Cyber Risk

The Threat from Within

Employees are the most vulnerable point in any organization’s computer network, but many companies fail to pay enough attention to this risk.
By: | March 3, 2017 • 13 min read

On May 21, 2014, the accounting director at AFGlobal Corp. in Texas read an email from his CEO asking him to work with the attorney for an outside auditor in “a strictly confidential financial operation.”

The attorney soon contacted the accounting director and said that $480,000 was needed for due diligence costs pursuant to a pending acquisition of a Chinese company. The attorney sent an email with the wiring instructions, which the director followed.

About a week later, the attorney requested $18 million, at which point, the accounting director became suspicious and told his supervisors.

It is probably no surprise that the “attorney” was an imposter and the email was not from the CEO.

Risk managers schooled on the threat of social engineering would also guess that the imposter knew a great deal about the company’s processes and procedures.

He in fact knew that the accounting director had a “long-standing, very personal and familiar relationship” with the CEO, according to a lawsuit filed by AFGlobal seeking to force its insurance company to repay it for its losses.

“We are now way past the old style of people trying to crack codes to get in through firewalls. The hacking community realized that the weak point in any defense system is the people element,” said Roger Miles, who teaches risk-related psychology at Cambridge University and the UK Defence Academy.

Roger Miles, professor of risk-related psychology, Cambridge University and the UK Defence Academy

“Ordinary employees simply do not have insight into the risk coming at them. The hackers are pretty smart at understanding that,” said Miles, who also researches and consults on risk perception, regulatory design and governance.

“Given the option between the effort of hacking code or getting the average employee in the organization to hand you the key, they clearly see a better return on time spent,” he said.

The risk is staggering.

The Experian Data Breach Resolution and Ponemon Institute found that about 80 percent of all data breaches began with employee activity. Verizon’s Security Breach Investigation Report said that of the top five ways that result in 95 percent of security breaches, four of those five directly involve employee behavior.


Some employee activities are malicious: The IT employee at the American College of Education who allegedly changed the system password before being fired and then offered to sell it back to the organization for $200,000; or the 20 percent of employees who admitted to a Market Pulse Survey by SailPoint that they would sell their company passwords, some for as little as $150.

But most employees are culpable only of not being wary enough.

“You have to be more pessimistic, more mistrusting and more suspicious of intentions,” said Miles. “That’s not a natural behavior of humans. Social engineering exploits ordinary people’s natural goodwill.”

It doesn’t have to be as blatant as the bogus CEO’s email to his accounting department. And that scam probably didn’t start there. That’s where it ended.

It starts with easy questions, by phone or email, from an apparent co-worker or vendor asking for a name or a title. Then, the hackers dive deeper, pulling together corporate hierarchies, co-worker relationships and personal activities.

Sometimes, the emails, apparently from inside the organization, ask users to click onto a link to review a file or log onto a training session.

Or it could be an email from a vendor with an attached invoice that has to be paid or a message from a merchant with instructions on when a package is expected to be delivered, said Larry Lidz, chief information security officer at CNA. When the attachments are clicked, the embedded malicious materials are used to access systems.

“If the program isn’t structured correctly, sometimes these types of claims can fall within the cracks.” —Rob Rosenzweig, vice president and national cyber risk practice leader, Risk Strategies Co.

In the day-to-day time crunch at work, employees may not take the time to look at such innocuous emails suspiciously. And once the link is clicked, the hackers are inside the system.

“As far as my experience,” said Austin Berglas, senior managing director and cyber defense practice head at K2 Intelligence, “with few exceptions, the majority of the successful breaches start because a cyber criminal exploits an employee or third-party who had connectivity inside the target network.”

He said 11 percent to 15 percent of employees will click on an infected email attachment.

“That’s a pretty significant number,” he said. “It often just takes one.”

Martin Frappolli, senior director of knowledge resources, The Institutes

Martin Frappolli, senior director of knowledge resources at The Institutes, which provides training for insurance and risk management professionals, said that corporations are sometimes too distracted by the never-ending news of big data breaches and external cyber liability risks to focus on the risks of employee behavior.

“I don’t want to say [employee behavior] is more important [than external risks] but it’s not getting its full share of attention,” he said. “It’s not top of mind for many organizations.”

He cited an example where criminals left USB memory sticks inside various restrooms of a corporation. They were labeled “confidential salary information.” Not surprisingly, employees who found them plugged the USBs into their computers.

That launched programs that captured and transmitted sensitive data to a criminal organization, Frappolli said.

“That’s a really good example of how easy it is to exploit employees,” he said. “Rarely is it deliberate. It’s not malicious. … It is behaviors they could be educated about.”

Cost may be one reason organizations have not focused more on employee training, but Frappolli said, it’s also a belief that the “threat always seems a little bit more remote than it is.”

Quarterbacking Cyber Risk

Rob Rosenzweig, vice president and national cyber risk practice leader at Risk Strategies Company, said risk managers must take ownership of cyber security.

“In many ways, risk managers are the quarterbacks,” said Rosenzweig, a 2017 Risk & Insurance® Power Broker® winner in the Technology category.

“The coordination of those stakeholders internally often falls on risk management at our clients,” he said. “They are able to drive home to those various stakeholders what the risk is and why everyone should be involved in the process.”

Plus, he said, risk managers are more aware of resources, such as training or other proactive measures, which can be provided either at no cost or at a discounted rate by insurance companies or brokers.

“It’s a win-win for everybody,” Rosenzweig said. “For clients, it’s prevention and for insurers, it makes their clients better risks. I expect to see more in the coming years.”

Prevention, of course, depends on whether the breach was due to carelessness or malfeasance.

“If you have an internal person who knows you really well and has gone over to the dark side for criminal acts, that’s a tough one to deal with,” said Bob Parisi, managing director, Marsh FINPRO.

Rob Rosenzweig, vice president and national cyber risk practice leader, Risk Strategies Co.

But companies can make it more difficult for them. It can be as simple as automatically canceling log-in credentials when employees leave or when vendors complete their work, said Berglas of K2 Intelligence.

A survey by Sailpoint found that two of five former employees could still access their former company’s computer system after they left.

It’s also crucial to segregate data, so that files are available only to employees who need the information to do their jobs, Berglas said. Requiring two-factor authentication, such as an additional password or requiring the use of a thumbprint on an iPhone, is also important, he said.

Michael Kaiser, executive director of the National Cyber Security Alliance, said companies should determine their “most critical or crown jewel assets. What would harm you the most if stolen, lost or destroyed and how do you build protection layers around that?”

Segregating information, he said, can be more challenging in small to mid-size organizations where responsibilities are more diverse.

According to a survey by Kaspersky Lab and B2B International, intentional fraud by employees in enterprise companies amounts to more than $1.3 million in costs, said Andrey Pozhogin, cyber security expert at Kaspersky Lab, in an email.

For small to medium size businesses, it results in over $40,000 in costs per incident, on average. The cost of falling for phishing is more than $48,000 per incident, he said.

Since the report was published, Pozhogin said, Kaspersky Lab has seen a huge jump — eight times as many — in ransomware attacks on companies, which mostly result from phishing.

Beazley reported in January that ransomware attacks quadrupled in 2016 over the previous year, and it expects the attacks to double again in 2017.

According to the FBI, business email compromise, which it defines as sophisticated scams targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments, affected 7,066 businesses from October 2013 to August 2015, for a total loss to U.S. companies of $750 million.

The loss increases to $1.2 billion, when combined with international victims.

Engaging Employees

Pozhogin said the biggest challenges in implementing employee training “are underestimating the risk (both probability and potential impact of a cyber incident) and significant friction when implementing yet another employee education program.”


Tom Dunbar, senior vice president and head of information risk management at XL Catlin, said employees take educational efforts seriously when organizations discuss the consequences and risks of lax cyber security.

“When you demonstrate why you are doing it, why it has meaning, then you get the cooperation,” he said.

Dunbar, who earned a 2014 Risk & Insurance® Risk All Star award for his innovative cyber security work, said his company engages employees by using humorous gamification in its online training to focus on specific cyber security risks, and then it tests them — throughout the year — to keep the messages fresh.

“Given the option between the effort of hacking code or getting the average employee in the organization to hand you the key, they clearly see a better return on time spent.” —Roger Miles, professor of risk-related psychology, Cambridge University and the UK Defence Academy

Last year, it also ran a video campaign on cyber security risks and responses. For every view by an employee, the company donated $1 to charity, he said. His department also uses blogging as well as computer screen savers and wall posters to reinforce the messages.

The training teaches employees, for example, to “mouse over” the link of an email or the firm name and address to see if there are clues to a phishing attempt.

The company also sends out false emails to employees to see “how many we hooked and how many swam away” from a phishing attempt, Dunbar said. Then it sends out the email again highlighting the elements that should have clued in employees that the email was phony.

It does the same with phone calls. Using a third-party, employees may get a phone call from the help desk or vendor asking for information.

“It’s really trying to get colleagues to understand that attackers, the phishers, will try to come from any angle,” he said.

Dunbar said his team partners with legal, compliance, HR, marketing and other areas “to make sure we have support and things resonate but the actual program — creating it, designing it, is done by us.”

The phishing “exercises create a lot of awareness,” said John Coletti, chief underwriting officer for cyber and technology at XL Catlin. “They are very highly discussed internally and people will say, ‘Hey, did it get you?’ ”

Bob Parisi, managing director, Marsh FINPRO

“A good [training] program,” said Frappolli of The Institutes, “is repeated and updated on a regular basis. It’s a big mistake to do one-time training and then they are off chasing the next fire.”

It’s also a mistake, he said, to give total responsibility for cyber security to the IT department.

“I think it primarily belongs to the risk manager,” Frappolli said. “The risk manager, the HR department and the IT folks should be in lock step on how to educate employees and how to close off threats.”

Companies must also create an environment that is open, said Kaiser of the National Cyber Security Alliance.

“If the response to [clicking on a phishing email] is, ‘How could you be so stupid?’ people aren’t going to tell you,” he said.

And that knowledge is important or hackers could be in a company’s network for months without the company being aware.

Marsh’s Parisi said his favorite testing exercise is when companies send out fake emails and when the link is clicked, the worker’s computer displays a note that the system was taken over by a hacker. After 10 seconds or so, the display changes to a notification that the worker failed the cyber security exercise and must sign up for the next training class.

“I find it odd at times that a lot of companies aren’t as energetic or enthusiastic about training rather than building the latest and newest firewall,” Parisi said.

Crime or Cyber?

When underwriting policies, XL Catlin’s Coletti looks at not only IT system defenses, but also turnover within key areas and outsourcing changes that may result in disgruntled employees. He also looks at segregation of data access, to ensure that employees are limited to necessary data only.

“I think most of the companies we look at have very good employee training, particularly around phishing campaigns. Companies are extremely sensitive to the fact that phishing is the easiest way for a hacker to get a foothold in your organization,” he said.

When it comes to social engineering schemes, such as when an employee wires funds to an imposter, that can create problems with insurance coverage, he said.

“My sense is that doesn’t sound like cyber coverage to me,” Coletti said. “If I trick you into wiring funds to somebody and you do, I’m not sure why that becomes a cyber claim. There’s nothing cyber about that. … To me, that’s crime coverage.

“From a coverage perspective,” said Marsh’s Parisi, “it doesn’t matter if a person has criminal motivation or did something stupid. They will cover it. There’s no stupidity exclusion in cyber policies.”

But it depends on the type of loss that results from a social engineering scheme, he said. If it leads to a breach of privacy or data breach, that would be covered by a cyber policy. If the scheme results in an employee transferring funds, then it would be a crime or fidelity policy.

He noted there also is an “intentional acts limitation” in policies that relates to “the control group,” which generally is seen as the C-suite. If a C-suite executive engaged in fraudulent activity, that may not be covered by insurance, while an act by a “rogue employee” would be covered.

In the last 18 months or so, social engineering fraud endorsements have been available for crime coverage, he said.

“Cyber is not a panacea for all things that involve a computer. There are a lot of ways technology can cause loss or harm that isn’t necessarily picked up under a cyber policy,” Parisi said. “But what we have seen is an increasing reluctance of traditional P&C markets to cover cyber-related perils, creating a vacuum that the cyber markets can fill.”

Rosenzweig of Risk Strategies said there “is not a consistent response across the marketplace” as to whether a social engineering claim is covered under a cyber or crime policy.

“There is still a bit of finger-pointing on this,” he said. “That’s a point of frustration for clients.

“If the program isn’t structured correctly, sometimes these types of claims can fall wtihin the cracks.”

Andy Lea, vice president, underwriting for E&O, media and cyber, at CNA, said that while cyber policies are becoming broader as they relate to social engineering and data, the “available policy language and philosophy differ from carrier to carrier, and coverage can be very fact and circumstance specific, if they provide coverage at all.” &

Anne Freedman is managing editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Report: Marine

Crewless Ships Raise Questions

Is a remote operator legally a master? New technology confounds old terms.
By: | March 5, 2018 • 6 min read

For many developers, the accelerating development of remote-controlled and autonomous ships represents what could be the dawn of a new era. For underwriters and brokers, however, such vessels could represent the end of thousands of years of maritime law and risk management.

Rod Johnson, director of marine risk management, RSA Global Risk

While crewless vessels have yet to breach commercial service, there are active testing programs. Most brokers and underwriters expect small-scale commercial operations to be feasible in a few years, but that outlook only considers technical feasibility. How such operations will be insured remains unclear.

“I have been giving this a great deal of thought, this sits on my desk every day,” said Rod Johnson, director of marine risk management, RSA Global Risk, a major UK underwriter. Johnson sits on the loss-prevention committee of the International Union of Maritime Insurers.

“The agreed uncertainty that underpins marine insurance is falling away, but we are pretending that it isn’t. The contractual framework is being made less relevant all the time.”

Defining Autonomous Vessels

Two types of crewless vessels are being contemplated. First up is a drone with no one on board but actively controlled by a human at a remote command post on land or even on another vessel.

While some debate whether the controllers of drone aircrafts are pilots or operators, the very real question yet to be addressed is if a vessel controller is legally a “master” under maritime law.


The other type of crewless vessel would be completely autonomous, with the onboard systems making decisions about navigation, weather and operations.

Advocates tout the benefits of larger cargo capacity without crew spaces, including radically different hull designs without decks people can walk on. Doubters note a crew can fix things at sea while a ship cannot.

Rolls-Royce is one of the major proponents and designers. The company tested a remote-controlled tug in Copenhagen in June 2017.

“We think the initial early adopters will be vessels operating on fixed routes within coastal waters under the jurisdiction of flag states,” the company said.

“We expect to see the first autonomous vessel in commercial operation by the end of the decade. Further out, around 2025, we expect autonomous vessels to operate further from shore — perhaps coastal cargo ships. For ocean-going vessels to be autonomous, it will require a change in international regulations, so this will take longer.”

Once autonomous ships are a reality, “the entire current legal framework for maritime law and insurance is done,” said Johnson. “The master has not been replaced; he is just gone. Commodity ships (bulk carriers) would be most amenable to that technology. I’m not overly bothered by fully automated ships, but I am extremely bothered by heavily automated ones.”

He cited two risks specifically: hacking and fire.

“We expect to see the first autonomous vessel in commercial operation by the end of the decade. Further out, around 2025, we expect autonomous vessels to operate further from shore — perhaps coastal cargo ships. For ocean-going vessels to be autonomous, it will require a change in international regulations, so this will take longer.” — Rolls-Royce Holdings study

Andrew Kinsey, senior marine risk consultant, Allianz Global Corporate & Specialty, asked an even more existential question: “From an insurance standpoint, are we even still talking about a vessel as it is under law? Starting with the legal framework, the duty of a flag state is ‘manning of ships.’ What about the duty to render assistance? There cannot be insurance coverage of an illegal contract.”

Several sources noted that the technological development of crewless ships, while impressive, seems to be a solution in search of a problem. There is no known need in the market; no shippers, operators, owners or mariners advocate that crewless ships will solve their problems.

Kinsey takes umbrage at the suggestion that promotional material on crewless vessels cherry picks his company’s data, which found 75 percent to 90 percent of marine losses are caused by human error.


“Removing the humans from the vessels does not eliminate the human error. It just moves the human error from the helm to the coder. The reports on development by the companies with a vested interest [in crewless vessels] tend to read a lot like advertisements. The pressure for this is not coming from the end users.”

To be sure, Kinsey is a proponent of automation and technology when applied prudently, believing automation can make strides in areas of the supply chains. Much of the talk about automation is trying to bury the serious shortage of qualified crews. It also overshadows the very real potential for blockchain technology to overhaul the backend of marine insurance.

As a marine surveyor, Kinsey said he can go down to the wharf, inspect cranes, vessels and securements, and supervise loading and unloading — but he can’t inspect computer code or cyber security.

New Times, New Risks

In all fairness, insurance language has changed since the 17th century, especially as technology races ahead in the 21st.

“If you read any hull form, it’s practically Shakespearean,” said Stephen J. Harris, senior vice president of marine protection UK, Marsh. “The language is no longer fit for purpose. Our concern specifically to this topic is that the antiquated language talks about crew being on board. If they are not on board, do they still legally count as crew?”

Harris further questioned, “Under hull insurance, and provided that the ship owner has acted diligently, cover is extended to negligence of the master or crew. Does that still apply if the captain is not on board but sitting at a desk in an office?”

Andrew Kinsey, senior marine risk consultant, Allianz Global Corporate & Specialty

Several sources noted that a few international organizations, notably the Comite Maritime International and the International Maritime Organization, “have been very active in asking the legal profession around the world about their thoughts. The interpretations vary greatly. The legal complications of crewless vessels are actually more complicated than the technology.”

For example, if the operational, insurance and regulatory entities in two countries agree on the voyage of a crewless vessel across the ocean, a mishap or storm could drive the vessel into port or on shore of a third country that does not recognize those agreements.

“What worries insurers is legal uncertainty,” said Harris.

“If an operator did everything fine but a system went down, then most likely the designer would be responsible. But even if a designer explicitly accepted responsibility, what matters would be the flag state’s law in international waters and the local state’s law in territorial waters.


“We see the way ahead for this technology as local and short-sea operations. The law has to catch up with the technology, and it is showing no signs of doing so.”

Thomas M. Boudreau, head of specialty insurance, The Hartford, suggested that remote ferry operations could be the most appropriate use: “They travel fixed routes, all within one country’s waters.”

There could also be environmental and operational benefits from using battery power rather than conventional fuels.

“In terms of underwriting, the burden would shift to the manufacturer and designer of the operating systems,” Boudreau added.

It may just be, he suggested, that crewless ships are merely replacing old risks with new ones. Crews can deal with small repairs, fires or leaks at sea, but small conditions such as those can go unchecked and endanger the whole ship and cargo.

“The cyber risk is also concerning. The vessel may be safe from physical piracy, but what about hacking?” &

Gregory DL Morris is an independent business journalist based in New York with 25 years’ experience in industry, energy, finance and transportation. He can be reached at [email protected]