an evolution of cyber coverage. Cyber risk seems to take on new forms all the time, and nobody is certain of what the impact could be,” he said. “But we do know that cyber touches everything, and we as an industry are trying to connect the dots and cover the gaps between other coverages that are related.”

Insurers that are focused on building quality, lasting relationships with clients will be best positioned to weather the changes ahead. As cyber risk intersects with crime, property, general liability and other policies, companies will benefit most from partnering with a carrier that wants to work with them across their whole portfolio.

That way, when a loss occurs, carriers and their clients can work together to decipher what is or is not considered a cyber event and where the coverages lie. That relationship also makes it easier to fine tune the program to meet a company’s specific exposures going forward.

“At Nationwide, we’re very client focused. “We work with the top brokers in the nation and choose our clients wisely and create personal as well as a business relationship,” Iorio said. “When we know we have a quality client, we want to be there for them across their entire portfolio: directors and officers, professional liability, employment practices, crime and cyber.”

“The market may go up and down, but we stay consistent with our clients, and the same is true for cyber. We won’t be in it one day, and out the next.”

To learn more, visit https://www.nationwide.com/business-insurance.jsp.

SponsoredContent

BrandStudioLogo

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Nationwide. The editorial staff of Risk & Insurance had no role in its preparation.




Nationwide, a Fortune 100 company, is one of the largest and strongest diversified insurance and financial services organizations in the U.S. and is rated A+ by both A.M. Best and Standard & Poor’s.

Absence Management

Establishing Balance With Volunteers

It’s good business to allow job-leave for volunteer emergency responders, whether or not state laws apply.
By: | January 10, 2018 • 7 min read

If 2017 had a moniker, it might be “the year of the natural disasters,” thanks to a phenomenal array of catastrophic or severe events— hurricanes, tornadoes, wildfires, ice storms and floods.

Advertisement




Combined with smaller-scale fires and other emergencies, these incidents tax the resources of local and state emergency services, often prompting the need to call volunteer emergency responders into action.

But as lean as most organizations are already running, volunteer activities can sometimes cause friction between employees and employers. Handling conflicts the wrong way can potentially lead to legal headaches, harm employee morale and batter a company’s reputation.

State by State Variations

Most employers are aware of the various federal and state leave laws protecting their employees, including family and medical leave, pregnancy leave and military leave. But leave laws that protect the livelihoods of volunteer emergency responders are more likely to fly under the radar of some HR managers and risk managers.

Such laws don’t exist in every state, but more than 20 states do have some type of law in place to protect volunteers including emergency responders, firefighters, disaster workers, medical responders, ambulance drivers or peace officers.

Marti Cardi, vice president of Product Compliance for Matrix Absence Management

The laws vary broadly. Nearly all specify that such leave be unpaid, and that employees disclose their volunteer status to employers and provide documentation for each leave. But there is a spectrum of variations in terms of what may trigger an eligible leave. Some, for instance, apply for any emergency that prompts a call from the volunteer’s affiliated responder group. Others may require a government declaration of emergency for the law to be triggered.

While many of the laws do not explicitly require employers to let employees leave work when called to an emergency during a shift, most specify that an employee may be late or even miss work entirely without facing termination or any other adverse employment action.

Some states mandate a maximum number of unpaid leave days that a volunteer can claim. But others may place more significant burdens on employers. In California, for instance, employers with 50 or more employees are required to grant up to 14 days of unpaid leave for training activities in addition to any leave taken to respond to emergency events. For multistate employers, keeping on top of what obligations may apply in each circumstance can be a challenge.

Significant Risks

Large or mid-sized employers may rely on absence management providers to keep them in compliance. For smaller employers though, it may be as simple as looking up a state’s law via Google to find out what’s required. However, checking in with the state department of labor or the company’s attorney may be the best way to get the correct facts.

“I would caution that just because you don’t find something [on the internet], it doesn’t mean it’s not there,” said absence management and employment law attorney Marti Cardi, vice president of Product Compliance for Matrix Absence Management.

For example, Cardi said, an obscure Texas law provides job-protected leave for volunteer ham radio operators called into service during an emergency.

Cardi said employers should task HR to investigate the laws in each state the company operates in, and to ensure that supervisors are educated about the existence of these laws.

“If a supervisor is told by one of his or her employees, ‘Sorry I’m not coming in today … I’ve been called to volunteer firefighter duty for the [nearby region] fire,’” she said, you want to be sure that the supervisor knows not to take action against the employee, and to contact HR for guidance.

“Training supervisors to be aware of this kind of absence is really important.”

Advertisement




An employer that does terminate a protected volunteer for responding to an emergency may be ordered to pay back wages and reinstate the employee. In some cases, the employee may also be able to sue for wrongful termination.

And of course, “you don’t want to be the company in the headlines that is getting sued because you fired the volunteer firefighter,” she added.

If an employer bars a volunteer from responding, the worst-case scenario may be a third-party claim. Failure to comply with the law could give rise to a claim along the lines of “‘If you had complied with your statutory obligation to give Jane Doe time to respond, my loved one would not have died,’” explained Philadelphia-based Jonathan Segal, partner at law firm Duane Morris and managing principal of the Duane Morris Institute.

“That’s the claim I think is the largest in terms of legal risk.”

Even if no one dies or is seriously injured, he added, “there could still be significant reputational risk if an individual were to go to the media and say, ‘Look, I got called by the fire department and I wasn’t allowed to go.’”

The Right Thing to Do

What employers should be thinking about, Segal said, is that whether or not you have a legal obligation to provide job-protected leave for volunteer responders, “there’s still the question of what are the consequences if you don’t?”

Employee morale should be factored in, he said. The last thing any company wants is for employees to perceive it as insensitive to their interests or the interests of the community at large.

“Sometimes employers need to go beyond the law, and this is one of those times,” — Jonathan Segal, partner, Duane Morris; managing principal, Duane Morris Institute

“How is this going to resonate with my employees, with my workforce, how are people going to see this? These are all relevant factors to consider,” he said.

There’s an argument to be made for employers to look at the bigger picture when it comes to any volunteer responders on their payroll, said Segal.

“Sometimes employers need to go beyond the law, and this is one of those times,” he said. “Think about the case where’s there’s not a specific state law [for emergency responders] and you say to a volunteer, ‘No, you can’t leave to deal with this fire’ and then people die. You as an employer have potentially played a role, indirectly, because you didn’t allow the first responder or responders to go,” he said.

The bottom line is that “it’s the right thing to do, even if it’s not required by law,” agreed Cardi.

“I feel that companies should have a policy that they’re not going to discipline or discharge someone for absences due to this kind of civic service, subject to verification of course.”

Clear Policy

While most employers do strive to be good corporate citizens, it goes without question that employers need to guard their own interests. It’s not especially likely that volunteer responders will try to take advantage of the unpaid leave allowed them, but of course, it could happen.

That’s why it’s important to have policies that are aligned with state laws. Those policies could include:

  • Notifying the company of any volunteer affiliations either upon hire or as soon they are activated as volunteers.
  • Requiring that employees notify a supervisor as soon as possible if called to an emergency (state requirements vary).
  • Requiring documentation after the event from the head of the entity supervising the volunteer’s activities.

If at some point it becomes excessive – someone has responded to emergencies five times in nine weeks, then it’s time to examine the specifics of the law and have a discussion with the employee about what’s reasonable, said Segal. It may also be time to ask specifics about whether the person is volunteering each time, or are they being called.

Advertisement




In some cases, the discussion may need to be about finding a middle ground, especially if an employee has taken on an excessively demanding volunteer role.

“We encourage volunteers to pick the style that best fits their schedule,” said Greta Gustafson, a representative of the American Red Cross. “Disaster volunteers can elect to respond to disasters locally, nationally, or even virtually, and each assignment varies in length — from responding overnight to a home fire in your community to deploying across the country for several weeks following a hurricane.

“The Red Cross encourages all volunteers to talk with their employers to determine their availability and to communicate this with their local Red Cross chapter.”

Segal suggests approaching it as an interactive dialogue — borrowing from the ADA. “Employers may need to open a discussion along the lines of ‘I need you here this week because this week we have a deliverable on Friday and you’re critical to that client deliverable,’” he said, but also identify when the employee’s absence would be less critical.

No doubt there will be tough calls. An employer may have its hands full just trying to meet basic customer needs and need all hands on deck.

“That may be a situation where you say, ‘First let me check the law,’” said Segal. If there’s a leave law that applies, “then I’m going to need to comply with it. If there’s not, then you may need to balance competing interests and say, ‘We need you here.’” &

Michelle Kerr is associate editor of Risk & Insurance. She can be reached at [email protected]