Cyber Risk

The Threat from Within

Employees are the most vulnerable point in any organization’s computer network, but many companies fail to pay enough attention to this risk.
By: | March 3, 2017 • 13 min read

On May 21, 2014, the accounting director at AFGlobal Corp. in Texas read an email from his CEO asking him to work with the attorney for an outside auditor in “a strictly confidential financial operation.”

The attorney soon contacted the accounting director and said that $480,000 was needed for due diligence costs pursuant to a pending acquisition of a Chinese company. The attorney sent an email with the wiring instructions, which the director followed.

About a week later, the attorney requested $18 million, at which point, the accounting director became suspicious and told his supervisors.

It is probably no surprise that the “attorney” was an imposter and the email was not from the CEO.

Risk managers schooled on the threat of social engineering would also guess that the imposter knew a great deal about the company’s processes and procedures.

He in fact knew that the accounting director had a “long-standing, very personal and familiar relationship” with the CEO, according to a lawsuit filed by AFGlobal seeking to force its insurance company to repay it for its losses.

“We are now way past the old style of people trying to crack codes to get in through firewalls. The hacking community realized that the weak point in any defense system is the people element,” said Roger Miles, who teaches risk-related psychology at Cambridge University and the UK Defence Academy.

Roger Miles, professor of risk-related psychology, Cambridge University and the UK Defence Academy

“Ordinary employees simply do not have insight into the risk coming at them. The hackers are pretty smart at understanding that,” said Miles, who also researches and consults on risk perception, regulatory design and governance.

“Given the option between the effort of hacking code or getting the average employee in the organization to hand you the key, they clearly see a better return on time spent,” he said.

The risk is staggering.

The Experian Data Breach Resolution and Ponemon Institute found that about 80 percent of all data breaches began with employee activity. Verizon’s Security Breach Investigation Report said that of the top five ways that result in 95 percent of security breaches, four of those five directly involve employee behavior.

Advertisement




Some employee activities are malicious: The IT employee at the American College of Education who allegedly changed the system password before being fired and then offered to sell it back to the organization for $200,000; or the 20 percent of employees who admitted to a Market Pulse Survey by SailPoint that they would sell their company passwords, some for as little as $150.

But most employees are culpable only of not being wary enough.

“You have to be more pessimistic, more mistrusting and more suspicious of intentions,” said Miles. “That’s not a natural behavior of humans. Social engineering exploits ordinary people’s natural goodwill.”

It doesn’t have to be as blatant as the bogus CEO’s email to his accounting department. And that scam probably didn’t start there. That’s where it ended.

It starts with easy questions, by phone or email, from an apparent co-worker or vendor asking for a name or a title. Then, the hackers dive deeper, pulling together corporate hierarchies, co-worker relationships and personal activities.

Sometimes, the emails, apparently from inside the organization, ask users to click onto a link to review a file or log onto a training session.

Or it could be an email from a vendor with an attached invoice that has to be paid or a message from a merchant with instructions on when a package is expected to be delivered, said Larry Lidz, chief information security officer at CNA. When the attachments are clicked, the embedded malicious materials are used to access systems.

“If the program isn’t structured correctly, sometimes these types of claims can fall within the cracks.” —Rob Rosenzweig, vice president and national cyber risk practice leader, Risk Strategies Co.

In the day-to-day time crunch at work, employees may not take the time to look at such innocuous emails suspiciously. And once the link is clicked, the hackers are inside the system.

“As far as my experience,” said Austin Berglas, senior managing director and cyber defense practice head at K2 Intelligence, “with few exceptions, the majority of the successful breaches start because a cyber criminal exploits an employee or third-party who had connectivity inside the target network.”

He said 11 percent to 15 percent of employees will click on an infected email attachment.

“That’s a pretty significant number,” he said. “It often just takes one.”

Martin Frappolli, senior director of knowledge resources, The Institutes

Martin Frappolli, senior director of knowledge resources at The Institutes, which provides training for insurance and risk management professionals, said that corporations are sometimes too distracted by the never-ending news of big data breaches and external cyber liability risks to focus on the risks of employee behavior.

“I don’t want to say [employee behavior] is more important [than external risks] but it’s not getting its full share of attention,” he said. “It’s not top of mind for many organizations.”

He cited an example where criminals left USB memory sticks inside various restrooms of a corporation. They were labeled “confidential salary information.” Not surprisingly, employees who found them plugged the USBs into their computers.

That launched programs that captured and transmitted sensitive data to a criminal organization, Frappolli said.

“That’s a really good example of how easy it is to exploit employees,” he said. “Rarely is it deliberate. It’s not malicious. … It is behaviors they could be educated about.”

Cost may be one reason organizations have not focused more on employee training, but Frappolli said, it’s also a belief that the “threat always seems a little bit more remote than it is.”

Quarterbacking Cyber Risk

Rob Rosenzweig, vice president and national cyber risk practice leader at Risk Strategies Company, said risk managers must take ownership of cyber security.

“In many ways, risk managers are the quarterbacks,” said Rosenzweig, a 2017 Risk & Insurance® Power Broker® winner in the Technology category.

“The coordination of those stakeholders internally often falls on risk management at our clients,” he said. “They are able to drive home to those various stakeholders what the risk is and why everyone should be involved in the process.”

Plus, he said, risk managers are more aware of resources, such as training or other proactive measures, which can be provided either at no cost or at a discounted rate by insurance companies or brokers.

“It’s a win-win for everybody,” Rosenzweig said. “For clients, it’s prevention and for insurers, it makes their clients better risks. I expect to see more in the coming years.”

Prevention, of course, depends on whether the breach was due to carelessness or malfeasance.

“If you have an internal person who knows you really well and has gone over to the dark side for criminal acts, that’s a tough one to deal with,” said Bob Parisi, managing director, Marsh FINPRO.

Rob Rosenzweig, vice president and national cyber risk practice leader, Risk Strategies Co.

But companies can make it more difficult for them. It can be as simple as automatically canceling log-in credentials when employees leave or when vendors complete their work, said Berglas of K2 Intelligence.

A survey by Sailpoint found that two of five former employees could still access their former company’s computer system after they left.

It’s also crucial to segregate data, so that files are available only to employees who need the information to do their jobs, Berglas said. Requiring two-factor authentication, such as an additional password or requiring the use of a thumbprint on an iPhone, is also important, he said.

Michael Kaiser, executive director of the National Cyber Security Alliance, said companies should determine their “most critical or crown jewel assets. What would harm you the most if stolen, lost or destroyed and how do you build protection layers around that?”

Segregating information, he said, can be more challenging in small to mid-size organizations where responsibilities are more diverse.

According to a survey by Kaspersky Lab and B2B International, intentional fraud by employees in enterprise companies amounts to more than $1.3 million in costs, said Andrey Pozhogin, cyber security expert at Kaspersky Lab, in an email.

For small to medium size businesses, it results in over $40,000 in costs per incident, on average. The cost of falling for phishing is more than $48,000 per incident, he said.

Since the report was published, Pozhogin said, Kaspersky Lab has seen a huge jump — eight times as many — in ransomware attacks on companies, which mostly result from phishing.

Beazley reported in January that ransomware attacks quadrupled in 2016 over the previous year, and it expects the attacks to double again in 2017.

According to the FBI, business email compromise, which it defines as sophisticated scams targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments, affected 7,066 businesses from October 2013 to August 2015, for a total loss to U.S. companies of $750 million.

The loss increases to $1.2 billion, when combined with international victims.

Engaging Employees

Pozhogin said the biggest challenges in implementing employee training “are underestimating the risk (both probability and potential impact of a cyber incident) and significant friction when implementing yet another employee education program.”

Advertisement




Tom Dunbar, senior vice president and head of information risk management at XL Catlin, said employees take educational efforts seriously when organizations discuss the consequences and risks of lax cyber security.

“When you demonstrate why you are doing it, why it has meaning, then you get the cooperation,” he said.

Dunbar, who earned a 2014 Risk & Insurance® Risk All Star award for his innovative cyber security work, said his company engages employees by using humorous gamification in its online training to focus on specific cyber security risks, and then it tests them — throughout the year — to keep the messages fresh.

“Given the option between the effort of hacking code or getting the average employee in the organization to hand you the key, they clearly see a better return on time spent.” —Roger Miles, professor of risk-related psychology, Cambridge University and the UK Defence Academy

Last year, it also ran a video campaign on cyber security risks and responses. For every view by an employee, the company donated $1 to charity, he said. His department also uses blogging as well as computer screen savers and wall posters to reinforce the messages.

The training teaches employees, for example, to “mouse over” the link of an email or the firm name and address to see if there are clues to a phishing attempt.

The company also sends out false emails to employees to see “how many we hooked and how many swam away” from a phishing attempt, Dunbar said. Then it sends out the email again highlighting the elements that should have clued in employees that the email was phony.

It does the same with phone calls. Using a third-party, employees may get a phone call from the help desk or vendor asking for information.

“It’s really trying to get colleagues to understand that attackers, the phishers, will try to come from any angle,” he said.

Dunbar said his team partners with legal, compliance, HR, marketing and other areas “to make sure we have support and things resonate but the actual program — creating it, designing it, is done by us.”

The phishing “exercises create a lot of awareness,” said John Coletti, chief underwriting officer for cyber and technology at XL Catlin. “They are very highly discussed internally and people will say, ‘Hey, did it get you?’ ”

Bob Parisi, managing director, Marsh FINPRO

“A good [training] program,” said Frappolli of The Institutes, “is repeated and updated on a regular basis. It’s a big mistake to do one-time training and then they are off chasing the next fire.”

It’s also a mistake, he said, to give total responsibility for cyber security to the IT department.

“I think it primarily belongs to the risk manager,” Frappolli said. “The risk manager, the HR department and the IT folks should be in lock step on how to educate employees and how to close off threats.”

Companies must also create an environment that is open, said Kaiser of the National Cyber Security Alliance.

“If the response to [clicking on a phishing email] is, ‘How could you be so stupid?’ people aren’t going to tell you,” he said.

And that knowledge is important or hackers could be in a company’s network for months without the company being aware.

Marsh’s Parisi said his favorite testing exercise is when companies send out fake emails and when the link is clicked, the worker’s computer displays a note that the system was taken over by a hacker. After 10 seconds or so, the display changes to a notification that the worker failed the cyber security exercise and must sign up for the next training class.

“I find it odd at times that a lot of companies aren’t as energetic or enthusiastic about training rather than building the latest and newest firewall,” Parisi said.

Crime or Cyber?

When underwriting policies, XL Catlin’s Coletti looks at not only IT system defenses, but also turnover within key areas and outsourcing changes that may result in disgruntled employees. He also looks at segregation of data access, to ensure that employees are limited to necessary data only.

“I think most of the companies we look at have very good employee training, particularly around phishing campaigns. Companies are extremely sensitive to the fact that phishing is the easiest way for a hacker to get a foothold in your organization,” he said.

When it comes to social engineering schemes, such as when an employee wires funds to an imposter, that can create problems with insurance coverage, he said.

“My sense is that doesn’t sound like cyber coverage to me,” Coletti said. “If I trick you into wiring funds to somebody and you do, I’m not sure why that becomes a cyber claim. There’s nothing cyber about that. … To me, that’s crime coverage.

“From a coverage perspective,” said Marsh’s Parisi, “it doesn’t matter if a person has criminal motivation or did something stupid. They will cover it. There’s no stupidity exclusion in cyber policies.”

But it depends on the type of loss that results from a social engineering scheme, he said. If it leads to a breach of privacy or data breach, that would be covered by a cyber policy. If the scheme results in an employee transferring funds, then it would be a crime or fidelity policy.

He noted there also is an “intentional acts limitation” in policies that relates to “the control group,” which generally is seen as the C-suite. If a C-suite executive engaged in fraudulent activity, that may not be covered by insurance, while an act by a “rogue employee” would be covered.

In the last 18 months or so, social engineering fraud endorsements have been available for crime coverage, he said.

“Cyber is not a panacea for all things that involve a computer. There are a lot of ways technology can cause loss or harm that isn’t necessarily picked up under a cyber policy,” Parisi said. “But what we have seen is an increasing reluctance of traditional P&C markets to cover cyber-related perils, creating a vacuum that the cyber markets can fill.”

Rosenzweig of Risk Strategies said there “is not a consistent response across the marketplace” as to whether a social engineering claim is covered under a cyber or crime policy.

“There is still a bit of finger-pointing on this,” he said. “That’s a point of frustration for clients.

“If the program isn’t structured correctly, sometimes these types of claims can fall wtihin the cracks.”

Andy Lea, vice president, underwriting for E&O, media and cyber, at CNA, said that while cyber policies are becoming broader as they relate to social engineering and data, the “available policy language and philosophy differ from carrier to carrier, and coverage can be very fact and circumstance specific, if they provide coverage at all.” &

Anne Freedman is managing editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Reputational Risk

Under Siege

Driven by social media, political wars spill over into the corporate arena, threatening reputations.
By: | May 2, 2017 • 12 min read

On Jan. 28, the New York Taxi Workers Alliance called a strike at John F. Kennedy International Airport, one day after President Trump signed an executive order banning entry of foreign nationals from seven Muslim-majority nations, including a blanket ban on refugees. The strike was an act of solidarity with immigrants, and a public display of the Alliance’s opposition to the executive order.

Advertisement




Uber, however, continued to service the airport, tweeting that it would halt surge pricing during the protests. Some saw it as an opportunistic ploy to get more riders to use Uber. A #deleteUber Twitter campaign was quickly born, with users tweeting screen shots of themselves removing the app from their smartphones.

More than 200,000 were estimated to have uninstalled the ride-sharing service over the course of the weekend.

Uber CEO Travis Kalanick reacted, creating a $3 million legal defense fund to provide lawyers and immigration experts for any of its drivers that were barred from the U.S., and promising that drivers would be compensated for lost wages.

Over the same weekend, in response to the travel ban, Starbucks CEO Howard Schultz announced that the company would hire 10,000 refugees worldwide over the next five years. Then it was Starbucks turn to get punished in the public arena. A #boycottStarbucks campaign was launched by people who felt the company should focus more on hiring American veterans.

Athletic shoemaker New Balance suffered blowback in November of 2016 when its vice president of communications, Matt LeBretton, told the “Wall Street Journal” in an interview that he believed “things are going to move in the right direction” under the new administration. Angry customers began posting pictures of themselves trashing or even burning their New Balance sneakers.

These social media-fueled public relations crises demonstrate how fickle public opinion can be. They also serve as warning signs of growing reputational risk for corporations.

Uber, for example, typically stops its surge pricing in the event of emergency so as not to exploit a crisis for its own benefit. To do so during the protests and taxi strike at JFK was perhaps meant to show its respect for the event.

Helen Chue, global risk manager, Facebook

Starbucks’ 10,000 refugee hires would be spread out across its locations around the globe, not just in the U.S., where the coffee conglomerate already promised to hire 25,000 veterans and military spouses by 2025.

New Balance’s LeBretton was speaking specifically about the Trans-Pacific Partnership during his interview, and how the deal could hurt sneaker production in the U.S. while favoring foreign producers — he wasn’t talking about Trump’s other proposed plans.

These companies, in reality, did nothing as abhorrent and scandalous as the Twitterverse may have led some to believe, but context isn’t always provided in 140 characters.

Public Pressure

Complaints and boycotts have been launched at companies via social media for perhaps as long as social media has existed. But the current contentious environment created by one of the most divisive leaders in American history now colors every public statement made by prominent business leaders with a political tint. Executives are stuck between a rock and a hard place. They’re exposed to reputational damage whether they oppose or endorse a Trump action, or even if they do nothing at all.

Take Elon Musk, for example, founder of Tesla and SpaceX and a well-known advocate for climate research and environmental protection. He came under fire for not publicly denouncing the travel ban and for keeping his seat on Trump’s business advisory council.

Musk has largely avoided the limelight on political issues, couching statements when he makes them at all — as most executives are wont to do. But he was prodded to defend himself on Twitter after some users suggested he was a hypocrite.

“Be proactive in your plans to mitigate the aftermath and how to communicate. Own up to error. Be transparent. Salvage your crown jewel.” —Helen Chue, global risk manager, Facebook

A strategy of avoidance may no longer work as consumers, employees and the public at large pressure companies to make a statement or take action in response to political events.

“A large segment of the population expects the people they do business with and the companies they buy from to support their point of view or respond to political or social issues in a certain way,” said Chrystina M. Howard, senior vice president, strategic risk consulting, Willis Towers Watson.

In a damned-if-you-do, damned-if-you-don’t environment, reputation risk is expanding, and risk managers need to re-evaluate how they assess their exposure and build mitigation strategies.

A True Crisis?

The challenge begins with determining whether a negative public relations event is really a crisis. Is it a temporary blow to a brand, or does it have the potential to do long-term reputation damage? Misreading the signs could lead companies to overreact and further tarnish their image.

“These sudden public relations crises are a source of panic for companies, but sometimes it sounds much worse than it actually is. The financial ramifications may not be anywhere near what was feared,” Howard said.

“Uber is probably a good example of what not to do,” said Jeff Cartwright, director of communications at Morning Consult, a brand and political intelligence firm.

“They maybe went over the top in trying to reverse the way they handled the protests at JFK.”

Tracking brand value in real time can give risk managers insight into the true impact of a negative social media campaign or bad press.  Michael Ramlet, CEO and co-founder of Morning Consult, said most events don’t damage brands as much as trending hashtags make it appear.

Morning Consult’s proprietary brand tracking tool allows companies to measure their brand perception against influencing events like a spike of Twitter mentions and news stories. More often than not, overall brand loyalty remains on par with industry averages.

In Uber’s case, Twitter mentions spiked to roughly 8,800 on Jan. 29, up from about 1,000 the day before. By Jan. 31, though, the number was back down to around 1,250 and quickly settled back down to its average numbers. From the beginning of the #deleteUber campaign through the end of February, Uber’s favorability shrunk from 50 percent to roughly 40 percent, based on a series of polls taken by 18,908 respondents.

Advertisement




It’s a significant dip, but likely not a permanent stain on the company’s reputation, especially after Kalanick’s public show of support for immigrants and rejection of the travel ban. Uber’s favorability rating remained higher than competitor Lyft’s throughout the ordeal.

“The #deleteUber campaign turned out to be a very local thing that didn’t have a widespread impact,” Ramlet said.

“Twitter at best is an imputed analysis of what people are saying. The vocal minority might be very active, but there might be a silent majority who still think fondly of a brand, or at least have no negative opinions of it.”

He said risk managers can also benefit by breaking down their brand perception into geographic and demographic subsets. It can, for example, show whether a brand is favored more heavily by Democrats or Republicans.

“If you have that data on day one, it can help you determine how to respond if, say, Trump tweets at you,” Ramlet said.

Of course, some spikes in news media and social media attention are indicative of much deeper problems and true reputational risk.

After the Wells Fargo dummy-account scandal broke, for example, unfavorability ratings as measured by Morning Consult jumped from roughly 20 percent to nearly 55 percent, while favorability dropped from 50 percent to 30 percent. Net favorability, which stood at 33 percent pre-scandal, fell to -4 percent post-scandal.

“They went from being the most popular bank to the least popular in less than four months, according to our data,” Ramlet said.

The contrast between Uber’s and Wells Fargo’s stories demonstrates the difference between a more surface-level public-relations event that temporarily hurts brand image, and a true reputation event.

“Failures that produce real and lasting damage to reputation include failures of ethics, innovation, safety, security, quality and sustainability,” said Nir Kossovksy, CEO of Steel City Re.

“Activists make a lot of noise that can be channeled through various media, but for the most part in the business world, stakeholders are interested in the goods and services a company offers, not in their political or social views. As long as you can meet stakeholder expectations, you avoid long-term reputational damage.”

Wells Fargo’s scandal involved a violation of ethics, sparked an SEC investigation and forced the resignation of its CEO, John Stumpf. It’s safe to say stakeholders were severely disappointed.

That’s not to say, however, that a tarnished brand name doesn’t also impact the bottom line.

“Even if a bad event is short-lived, the equity markets react quickly, so there may be sharp equity dips. There may be some economic impact even over the short term,” Kossovsky said, “because sharp dips are dog whistles for activists, litigators and corporate raiders.”

Social Media Machine

The root of reputation risk’s tightening grip lies in the politicizing of business, and consumers’ increased desire to buy from companies that share their values. Social media may not be driving that trend, but it acts as a vehicle for it.

“Social media has really changed the game in terms of brand equity, and has given people another way to choose who they give their money to,” Howard of Willis Towers Watson said.

Platforms like Twitter make it easier for consumers to directly reach out to big companies and allow news to travel at warp speed.

“Social media are communication channels that can take a story and make it widely available. In that regard, the media risk is no different than that posed by a newspaper or radio channel,” Kossovsky said.

“The difference today that changes the strategy for risk managers and boards is that social media has been weaponized: Stories shared on social media don’t necessarily have to contain truthful content, and there’s not always an obvious difference between what’s true and what’s not.”

Helen Chue, Facebook’s global risk manager, agreed.

“More influential than social media platforms is today’s culture of immediacy and headlines. Because we are inundated with information from so many sources, we scan the headlines, form our opinions and go from there,” she said.

“It’s dangerous to draw conclusions without taking a balanced approach, but who has the time and patience to sift through all the different viewpoints?”

An environment of political divisiveness, driven by speed and immediacy of social media, creates the risk that false or half-true stories are disseminated before companies have a chance to clarify. This is what happened to Uber and New Balance.

“It creates the opportunity to turn a non-problem into a problem,” Kossovksy said.

“That’s how social media changes the calculus of risk management.”

Risk Mitigation

The best way to battle both political pressure and social media’s speed is through an ironclad communication strategy; a process that risk managers can lead.

Advertisement




“Risk managers play a crucial role in mitigating reputation risk,” Howard said.

“They bring with them the discipline of managing and monitoring a risk, having a plan and responding to crisis. Now they really have to partner with communications, marketing and PR.”

They also have to get the attention of their board of directors.

“If you let a gap form between what you say and what you do, that gap is the definition of reputation risk.” — Nir Kossovksy, CEO of Steel City Re

“This is both a company-wide risk and personal leadership risk, so the board needs to drive a company-wide policy that protects the board as well,” Kossovsky said.

The art of mitigating reputation risk, he said, comes down to managing expectations. Corporate communications should clearly convey what a company believes and what it does not believe; what it can do and what it can’t do. And those stated values need to align with the operational reality. It comes down to creating credibility and legitimacy.

“If you let a gap form between what you say and what you do, that gap is the definition of reputation risk,” he said. A strong communication strategy can prevent adverse events from turning into reputational threats.

Willis Towers Watson helps clients test their strategies through a table-top exercise in which they have to respond to a social media-driven reputation event.

“We’ll say, ‘Something happened with X product, and now everyone’s on Twitter lambasting you and calling for resignations, etc.’ What do you do on day one? What do you do a week out? How long do you continue to monitor it and keep it on your radar?” Howard said.

“If you have that plan in place, you can fine-tune it going forward as circumstances change.”

Sometimes, though, the communication strategy fails, and a company falls short of meeting stakeholders’ expectations. Now it’s time for crisis management.

“Volatility creates vulnerability. If you stumble on your corporate message, it creates an opportunity for activists, litigators and corporate raiders to exploit. So you need to have authoritative third parties who can attest to your credibility and affirm the truth of the situation to open-minded stakeholders,” Kossovsky said.

Owning up to any mistakes, reaffirming the truth and being as transparent as possible will be key in any response plan.

Insuring the Risk

Recouping dollars lost from reputation damage requires a blend of mathematics with a little magic. While some traditional products are available, reputation risk is, for the most part, an intangible and uninsurable risk.

“Many companies have leveraged their captive insurance companies in the absence of traditional reputation products in the marketplace,” said Derrick Easton, managing director, alternative risk transfer solutions practice, Willis Towers Watson.

“It goes back to measuring a loss that can include lost revenue, or increased costs. Some companies build indexes in the same way we might create an index for a weather product, using rainfall or wind speed. For reputation, we might use stock price or a more refined index,” he said.

“If we can measure a potential loss, we can build a financing structure.”

While there’s no clear-cut way to measure losses from reputation damage, “stock performance and reported sales changes are some of the best tools we have,” Howard said.

Some insurers, including Allianz and Tokiomarine Kiln, and Steel City Re, an MGA, do offer reputation policies. When these fit a company’s needs, they have the ancillary benefit of affirming quality of governance and sending a signal that the insured is prepared to defend itself.

“Because reputation assurance is only available to companies that have demonstrated sound governance processes, it helps to convince people that if a bad piece of news happens, it’s idiosyncratic; it doesn’t reflect what the company really stands for,” Kossovsky of Steel City Re said.

Advertisement




“And it tells activists, broadly defined, not to look for low-hanging fruit here.”

In a volatile political environment, companies fare best when they simply tell the truth.

“The American public will accept an apology if delivered quickly and if it’s sincere,” said Stephen Greyser, Richard P. Chapman professor (marketing/communications) emeritus, of the Harvard Business School.

“Tell the truth. Don’t stonewall. A bad social media campaign can be an embarrassment, but if you stick to the facts and apologize when you need to, people forget about the bad quickly.”

“Reputation is the crown jewel,” Chue said. “Given the power of social media’s reach, one individual can have a tsunami-like influence. And it can happen when you least expect it, and it will probably be something you thought was innocuous or even positive that sets off a maelstrom.

“Plan for the worst-case scenario. Be proactive in your plans to mitigate the aftermath and how to communicate. Own up to error. Be transparent. Salvage your crown jewel.” &

Katie Siegel is a staff writer at Risk & Insurance®. She can be reached at [email protected]