COVID Is a Cyber Attack Enabler. How to Shut the Door on the Risk

The move of millions of workers to home offices provided flexibility during the pandemic, but it has also amplified cyber risk.
By: | October 13, 2020

Amid the COVID-19 outbreak, many companies have transitioned to an at-home workforce. While remote work itself is not new, the sheer volume of companies deploying technology to stay productive and connected is greater than ever before, potentially proliferating cyber security risk.

Advertisement


“Over the last several years, we’ve seen more businesses with the capacity for remote work, but the pandemic has obviously accelerated this,” said Robert Pizarro, vice president of commercial specialty at AmTrust Financial Services, Inc.

“With that, the need to share and exchange data between coworkers and vendors has never been greater. And that can create more opportunities for data compromise.”

Same Threats, New Risks

Most experts agree that the essential tenets of cyber security that existed before the pandemic hit remain unchanged. Threats such as ransomware and phishing, spoofing and social engineering schemes continue unabated. What has changed are the conditions of the workplace which now technologically, psychologically and physically render companies more vulnerable to attack.
For many companies, this is simply a new mode of operation, and with that comes more challenges, said Jacob Ingerslev, head of cyber risk at The Hartford.

“Businesses that had employees working remotely and a high degree of cloud adoption are not likely to have experienced much impact from the changes brought about by COVID, while those with a more traditional, office-based workforce and technology infrastructure might have been affected in a more serious way,” Ingerslev said.

As the working world has reinvented itself to respond to the pandemic, threat actors have evolved, too, seizing on public concerns about health and financial stability and turning them into keywords. As of August 2020, the Federal Trade Commission reported 175,000 coronavirus related incidents, with voice call phishing attacks on the rise.

Jason Glasgow, cyber lead, E&O division, Allied World.

“The pandemic hasn’t necessarily created new concerns, but it has exacerbated existing issues,” said Jason Glasgow, cyber lead, E&O division at Allied World.

“We’ve seen COVID-19-specific phishing attacks preying on people’s fears and these have been far more successful than other attacks. We’ve also seen an increase in ransomware frequency and severity.”

The work-from-home scenario is ripe for social engineering targets, not just because of a heightened common need for information, but also because employees tend to be more distracted with children, partners and other family and pets around. The change of setting and added stressors can turn even seasoned end users into easy targets for manipulation.

“It’s likely that distractions such as having to manage the challenges of working and parenting at the same time as well as the impact on mental health from the lockdown and the gravity of the COVID situation as a whole may lead employees to make mistakes they wouldn’t otherwise make,” said Ingerslev.

It’s not just that workers are newly remote, but also that new classes of data are being shared over potentially less secure networks, said Michael Convertino, CSO of Arceo.

“When everyone moves to mobile work that exposes new data to the same vulnerabilities. Companies are in a mad scramble to upgrade their systems and better secure them as CISOs recognize the weaknesses on home networks. For example, you may be using a company device on a network with a PC and a gaming system that can easily be hacked, allowing an adversary to hitch a ride into the corporate network.”

Hacking may not even be necessary if employees inadvertently expose sensitive data, by using consumer cloud storage like Dropbox or One Drive to share or save it with other employees.

“Often these accounts can be made public to anyone who has a link and that might include personally identifiable information or proprietary corporate information,” Pizarro said.

“And in a case like that it can be difficult to see who had access, which makes forensics more difficult should an incident occur.”

Asking the Right Questions

“By and large, the process of underwriting itself remains the same, even when conducted remotely,” said John Coletti, chief underwriting officer at AXA XL, but he has observed subtle differences in the past year.

Advertisement


“We miss meeting with our clients and brokers face-to-face. Human interaction provides intangibles such as body language that help us corroborate or question the underwriting information. Relationships are still extremely important,” Coletti said.

The specific questions insurers are asking focus on how insureds have addressed needed changes in cyber security infrastructure: how companies are safeguarding data assets remotely, how they are keeping the network up and running, and how they are ensuring business continuity.

“One of the questions insurers always ask in the underwriting process is whether there have been any changes to operations in the past year, and that goes without saying in the case of COVID-19,” said Elissa Doroff, managing director and cyber technical leader for NFP’s management and professional lines.

Exactly how workers log on to the company network is an important line of questioning. Many larger companies issue official laptops and devices, but smaller companies may not, and employees’ own devices must be properly secured. Depending on how computer systems are defined by a policy, BYOD (bring your own devices) may not be covered by cyber insurance. Are home wi-fi networks secured or are they using a VPN to log on?

“How are they logging on to the company servers? If they are doing it without VPN access, that adds another layer to the underwriting review,” Pizarro said.

Another concern might be the ability for networks to manage the increased load of a remote workforce including the added reliance on video meetings.

“In widespread work from home situations, security around access points and potential ransomware attacks are critical but organizations should monitor and ensure there is sufficient network capacity,” said Thomas Kang, head of cyber in North America at Allianz Global Corporate & Specialty.

“If everyone is online and highly dependent on the internet for their work, it can have a significant impact on business income loss when there is an outage. There are also bandwidth challenges when a high number of employees are video conferencing and companies should ensure that they do not compromise availability.”

In addition to hardware, software and network readiness, insureds will have to address legal and regulatory obligations in this new environment.

“There are key issues to keep in mind including what data their employees have access to and what industry they’re in,” Glasgow said.

“If they work in a law firm or in health care, they can’t access that data on a personal device, and it can’t be shown to or seen by family members, even if working from home.”

Responding to an Incident Remotely

When faced with a data breach or data loss incident, timing is always of the essence, yet employees who used to be in the office are now scattered geographically and potentially working at uncoordinated hours.

It’s paramount to have an incident response plan (IRP) that accounts for these new circumstances, including changed contact information for offsite employees or employees out sick and/or taking care of family members.

Advertisement


Insureds should also perform remote tabletop exercises to confirm that their IRPs are up to date and function as needed, and that the IRPs are themselves accessible at all times.

“What happens if the network goes down—you won’t be able to get on the company Zoom in that situation, so you should be able to contact everyone by phone,” Glasgow said.

“In widespread work from home situations, security around access points and potential ransomware attacks are critical but organizations should monitor and ensure there is sufficient network capacity.” —Thomas Kang, head of cyber in North America, Allianz Global Corporate & Specialty

“It can be more difficult to train on an incident response plan remotely, but these plans have always been critical in minimizing costs and business disruption, especially given the more complicated ransomware attacks we’ve been seeing lately.”

The good news is that much of the response work by vendors such as forensics services often happens remotely under normal circumstances. Still, Kang said, a decentralized workforce can complicate incident response if the team is unprepared to manage an event from a distance or able to ensure that appropriate personnel have on-site availability.

“We have seen some challenges when important IT or information security personnel are offsite and can’t get access to onsite capabilities, particularly given the tight timeframes required by many regulations and to ensure proper containment.”

Emerging Concerns

Even as insurers and insureds play the indemnity version of whack-a-mole to address the cyber security risks that have already been identified, new issues are coming to the fore.

One concern is how budget cuts from the pandemic and its financial aftermath might impact cyber security resources or even the amount of cyber security coverage companies are willing to pay for. But insurance should only be part of a comprehensive approach.

“It was important to know whether there were changes in the information security budget before all of this happened, but now we really need to know how dedicated companies are to cyber security from a holistic perspective,” Doroff said.

Advertisement


“It’s not just a matter of tacking on cyber insurance. If they’re laying off employees who are critical to the security function, it will have an impact on protection, on recovering from an incident, on business continuity.”

Insurers should be communicating about the current landscape of risk and why cyber security insurance remains essential. Insureds, for their part, should be aware of their policies and what is and isn’t covered.

Another issue looks ahead to when offices eventually reopen—how companies will collect health data and track it to protect their workforce. What are the legal and regulatory ramifications of keeping staff safe from outbreaks?

“Taking temperatures, collecting that data and performing contact tracing will raise many other concerns about privacy,” Glasgow said. “That’s something we are keeping an eye on.” &

Elisa Ludwig is a contract writer based outside Philadelphia. She has written extensively about cybersecurity issues for the Junto blog on the eRiskHub. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Scenario

The Betrayal of Elizabeth

In this Risk Scenario, Risk & Insurance explores what might happen in the event a telemedicine or similar home health visit violates a patient's privacy. What consequences await when a young girl's tele visit goes viral?
By: | October 12, 2020
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.

PART ONE: CRACKS IN THE FOUNDATION

Elizabeth Cunningham seemingly had it all. The daughter of two well-established professionals — her father was a personal injury attorney, her mother, also an attorney, had her own estate planning practice — she grew up in a house in Maryland horse country with lots of love and the financial security that can iron out at least some of life’s problems.

Tall, good-looking and talented, Elizabeth was moving through her junior year at the University of Pennsylvania in seemingly good order; check that, very good order, by all appearances.

Her pre-med grades were outstanding. Despite the heavy load of her course work, she’d even managed to place in the Penn Relays in the mile, in the spring of her sophomore season, in May of 2019.

But the winter of 2019/2020 brought challenges, challenges that festered below the surface, known only to her and a couple of close friends.

First came betrayal at the hands of her boyfriend, Tom, right around Thanksgiving. She saw a message pop up on his phone from Rebecca, a young woman she thought was their friend. As it turned out, Rebecca and Tom had been intimate together, and both seemed game to do it again.

Reeling, her holiday mood shattered and her relationship with Tom fractured, Elizabeth was beset by deep feelings of anxiety. As the winter gray became more dense and forbidding, the anxiety grew.

Fed up, she broke up with Tom just after Christmas. What looked like a promising start to 2020 now didn’t feel as joyous.

Right around the end of the year, she plucked a copy of her father’s New York Times from the table in his study. A budding physician, her eyes were drawn to a piece about an outbreak of a highly contagious virus in Wuhan, China.

“Sounds dreadful,” she said to herself.

Within three months, anxiety gnawed at Elizabeth daily as she sat cloistered in her family’s house in Bel Air, Maryland.

It didn’t help matters that her brother, Billy, a high school senior and a constant thorn in her side, was cloistered with her.

She felt like she was suffocating.

One night in early May, feeling shutdown and unable to bring herself to tell her parents about her true condition, Elizabeth reached out to her family physician for help.

Dr. Johnson had been Elizabeth’s doctor for a number of years and, being from a small town, Elizabeth had grown up and gone to school with Dr. Johnson’s son Evan. In fact, back in high school, Evan had asked Elizabeth out once. Not interested, Elizabeth had declined Evan’s advances and did not give this a second thought.

Dr. Johnson’s practice had recently been acquired by a Virginia-based hospital system, Medwell, so when Elizabeth called the office, she was first patched through to Medwell’s receptionist/scheduling service. Within 30 minutes, an online Telehealth consult had been arranged for her to speak directly with Dr. Johnson.

Due to the pandemic, Dr. Johnson called from the office in her home. The doctor was kind. She was practiced.

“So can you tell me what’s going on?” she said.

Elizabeth took a deep breath. She tried to fight what was happening. But she could not. Tears started streaming down her face.

“It’s just… It’s just…” she managed to stammer.

The doctor waited patiently. “It’s okay,” she said. “Just take your time.”

Elizabeth took a deep breath. “It’s like I can’t manage my own mind anymore. It’s nonstop. It won’t turn off…”

More tears streamed down her face.

Patiently, with compassion, the doctor walked Elizabeth through what she might be experiencing. The doctor recommended a follow-up with Medwell’s psychology department.

“Okay,” Elizabeth said, some semblance of relief passing through her.

Unbeknownst to Dr. Johnson, her office door had not been completely closed. During the telehealth call, Evan stopped by his mother’s office to ask her a question. Before knocking he overheard Elizabeth talking and decided to listen in.

PART TWO: BETRAYAL

As Elizabeth was finding the courage to open up to Dr. Johnson about her psychological condition, Evan was recording her with his smartphone through a crack in the doorway.

Spurred by who knows what — his attraction to her, his irritation at being rejected, the idleness of the COVID quarantine — it really didn’t matter. Evan posted his recording of Elizabeth to his Instagram feed.

#CantManageMyMind, #CrazyGirl, #HelpMeDoctorImBeautiful is just some of what followed.

Elizabeth and Evan were both well-liked and very well connected on social media. The posts, shares and reactions that followed Evan’s digital betrayal numbered in the hundreds. Each one of them a knife into the already troubled soul of Elizabeth Cunningham.

By noon of the following day, her well-connected father unleashed the dogs of war.

Rand Davis, the risk manager for the Medwell Health System, a 15-hospital health care company based in Alexandria, Virginia was just finishing lunch when he got a call from the company’s general counsel, Emily Vittorio.

“Yes?” Rand said. He and Emily were accustomed to being quick and blunt with each other. They didn’t have time for much else.

“I just picked up a notice of intent to sue from a personal injury attorney in Bel Air, Maryland. It seems his daughter was in a teleconference with one of our docs. She was experiencing anxiety, the daughter that is. The doctor’s son recorded the call and posted it to social media.”

“Great. Thanks, kid,” Rand said.

“His attorneys want to initiate a discovery dialogue on Monday,” Emily said.

It was Thursday. Rand’s dreams of slipping onto his fishing boat over the weekend evaporated, just like that. He closed his eyes and tilted his face up to the heavens.

Wasn’t it enough that he and the other members of the C-suite fought tooth and nail to keep thousands of people safe and treat them during the COVID-crisis?

He’d watched the explosion in the use of telemedicine with a mixture of awe and alarm. On the one hand, they were saving lives. On the other hand, they were opening themselves to exposures under the Health Insurance Portability and Accountability Act. He just knew it.

He and his colleagues tried to do the right thing. But what they were doing, overwhelmed as they were, was simply not enough.

PART THREE: FALLING DOMINOES

Within the space of two weeks, the torture suffered by Elizabeth Cunningham grew into a class action against Medwell.

In addition to the violation of her privacy, the investigation by Mr. Cunningham’s attorneys revealed the following:

Medwell’s telemedicine component, as needed and well-intended as it was, lacked a viable informed consent protocol.

The consultation with Elizabeth, and as it turned out, hundreds of additional patients in Maryland, Pennsylvania and West Virginia, violated telemedicine regulations in all three states.

Numerous practitioners in the system took part in teleconferences with patients in states in which they were not credentialed to provide that service.

Even if Evan hadn’t cracked open Dr. Johnson’s door and surreptitiously recorded her conversation with Elizabeth, the Medwell telehealth system was found to be insecure — yet another violation of HIPAA.

The amount sought in the class action was $100 million. In an era of social inflation, with jury awards that were once unthinkable becoming commonplace, Medwell was standing squarely in the crosshairs of a liability jury decision that was going to devour entire towers of its insurance program.

Adding another layer of certain pain to the equation was that the case would be heard in Baltimore, a jurisdiction where plaintiffs’ attorneys tended to dance out of courtrooms with millions in their pockets.

That fall, Rand sat with his broker on a call with a specialty insurer, talking about renewals of the group’s general liability, cyber and professional liability programs.

“Yeah, we were kind of hoping to keep the increases on all three at less than 25%,” the broker said breezily.

There was a long silence from the underwriters at the other end of the phone.

“To be honest, we’re borderline about being able to offer you any cover at all,” one of the lead underwriters said.

Rand just sat silently and waited for another shoe to drop.

“Well, what can you do?” the broker said, with hope draining from his voice.

The conversation that followed would propel Rand and his broker on the difficult, next to impossible path of trying to find coverage, with general liability underwriters in full retreat, professional liability underwriters looking for double digit increases and cyber underwriters asking very pointed questions about the health system’s risk management.

Elizabeth, a strong young woman with a good support network, would eventually recover from the damage done to her.

Medwell’s relationships with the insurance markets looked like it almost never would. &

Bar-Lessons-Learned---Partner's-Content-V1b

Risk & Insurance® partnered with Allied World to produce this scenario. Below are Allied World’s recommendations on how to prevent the losses presented in the scenario. This perspective is not an editorial opinion of Risk & Insurance.®.

The use of telehealth has exponentially accelerated with the advent of COVID-19. Few health care providers were prepared for this shift. Health care organizations should confirm that Telehealth coverage is included in their Medical Professional, General Liability and Cyber policies, and to what extent. Concerns around Telehealth focus on HIPAA compliance and the internal policies in place to meet the federal and state standards and best practices for privacy and quality care. As states open businesses and the crisis abates, will pre-COVID-19 telehealth policies and regulations once again be enforced?

Risk Management Considerations:

The same ethical and standard of care issues around caring for patients face-to-face in an office apply in telehealth settings:

  • maintain a strong patient-physician relationship;
  • protect patient privacy; and
  • seek the best possible outcome.

Telehealth can create challenges around “informed consent.” It is critical to inform patients of the potential benefits and risks of telehealth (including privacy and security), ensure the use of HIPAA compliant platforms and make sure there is a good level of understanding of the scope of telehealth. Providers must be aware of the regulatory and licensure requirements in the state where the patient is located, as well as those of the state in which they are licensed.

A professional and private environment should be maintained for patient privacy and confidentiality. Best practices must be in place and followed. Medical professionals who engage in telehealth should be fully trained in operating the technology. Patients must also be instructed in its use and provided instructions on what to do if there are technical difficulties.

This case study is for illustrative purposes only and is not intended to be a summary of, and does not in any way vary, the actual coverage available to a policyholder under any insurance policy. Actual coverage for specific claims will be determined by the actual policy language and will be based on the specific facts and circumstances of the claim. Consult your insurance advisors or legal counsel for guidance on your organization’s policies and coverage matters and other issues specific to your organization.

This information is provided as a general overview for agents and brokers. Coverage will be underwritten by an insurance subsidiary of Allied World Assurance Company Holdings, Ltd, a Fairfax company (“Allied World”). Such subsidiaries currently carry an A.M. Best rating of “A” (Excellent), a Moody’s rating of “A3” (Good) and a Standard & Poor’s rating of “A-” (Strong), as applicable. Coverage is offered only through licensed agents and brokers. Actual coverage may vary and is subject to policy language as issued. Coverage may not be available in all jurisdictions. Risk management services are provided or arranged through AWAC Services Company, a member company of Allied World. © 2020 Allied World Assurance Company Holdings, Ltd. All rights reserved.




Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]