1. Cyber Insurance presentation for: The 2nd Anti Cybercrime Forum Beirut, 29th November 2016 Alexander Blom, Head of Financial Lines, AIG MENA

2. Threat Actors
Criminals
Spies
Hacktivists
Insiders
Military
Terrorists

3. Cyber Risk in the Financial Services Sector
Theft or Loss of Data
Personal data, business data, any data with black-market value is at risk
Motive: financial or competitive gain
Data Destruction
Wiping or scrambling electronic data
Motive: ideological, extortion, terrorism, or war
Communication Disruptions
Website or network disruption; website defacement; social media takeover
Theft of Monies, Securities, Funds, etc.
Beyond the theft of data: money and securities are a high value target both physically and electronically
Motive: financial

4. Financial Institutions Cyber Risk
Sensitivity of Data
Headline Risk &
High Value Targets
Regulatory Oversight
Financial data is a special class much like medical data
Financial data is both inherently valuable and useful for facilitating other threat vectors
Both consumer and commercial customers have sensitive data
Financial data has monetary value both on the black market and intrinsically
Financial institutions are often considered critical infrastructure and systemically important
Money and securities are a high value target both physically and electronically
Reputation is extremely important and a high value / high impact target
Attacks against financial institutions make great headlines
Financial institutions are one of the most regulated industries
The combination of increasing data privacy regulatory scrutiny and financial regulatory oversight creates increased challenges to firms
Cost of regulatory compliance in addition to cyber security and operations spend

5. End-to-End Risk Management Approach
Prevention
Insurance Coverage
Breach Resolution Team
Education via CyberEdge®, RiskTool, and eRisk Hub
Third-Party Loss Resulting From a Security or Data Breach
24/7 Breach Support
Compliance via RiskTool
Direct First-Party Costs of Responding to a Breach
Legal and Forensics Services
Assessment via K2 Intelligence, Bitsight, IBM, Axio, and RSA Security
Lost Income and Operating Expense Resulting From a Security or Data Breach
Notification, Credit, and ID Monitoring Call Center
Protection via RiskAnalytics Shunning Tool
Threats to Disclose Data or Attack a System to Extort Money
Crisis Communication Experts
Consultation by KPMG
Online Defamation and Copyright and Trademark Infringement
Over 15 Years’ Experience Handling Cyber-Related Claims

6. (To Your Organization)
Cyber Loss Spectrum
Losses due to cyber events (data breaches, destructive attacks, and other unauthorized access or use of your computer systems) can be categorized into these four quadrants:
1st Party Damages
(To Your Organization)
3rd Party Damages
(To Others)
Financial
Damages
Tangible (Monetary)
Damages

7. Financial / 1st Party Damages
Cyber Loss Spectrum
Response costs: forensics, credit monitoring, notifications, crisis management, public relations
Legal expense: advice and defense
Revenue losses from network or computer outages, including cloud
Cost of restoring lost data
Cyber extortion expenses
3rd Party
Tangible (Monetary)

8. (To Your Organization) (To Your Organization)
Financial / 1st Party Damages
Available Insurance
AIG offers this coverage as a part of CyberEdge, in the Event Management, Network Interruption, and Cyber Extortion coverage sections.
1st Party Damages
(To Your Organization)
3rd Party Damages
(To Others)
Response costs: forensics, credit monitoring, notifications, crisis management, public relations
Legal expense: advice and defense
Revenue losses from network or computer outages, including cloud
Cost of restoring lost data
Cyber extortion expenses
1st Party Damages
(To Your Organization)

9. Financial / 3rd Party Damages
Cyber Loss Spectrum
3rd party entities may seek to recover:
Consequential revenue losses
Restoration expenses
Legal expenses
Their credit monitoring costs
Value of their intellectual property stolen from you
3rd party entities may issue or be awarded civil fines and penalties.
1st Party
Tangible (Monetary)

10. (To Your Organization) (To Your Organization)
Financial / 3rd Party Damages
Available Insurance
3rd party entities may seek to recover:
Consequential revenue losses
Restoration expenses
Legal expenses
Their credit monitoring costs
Value of their intellectual property stolen from you
3rd party entities may issue or be awarded civil fines and penalties.
AIG offers this coverage as a part of CyberEdge, in the Security and Privacy Liability coverage section.
1st Party Damages
(To Your Organization)
3rd Party Damages
(To Others)
1st Party Damages
(To Your Organization)
1st Party
Tangible (Monetary)

11. Tangible (Monetary) / 1st Party Damages
Cyber Loss Spectrum
3rd Party
Financial
Theft of Funds of your monies, securities, funds, etc.
Destruction or damage to your facilities or other property
Reputational Harm to your operation (valuation)
Lost revenues from physical damage or reputational harm
Your Intellectual Property compromise, both value and use

12. Tangible (Monetary) / 1st Party Damages
Available Insurance
3rd Party
Financial
Property policies and fidelity/crime policies may cover these cyber-peril losses.
Potential pitfalls:
Silence
Cyber exclusions
Other applicable exclusions (data, terrorism, etc.)
Theft of Funds of your monies, securities, funds, etc.
Destruction or damage to your facilities or other property
Reputational Harm to your operation (valuation)
Lost revenues from physical damage or reputational harm
Your Intellectual Property compromise, both value and use
(Traditional) cyber policies typically exclude bodily injury (BI), property damage (PD), Theft of Funds and Intellectual Property & Reputation value loss

13. Tangible (Monetary) / 3rd Party Damages
Cyber Loss Spectrum
1st Party
Financial
Mechanical breakdown of others’ equipment
Destruction or damage to others’ facilities or property
Theft of Funds of customers, in your custody
Lost revenues from physical damage
Bodily injury to others

14. Tangible (Monetary) / 3rd Party Damages
Available Insurance
1st Party
Financial
Mechanical breakdown of others’ equipment
Destruction or damage to others’ facilities or property
Theft of Funds of customers, in your custody
Lost revenues from physical damage
Bodily injury to others
Other policies may cover these cyber losses; subject to the same potential issues as Property.
(Traditional) cyber policies typically exclude bodily injury (BI) and property damage (PD)

15. Addressing Financial Institutions Cyber Loss
Insurance market needs:
A better understanding of the risks, threats and vulnerabilities faced by the financial services sector so that insurance can provide more comprehensive solutions
Further exploration of “cyber as a peril” and how many policies can be impacted (E&O, EPL, Fidelity, D&O, etc.)
Financial
Tangible (Monetary)
3rd Party
1st Party
Financial Institutions’ needs:
Clarifications in cyber insurance policies, cyber coverages and additional cyber risk mitigation services
Continually developing insurance offering customized to financial institutions’ needs

16. Pricing and Underwriting Considerations
Factor
Considerations
Industry/Revenue
What industry does the insured belong to? What is the insured’s annual revenue?
Claims History
How many claims are made annually on average? What is the largest claim payment experienced by the insured?
Type of Data
What type of data and information is processed, stored, and maintained? How hard is the data to replace or recreate?
IT Controls
Are all technology platforms updated regularly with their respective security patches?
Does the organization enforce encryption controls for all sensitive data at rest and transit?
Regulatory Compliance
Is the applicant compliant with applicable regulations (PCI, HIPAA, etc.)?
Governance
Does the applicant have formal information security and privacy policies in place?
Outsource Vendors
What is the applicant’s due diligence process prior to engaging a new vendor? Do contracts with vendors contain an indemnification provision?
Internal Threat
Does the applicant require all computer users to undergo security awareness training program?

17. Contact Information
Alexander Blom
Head of Financial Lines, MENA
AIG MEA Limited, Dubai
Aisling Malone
Professional Indemnity & Cyber Lead, MENA
AIG MEA Limited, Dubai

18. American International Group, Inc
American International Group, Inc. (AIG) is a leading international insurance organization serving customers in more than 130 countries.. AIG companies serve commercial, institutional, and individual customers through one of the most extensive worldwide property-casualty networks of any insurer. In addition, AIG companies are leading providers of life insurance and retirement services in the United States. AIG common stock is listed on the New York Stock Exchange and the Tokyo Stock Exchange.
Additional information about AIG can be found at | YouTube: | | LinkedIn:
AIG is the marketing name for the worldwide property-casualty, life and retirement, and general insurance operations of American International Group, Inc. For additional information, please visit our website at All products and services are written or provided by subsidiaries or affiliates of American International Group, Inc. Products or services may not be available in all countries, and coverage is subject to actual policy language. Non-insurance products and services may be provided by independent third parties. Certain property-casualty coverages may be provided by a surplus lines insurer. Surplus lines insurers do not generally participate in state guaranty funds, and insureds are therefore not protected by such funds.