Thousands of dollars lost at the blink of an eye, and systems shut down for weeks. It might sound like something out of a movie, but it’s becoming more and more of a reality thanks to modern hackers. As technology evolves and becomes more sophisticated, so do the occurrence of cyber breaches.
“The more we rely on technology, the more everything becomes interconnected,” said Jackie Lee, associate vice president, Cyber Liability at Nationwide. “We are in an age where our car is a giant computer, and we can turn on our air conditioners with our phones. Everyone holds data. It’s everywhere.”
According to Lee, phishing is on the rise as one of the most common forms of cyber attacks. What used to be easy to identify as fraudulent has become harder to distinguish. Gone are the days of the emails from the Nigerian prince, which have been replaced with much more sophisticated—and tricky—techniques that could extort millions.
“A typical phishing email is much more legitimate and plausible,” Lee said. “It could be an email appearing to be from human resources at annual benefits enrollment or it could be a seemingly authentic message from the CFO asking to release an invoice.”
According to Lee, the root of phishing is behavior and analytics. “Hackers can pick out so much from a person’s behavior, whether it’s a key word in an engagement survey or certain times when they are logging onto VPN.”
On the flip side, behavior also helps determine the best course of action to prevent phishing.
“When we send an exercise email to test how associates respond to phishing, we monitor who has clicked the first round, then a second round,” she said. “We look at repeat offenders and also determine if there is one exercise that is more susceptible. Once we understand that, we can take the right steps to make sure employees are trained to be more aware and recognize a potentially fraudulent email.”
Lee stressed that phishing can affect employees at all levels.
“When the exercise is sent out, we find that 20 percent of the opens are from employees at the executive level,” she said. “It’s just as important they are taking the right steps to ensure they are practicing what they are preaching.”
Another hot hacking ploy is ransomware, a type of property-related cyber attack that prevents or limits users from accessing their system unless a ransom is paid. The average ransom request for a business is around $10,000. According to the FBI, there were 2,400 ransomware complaints in 2015, resulting in total estimated losses of more than $24 million. These threats are expected to increase by 300% this year alone.
“These events are happening, and businesses aren’t reporting them,” Lee said.
In the last five years, government entities saw the largest amount of ransomware attacks. Lee added that another popular target is hospitals.
After a recent cyber attack, a hospital in Los Angeles was without its crucial computer programs until it paid the hackers $17,000 to restore its systems.
Lee said there is beginning to be more industry-wide awareness around ransomware, and many healthcare organizations are starting to buy cyber insurance and are taking steps to safeguard their electronic files.
“A hospital holds an enormous amount of data, but there is so much more at stake than just the computer systems,” Lee said. “All their medical systems are technology-based. To lose those would be catastrophic.”
And though not all situations are life-or-death, Lee does emphasize that any kind of property loss could be crippling. “On a granular scale, you look at everything from your car to your security system. All data storage points could be controlled and compromised at some point.”
According to Lee, the Cyber product, which is still in its infancy, is poised to affect every line of business. She foresees underwriting offering more expertise in crime and becoming more segmented into areas of engineering, property, and automotive to address ongoing growing concerns.”
“Cyber coverage will become more than a one-dimensional product,” she said. “I see a large gap in coverage. Consistency is evolving, and as technology evolves, we are beginning to touch other lines. It’s no longer about if a breach will happen. It’s when.”
Nationwide’s cyber liability coverage includes a service-based solution that helps mitigate losses. Whether it’s loss prevention resources, breach response and remediation expertise, or an experienced claim team, Nationwide’s comprehensive package of services will complement and enhance an organization’s cyber risk profile.
Nationwide currently offers up to $15 million in limits for Network Security, Data Privacy, Technology E&O, and First Party Business Interruption.
Products underwritten by Nationwide Mutual Insurance Company and Affiliated Companies. Not all Nationwide affiliated companies are mutual companies, and not all Nationwide members are insured by a mutual company. Subject to underwriting guidelines, review, and approval. Products and discounts not available to all persons in all states. Home Office: One Nationwide Plaza, Columbus, OH. Nationwide, the Nationwide N and Eagle, and other marks displayed on this page are service marks of Nationwide Mutual Insurance Company, unless otherwise disclosed. © 2016 Nationwide Mutual Insurance Company.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Nationwide. The editorial staff of Risk & Insurance had no role in its preparation.
“The sky is not falling” when it comes to cyber security, but the threat is a growing challenge for companies.
“I am not a cyber apocalyptic kind of guy,” said Gen. Michael Hayden, former head of the Central Intelligence Agency and National Security Agency, who currently is a principal at the Chertoff Group, a security consultancy.
“There are lots of things to worry about in the cyber domain and you don’t have to be apocalyptic to be concerned,” said Hayden prior to his presentation at a Global Risk Forum sponsored by Lockton on Sunday afternoon on the geopolitical threats facing the United States.
“We have only begun to consider the threat as it currently exists in the cyber domain.”
Hayden said cyber risk is equal to the threat times your vulnerability to the threat, times the consequences of a successful attack.
At present, companies are focusing on the vulnerability aspect, and responding by building “high walls and deep moats” to keep attackers out, he said. If you do that successfully, it will prevent 80 percent of the attackers.
“It’s all about making yourself a tougher target than the next like target,” he said.
But that still leaves 20 percent vulnerability, so companies need to focus on the consequences: It’s about response, resiliency and recovery, he said.
The range of attackers is vast, including nations that have used cyber attacks to disrupt Sony (the North Koreans angry about a movie), the Sands Casino (Iranians angry about the owner’s comments about their country), and U.S. banks (Iranians seeking to disrupt iconic U.S. institutions after the Stuxnet attack on their nuclear program), he said.
“You don’t have to offend anybody to be a target,” he said. “It may be enough to be iconic.”
The world order that has existed for the past 75 years “is melting away” and the world is less stable.
And no matter how much private companies do, it may not be enough.
“The big questions in cyber now are law and policy,” Hayden said. “We have not yet decided as a people what we want or will allow our government to do to keep us safe in the cyber domain.”
The U.S. government defends the country’s land, sea and air, but when it comes to cyber, defenses have been mostly left to private enterprises, he said.
“I don’t know that we have quite decided the balance between the government’s role and the private sector’s role,” he said.
As for the government’s role in the geopolitical challenges facing it, Hayden said he has seen times that were more dangerous, but never more complicated.
The world order that has existed for the past 75 years “is melting away” and the world is less stable, he said.
Nations such as North Korea, Iran, Russia and Pakistan are “ambitious, brittle and nuclear.” The Islamic world is in a clash between secular and religious governance, and China, which he said is “competitive and occasionally confrontational” is facing its own demographic and economic challenges.
“It’s going to be a tough century,” Hayden said.