Cyber Risk

The Threat from Within

Employees are the most vulnerable point in any organization’s computer network, but many companies fail to pay enough attention to this risk.
By: | March 3, 2017 • 13 min read

On May 21, 2014, the accounting director at AFGlobal Corp. in Texas read an email from his CEO asking him to work with the attorney for an outside auditor in “a strictly confidential financial operation.”

The attorney soon contacted the accounting director and said that $480,000 was needed for due diligence costs pursuant to a pending acquisition of a Chinese company. The attorney sent an email with the wiring instructions, which the director followed.

About a week later, the attorney requested $18 million, at which point, the accounting director became suspicious and told his supervisors.

It is probably no surprise that the “attorney” was an imposter and the email was not from the CEO.

Risk managers schooled on the threat of social engineering would also guess that the imposter knew a great deal about the company’s processes and procedures.

He in fact knew that the accounting director had a “long-standing, very personal and familiar relationship” with the CEO, according to a lawsuit filed by AFGlobal seeking to force its insurance company to repay it for its losses.

“We are now way past the old style of people trying to crack codes to get in through firewalls. The hacking community realized that the weak point in any defense system is the people element,” said Roger Miles, who teaches risk-related psychology at Cambridge University and the UK Defence Academy.

Roger Miles, professor of risk-related psychology, Cambridge University and the UK Defence Academy

“Ordinary employees simply do not have insight into the risk coming at them. The hackers are pretty smart at understanding that,” said Miles, who also researches and consults on risk perception, regulatory design and governance.

“Given the option between the effort of hacking code or getting the average employee in the organization to hand you the key, they clearly see a better return on time spent,” he said.

The risk is staggering.

The Experian Data Breach Resolution and Ponemon Institute found that about 80 percent of all data breaches began with employee activity. Verizon’s Security Breach Investigation Report said that of the top five ways that result in 95 percent of security breaches, four of those five directly involve employee behavior.

Advertisement




Some employee activities are malicious: The IT employee at the American College of Education who allegedly changed the system password before being fired and then offered to sell it back to the organization for $200,000; or the 20 percent of employees who admitted to a Market Pulse Survey by SailPoint that they would sell their company passwords, some for as little as $150.

But most employees are culpable only of not being wary enough.

“You have to be more pessimistic, more mistrusting and more suspicious of intentions,” said Miles. “That’s not a natural behavior of humans. Social engineering exploits ordinary people’s natural goodwill.”

It doesn’t have to be as blatant as the bogus CEO’s email to his accounting department. And that scam probably didn’t start there. That’s where it ended.

It starts with easy questions, by phone or email, from an apparent co-worker or vendor asking for a name or a title. Then, the hackers dive deeper, pulling together corporate hierarchies, co-worker relationships and personal activities.

Sometimes, the emails, apparently from inside the organization, ask users to click onto a link to review a file or log onto a training session.

Or it could be an email from a vendor with an attached invoice that has to be paid or a message from a merchant with instructions on when a package is expected to be delivered, said Larry Lidz, chief information security officer at CNA. When the attachments are clicked, the embedded malicious materials are used to access systems.

“If the program isn’t structured correctly, sometimes these types of claims can fall within the cracks.” —Rob Rosenzweig, vice president and national cyber risk practice leader, Risk Strategies Co.

In the day-to-day time crunch at work, employees may not take the time to look at such innocuous emails suspiciously. And once the link is clicked, the hackers are inside the system.

“As far as my experience,” said Austin Berglas, senior managing director and cyber defense practice head at K2 Intelligence, “with few exceptions, the majority of the successful breaches start because a cyber criminal exploits an employee or third-party who had connectivity inside the target network.”

He said 11 percent to 15 percent of employees will click on an infected email attachment.

“That’s a pretty significant number,” he said. “It often just takes one.”

Martin Frappolli, senior director of knowledge resources, The Institutes

Martin Frappolli, senior director of knowledge resources at The Institutes, which provides training for insurance and risk management professionals, said that corporations are sometimes too distracted by the never-ending news of big data breaches and external cyber liability risks to focus on the risks of employee behavior.

“I don’t want to say [employee behavior] is more important [than external risks] but it’s not getting its full share of attention,” he said. “It’s not top of mind for many organizations.”

He cited an example where criminals left USB memory sticks inside various restrooms of a corporation. They were labeled “confidential salary information.” Not surprisingly, employees who found them plugged the USBs into their computers.

That launched programs that captured and transmitted sensitive data to a criminal organization, Frappolli said.

“That’s a really good example of how easy it is to exploit employees,” he said. “Rarely is it deliberate. It’s not malicious. … It is behaviors they could be educated about.”

Cost may be one reason organizations have not focused more on employee training, but Frappolli said, it’s also a belief that the “threat always seems a little bit more remote than it is.”

Quarterbacking Cyber Risk

Rob Rosenzweig, vice president and national cyber risk practice leader at Risk Strategies Company, said risk managers must take ownership of cyber security.

“In many ways, risk managers are the quarterbacks,” said Rosenzweig, a 2017 Risk & Insurance® Power Broker® winner in the Technology category.

“The coordination of those stakeholders internally often falls on risk management at our clients,” he said. “They are able to drive home to those various stakeholders what the risk is and why everyone should be involved in the process.”

Plus, he said, risk managers are more aware of resources, such as training or other proactive measures, which can be provided either at no cost or at a discounted rate by insurance companies or brokers.

“It’s a win-win for everybody,” Rosenzweig said. “For clients, it’s prevention and for insurers, it makes their clients better risks. I expect to see more in the coming years.”

Prevention, of course, depends on whether the breach was due to carelessness or malfeasance.

“If you have an internal person who knows you really well and has gone over to the dark side for criminal acts, that’s a tough one to deal with,” said Bob Parisi, managing director, Marsh FINPRO.

Rob Rosenzweig, vice president and national cyber risk practice leader, Risk Strategies Co.

But companies can make it more difficult for them. It can be as simple as automatically canceling log-in credentials when employees leave or when vendors complete their work, said Berglas of K2 Intelligence.

A survey by Sailpoint found that two of five former employees could still access their former company’s computer system after they left.

It’s also crucial to segregate data, so that files are available only to employees who need the information to do their jobs, Berglas said. Requiring two-factor authentication, such as an additional password or requiring the use of a thumbprint on an iPhone, is also important, he said.

Michael Kaiser, executive director of the National Cyber Security Alliance, said companies should determine their “most critical or crown jewel assets. What would harm you the most if stolen, lost or destroyed and how do you build protection layers around that?”

Segregating information, he said, can be more challenging in small to mid-size organizations where responsibilities are more diverse.

According to a survey by Kaspersky Lab and B2B International, intentional fraud by employees in enterprise companies amounts to more than $1.3 million in costs, said Andrey Pozhogin, cyber security expert at Kaspersky Lab, in an email.

For small to medium size businesses, it results in over $40,000 in costs per incident, on average. The cost of falling for phishing is more than $48,000 per incident, he said.

Since the report was published, Pozhogin said, Kaspersky Lab has seen a huge jump — eight times as many — in ransomware attacks on companies, which mostly result from phishing.

Beazley reported in January that ransomware attacks quadrupled in 2016 over the previous year, and it expects the attacks to double again in 2017.

According to the FBI, business email compromise, which it defines as sophisticated scams targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments, affected 7,066 businesses from October 2013 to August 2015, for a total loss to U.S. companies of $750 million.

The loss increases to $1.2 billion, when combined with international victims.

Engaging Employees

Pozhogin said the biggest challenges in implementing employee training “are underestimating the risk (both probability and potential impact of a cyber incident) and significant friction when implementing yet another employee education program.”

Advertisement




Tom Dunbar, senior vice president and head of information risk management at XL Catlin, said employees take educational efforts seriously when organizations discuss the consequences and risks of lax cyber security.

“When you demonstrate why you are doing it, why it has meaning, then you get the cooperation,” he said.

Dunbar, who earned a 2014 Risk & Insurance® Risk All Star award for his innovative cyber security work, said his company engages employees by using humorous gamification in its online training to focus on specific cyber security risks, and then it tests them — throughout the year — to keep the messages fresh.

“Given the option between the effort of hacking code or getting the average employee in the organization to hand you the key, they clearly see a better return on time spent.” —Roger Miles, professor of risk-related psychology, Cambridge University and the UK Defence Academy

Last year, it also ran a video campaign on cyber security risks and responses. For every view by an employee, the company donated $1 to charity, he said. His department also uses blogging as well as computer screen savers and wall posters to reinforce the messages.

The training teaches employees, for example, to “mouse over” the link of an email or the firm name and address to see if there are clues to a phishing attempt.

The company also sends out false emails to employees to see “how many we hooked and how many swam away” from a phishing attempt, Dunbar said. Then it sends out the email again highlighting the elements that should have clued in employees that the email was phony.

It does the same with phone calls. Using a third-party, employees may get a phone call from the help desk or vendor asking for information.

“It’s really trying to get colleagues to understand that attackers, the phishers, will try to come from any angle,” he said.

Dunbar said his team partners with legal, compliance, HR, marketing and other areas “to make sure we have support and things resonate but the actual program — creating it, designing it, is done by us.”

The phishing “exercises create a lot of awareness,” said John Coletti, chief underwriting officer for cyber and technology at XL Catlin. “They are very highly discussed internally and people will say, ‘Hey, did it get you?’ ”

Bob Parisi, managing director, Marsh FINPRO

“A good [training] program,” said Frappolli of The Institutes, “is repeated and updated on a regular basis. It’s a big mistake to do one-time training and then they are off chasing the next fire.”

It’s also a mistake, he said, to give total responsibility for cyber security to the IT department.

“I think it primarily belongs to the risk manager,” Frappolli said. “The risk manager, the HR department and the IT folks should be in lock step on how to educate employees and how to close off threats.”

Companies must also create an environment that is open, said Kaiser of the National Cyber Security Alliance.

“If the response to [clicking on a phishing email] is, ‘How could you be so stupid?’ people aren’t going to tell you,” he said.

And that knowledge is important or hackers could be in a company’s network for months without the company being aware.

Marsh’s Parisi said his favorite testing exercise is when companies send out fake emails and when the link is clicked, the worker’s computer displays a note that the system was taken over by a hacker. After 10 seconds or so, the display changes to a notification that the worker failed the cyber security exercise and must sign up for the next training class.

“I find it odd at times that a lot of companies aren’t as energetic or enthusiastic about training rather than building the latest and newest firewall,” Parisi said.

Crime or Cyber?

When underwriting policies, XL Catlin’s Coletti looks at not only IT system defenses, but also turnover within key areas and outsourcing changes that may result in disgruntled employees. He also looks at segregation of data access, to ensure that employees are limited to necessary data only.

“I think most of the companies we look at have very good employee training, particularly around phishing campaigns. Companies are extremely sensitive to the fact that phishing is the easiest way for a hacker to get a foothold in your organization,” he said.

When it comes to social engineering schemes, such as when an employee wires funds to an imposter, that can create problems with insurance coverage, he said.

“My sense is that doesn’t sound like cyber coverage to me,” Coletti said. “If I trick you into wiring funds to somebody and you do, I’m not sure why that becomes a cyber claim. There’s nothing cyber about that. … To me, that’s crime coverage.

“From a coverage perspective,” said Marsh’s Parisi, “it doesn’t matter if a person has criminal motivation or did something stupid. They will cover it. There’s no stupidity exclusion in cyber policies.”

But it depends on the type of loss that results from a social engineering scheme, he said. If it leads to a breach of privacy or data breach, that would be covered by a cyber policy. If the scheme results in an employee transferring funds, then it would be a crime or fidelity policy.

He noted there also is an “intentional acts limitation” in policies that relates to “the control group,” which generally is seen as the C-suite. If a C-suite executive engaged in fraudulent activity, that may not be covered by insurance, while an act by a “rogue employee” would be covered.

In the last 18 months or so, social engineering fraud endorsements have been available for crime coverage, he said.

“Cyber is not a panacea for all things that involve a computer. There are a lot of ways technology can cause loss or harm that isn’t necessarily picked up under a cyber policy,” Parisi said. “But what we have seen is an increasing reluctance of traditional P&C markets to cover cyber-related perils, creating a vacuum that the cyber markets can fill.”

Rosenzweig of Risk Strategies said there “is not a consistent response across the marketplace” as to whether a social engineering claim is covered under a cyber or crime policy.

“There is still a bit of finger-pointing on this,” he said. “That’s a point of frustration for clients.

“If the program isn’t structured correctly, sometimes these types of claims can fall wtihin the cracks.”

Andy Lea, vice president, underwriting for E&O, media and cyber, at CNA, said that while cyber policies are becoming broader as they relate to social engineering and data, the “available policy language and philosophy differ from carrier to carrier, and coverage can be very fact and circumstance specific, if they provide coverage at all.” &

Anne Freedman is managing editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Emerging Risks

Stadium Safety

Soft targets, such as sports stadiums, must increase measures to protect lives and their business.
By: | January 10, 2018 • 8 min read

Acts of violence and terror can break out in even the unlikeliest of places.

Look at the 2013 Boston Marathon, where two bombs went off, killing three and injuring dozens of others in a terrorist attack. Or consider the Orlando Pulse nightclub, where 49 people were killed and 58 wounded. Most recently in Las Vegas, a gunman killed 58 and injured hundreds of others.

Advertisement




The world is not inherently evil, but these evil acts still find a way into places like churches, schools, concerts and stadiums.

“We didn’t see these kinds of attacks 20 years ago,” said Glenn Chavious, managing director, global sports & recreation practice leader, Industria Risk & Insurance Services.

As a society, we have advanced through technology, he said. Technology’s platform has enabled the message of terror to spread further faster.

“But it’s not just with technology. Our cultures, our personal grievances, have brought people out of their comfort zones.”

Chavious said that people still had these grievances 20 years ago but were less likely to act out. Tech has linked people around the globe to other like-minded individuals, allowing for others to join in on messages of terror.

“The progression of terrorist acts over the last 10 years has very much been central to the emergence of ‘lone wolf’ actors. As was the case in both Manchester and Las Vegas, the ‘lone wolf’ dynamic presents an altogether unique set of challenges for law enforcement and event service professionals,” said John

Glenn Chavious, managing director, global sports & recreation practice leader, Industria Risk & Insurance Services

Tomlinson, senior vice president, head of entertainment, Lockton.

As more violent outbreaks take place in public spaces, risk managers learn from and better understand what attackers want. Each new event enables risk managers to see what works and what can be improved upon to better protect people and places.

But the fact remains that the nature and pattern of attacks are changing.

“Many of these actions are devised in complete obscurity and on impulse, and are carried out by individuals with little to no prior visibility, in terms of behavioral patterns or threat recognition, thus making it virtually impossible to maintain any elements of anticipation by security officials,” said Tomlinson.

With vehicles driving into crowds, active shooters and the random nature of attacks, it’s hard to gauge what might come next, said Warren Harper, global sports & events practice leader, Marsh.

Public spaces like sporting arenas are particularly vulnerable because they are considered ‘soft targets.’ They are areas where people gather in large numbers for recreation. They are welcoming to their patrons and visitors, much like a hospital, and the crowds that attend come in droves.

NFL football stadiums, for example, can hold anywhere from 25,000 to 93,000 people at maximum capacity — and that number doesn’t include workers, players or other behind-the-scenes personnel.

“Attacks are a big risk management issue,” said Chavious. “Insurance is the last resort we want to rely upon. We’d rather be preventing it to avoid such events.”

Preparing for Danger

The second half of 2017 proved a trying few months for the insurance industry, facing hurricanes, earthquakes, wildfires and — unfortunately — multiple mass shootings.

The industry was estimated to take a more than $1 billion hit from the Las Vegas massacre in October 2017. A few years back, the Boston Marathon bombings cost businesses around $333 million each day the city was shut down following the attack. Officials were on a manhunt for the suspects in question, and Boston was on lockdown.

“Many of these actions are devised in complete obscurity and on impulse, and are carried out by individuals with little to no prior visibility.” — John Tomlinson, senior vice president, head of entertainment, Lockton

“Fortunately, we have not had a complete stadium go down,” said Harper. But a mass casualty event at a stadium can lead to the death or injury of athletes, spectators and guests; psychological trauma; potential workers’ comp claims from injured employees; lawsuits; significant reputational damage; property damage and prolonged business interruption losses.

The physical damage, said Harper, might be something risk managers can gauge beforehand, but loss of life is immeasurable.

Advertisement




The best practice then, said Chavious, is awareness and education.

“A lot of preparedness comes from education. [Stadiums] need a risk management plan.”

First and foremost, Chavious said, stadiums need to perform a security risk assessment. Find out where vulnerable spots are, decide where education can be improved upon and develop other safety measures over time.

Areas outside the stadium are soft targets, said Harper. The parking lot, the ticketing and access areas and even the metro transit areas where guests mingle before and after a game are targeted more often than inside.

Last year, for example, a stadium in Manchester was the target of a bomb, which detonated outside the venue as concert-goers left. In 2015, the Stade de France in Paris was the target of suicide bombers and active shooters, who struck the outside of the stadium while a soccer match was held inside.

Security, therefore, needs to be ready to react both inside and outside the vicinity. Reviewing past events and seeing what works has helped risk mangers improve safety strategies.

“A lot of places are getting into table-top exercises” to make sure their people are really trained, added Harper.

In these exercises, employees from various departments come together to brainstorm and work through a hypothetical terrorist situation.

A facilitator will propose the scenario — an active shooter has been spotted right before the game begins, someone has called in a bomb threat, a driver has fled on foot after driving into a crowd — and the stadium’s staff is asked how they should respond.

“People tend to act on assumptions, which may be wrong, but this is a great setting for them to brainstorm and learn,” said Harper.

Technology and Safety

In addition to education, stadiums are ahead of the game, implementing high-tech security cameras and closed-circuit TV monitoring, requiring game-day audiences to use clear/see-through bags when entering the arena, upping employee training on safety protocols and utilizing vapor wake dogs.

Drones are also adding a protective layer.

John Tomlinson, senior vice president, head of entertainment, Lockton

“Drones are helpful in surveying an area and can alert security to any potential threat,” said Chavious.

“Many stadiums have an area between a city’s metro and the stadium itself. If there’s a disturbance there, and you don’t have a camera in that area, you could use the drone instead of moving physical assets.”

Chavious added that “the overhead view will pick up potential crowd concentration, see if there are too many people in one crowd, or drones can fly overhead and be used to assess situations like a vehicle that’s in a place it shouldn’t be.”

But like with all new technology, drones too have their downsides. There’s the expense of owning, maintaining and operating the drone. Weather conditions can affect how and when a drone is used, so it isn’t a reliable source. And what if that drone gets hacked?

“The evolution of venue security protocols most certainly includes the increased usage of unmanned aerial systems (UAS), including drones, as the scope and territorial vastness provided by UAS, from a monitoring perspective, is much more expansive than ground-based apparatus,” said Tomlinson.

“That said,” he continued, “there have been many documented instances in which the intrusion of unauthorized drones at live events have posed major security concerns and have actually heightened the risk of injury to participants and attendees.”

Still, many experts, including Tomlinson, see drones playing a significant role in safety at stadiums moving forward.

“I believe the utilization of drones will continue to be on the forefront of risk mitigation innovation in the live event space, albeit with some very tight operating controls,” he said.

The SAFETY Act

In response to the terrorist attacks on Sept. 11, 2001, U.S. Homeland Security enacted the Support Anti-Terrorism by Fostering Effective

Warren Harper, global sports & events practice leader, Marsh

Technologies Act (SAFETY Act).

The primary purpose of the SAFETY Act was to encourage potential manufacturers or sellers of anti-terrorism technologies to continue to develop and commercialize these technologies (like video monitoring or drones).

There was a worry that the threat of liability in such an event would deter and prevent sellers from pursing these technologies, which are aimed at saving lives. Instead, the SAFETY Act provides incentive by adding a system of risk and litigation management.

“[The SAFETY Act] is geared toward claims arising out of acts of terrorism,” said Harper.

Bottom line: It’s added financial protection. Businesses both large and small can apply for the SAFETY designation — in fact, many NFL teams push for the designation. So far, four have reached SAFETY certification: Lambeau Field, MetLife Stadium, University of Phoenix Stadium and Gillette Stadium.

Advertisement




To become certified, reviewers with the SAFETY Act assess stadiums for their compliance with the most up-to-date terrorism products. They look at their built-in emergency response plans, cyber security measures, hiring and training of employees, among other criteria.

The process can take over a year, but once certified, stadiums benefit because liability for an event is lessened. One thing to remember, however, is that the added SAFETY Act protection only holds weight when a catastrophic event is classified as an act of terrorism.

“Generally speaking, I think the SAFETY Act has been instrumental in paving the way for an accelerated development of anti-terrorism products and services,” said Tomlinson.

“The benefit of gaining elements of impunity from third-party liability related matters has served as a catalyst for developers to continue to push the envelope, so to speak, in terms of ideas and innovation.”

So while attackers are changing their methods and trying to stay ahead of safety protocols at stadiums, the SAFETY Act, as well as risk managers and stadium owners, keep stadiums investing in newer, more secure safety measures. &

Autumn Heisler is a staff writer at Risk & Insurance. She can be reached at [email protected]