COVID-19 Can Detonate Cyber Landmines if You Don’t Pinpoint Your Exposures

By: Erin Kenneally | April 2, 2020

Erin Kenneally is the director of cyber risk analytics at Guidewire. She can be reached at [email protected].

While COVID-19 efforts justifiably focus on humanitarian concerns, businesses in the financial and insurance industries should nonetheless be aware of the associated cyber risk implications.

The bad news is that we can reasonably expect corporate cyber risk exposure to mirror the generalized, global spread of COVID-19.

This is because most businesses in affected areas are migrating to telework and remote labor operations, thereby increasing the number of potentially vulnerable targets cyber adversaries can exploit.

Just as natural disasters breed scammers who seek to take advantage of a vulnerable population, the COVID-19 crisis promises to surface its own stresses on our IT infrastructure and resultant brand of opportunistic cyber criminals.

Despite the uncertainty of the infection rate and the absence of vaccines, the good news for cyber risk is that the anticipated threats and vulnerabilities are largely knowable, preventable and defensible.

There remains an open question, however, as to whether this altered cyber risk environment will be temporary or will create a new norm for corporate cyber exposures.

Here are the cyber risk factors that organizations should consider, recommendations for reducing exposure and how analytics can quantify organizational and aggregated cyber risk and impact.

Cyber Risk Factors

Business susceptibility to cyber risk during the COVID-19 pandemic can result from the hasty or ill-prepared migration of the workforce to remote operations, where employees access internal corporate networks from outside the core corporate infrastructure.

Causes of this susceptibility to cyber risk include:

Insufficient IT infrastructure capacity and expertise
Inadequate data governance and enterprise risk management
Inadequate security strategy, architecture and controls
Ineffective enforcement of remote work policies with technical and administrative controls

Threat Vectors and Vulnerabilities

In light of risk factors related to a COVID-19-induced remote workforce, frequency of the following threats are likely to increase. The severity of their impact is a function of companies’ successes in implementing known countermeasures and establishing resiliency measures.

Social engineering and spear-phishing/spam-phishing scams are known attack vectors for compromising business email accounts.
- Spam and phishing scams prey on uncertainties related to COVID-19, luring individuals to click infected attachments or links in email messages that pretend to be updates on Coronavirus and often spoof authoritative organizations (such as the CDC and WHO).
- Phishing kits impersonate well-known, trusted service providers (e.g., Microsoft, Amazon, Google, Dropbox), vendors, suppliers, or partners to deceive employees. Victimization to account fraud or unwittingly revealing confidential business information, intellectual property, PII, or other resources will be heightened for employees who have less exposure in the traditional enterprise network.
Denial-of-service (DoS) attacks: With expanded deployment of VPN and other communication applications (instant messaging, audio, web- and video-conferencing), dependencies on telecommunication infrastructures will be higher, and the frequency of malicious attacks intended to disrupt these services is likely to rise.
Ransomware attacks: Ransomware success rates against organizations are not likely to increase if remote workers are properly segmented from production servers and databases where mission-critical data assets are stored.

Recommendations

Many resources are available to help businesses bolster the confidentiality, availability, and integrity of their business data and systems in a remote workforce regime.

As with basic personal hygiene recommendations for addressing COVID-19, businesses should consider these cyber hygiene practices in assessing and reducing cyber risk exposure for their remote workforce:

Require multifactor authentication for company apps and networks.
Implement a reputable and robust VPN infrastructure (accessed via multifactor authentication).
Mandate employee use of private Wi-Fi networks. When work must be done in public places, require the use of the employee’s mobile hotspot (smartphone or dedicated device) to access a secure connection.
Ensure robust password requirements (complexity, length, diversity), including trusted password managers and change management.
Enforce the use of company-owned communication services (email, messaging, and conferencing via audio, web, and video) and prohibit the use of free online services.
Implement and monitor intrusion detection system filters.
Segment the company network by providing user access to data and systems directly related to users’ tasks or departments.
Assess and monitor identity, credential, access, and key management for third-party partners, vendors, and supply chain entities.
Monitor the vulnerabilities of third-party service providers used by remote workers.
Review and revise all relevant security policies and practices. Train employees on these policies and practices and remind them especially about phishing and social engineering threats.
Regularly test and verify IT continuity after significant changes to the IT infrastructure and/or business applications.
Ensure that a backup plan is implemented that is consistent with IT business continuity and disaster recovery strategies, including: regular testing to ensure data accuracy and recoverability; storing multiple backups, such as two copies on different media and one offsite; and securing data using industry standard encryption.

Implications and Analytics

Although the impact of COVID-19 on supply chains and global economies is still not fully understood, we should anticipate that second-order effects on business cyber risk will follow the known attack patterns and susceptibilities

What is novel, are the scale and speed at which these threats and vulnerabilities will impact companies for which a large scale, distributed remote workforce is unprecedented.

Although the IT sector is presumably prepared to handle increased risk factors, even tech-savvy businesses have exposure to cyber threats via their supply chains (labor, service, and product providers), which will be targets of compromise due to their unreadiness. Heightened litigation risk and business interruption stemming from cyber infrastructure disruption should be a top priority.

None of these COVID-19-derived cyber risks are novel for established cyber coverages at the firm level.

None of these anticipated exposures pose unprecedented implications for the transfer of risk via cyber insurance from the standpoint of correlation with established coverages such as data breaches, liability, network interruption, and extortion.

Other non-affirmative cyber coverages/lines of business that may be impacted include property, financial lines, and general liability.

However, one of the notable potential secondary effects of COVID-19 for insurance and financial service providers is cyber risk accumulation. Companies across industries are more reliant on information and telecommunications infrastructures.

As we gain efficiencies from increased reliance on internet data and control planes (e.g., cloud IaaS-PaaS-SaaS, internet exchange points, broadband), we increase the technical dependencies and aggregate risk potential—along with the resulting frequency and magnitude of cascading and systemic harm.

Additionally, many insurance policies cover malicious and non-malicious incidents in service chain outages. These types of incidents are especially pernicious with increasing globalization and tight coupling of supply chains, enhancing the potential for cyber risk accumulation.

As with COVID-19 health strategies, the key to reducing cyber exposure lies in understanding the nature, scope, and projected impact of cyber risk.

Advanced analytics and data science capabilities can help policy administrators, underwriters, and risk and claims managers diagnose, quantify, forecast, and remedy these cyber risks by providing capabilities such as: identifying signals of a business’ remote IT services associated with a displaced workforce; segmenting cyber risk exposures by sector or virtual and physical geography; understanding risk accumulation paths based on network dependencies (e.g., cloud, ISP); and estimating financial losses for cyber perils like malware, ransomware and data breaches that might affect one or more entities in a portfolio.

Although we have moved from prevention to mitigation/suppression on the COVID-19 front, we still have the opportunity to prevent and manage its secondary effects on cyber risk exposure.

And—as we can corroborate with the biological reality of Coronavirus—testing for indicators of risk is key to understanding and responding to the frequency, distribution, and severity of forthcoming exposures. By engaging robust data, analytics, and domain expertise, companies can position themselves to bridge the disconnect in the interpretation of risk for the financial and insurance industries.

Read a blog post on COVID-19’s cyber risk implications on Guidewire’s Smart Approach Blog. &

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

By: Risk & Insurance | April 3, 2024

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.