1. E&O Risk Management: Meeting the Challenge of Change
Limiting Exposures to Data Breaches

2. INTRODUCTION
Insurance agents collect, use, and store personally identifiable information on a daily basis
Agents face exposure to both regulatory penalties and potential first and third party liability for breaches of data.
Liability from cyber-attacks is on the rise and the media is constantly reporting on companies being hacked, exposing protected personal information.
Additional information can be found on the VU web site and the Legal Advocacy area of the main Big I web site.
Limiting Exposures to Data Breaches

3. INTRODUCTION Risks include physical risks, such as:
Discarding protected personal information without it being properly shredded
Computers, fax machines and printers being discarded without thoroughly removing stored personal information;
Physical agency break-ins where the entire agency server is stolen.
Additional information can be found on the VU web site and the Legal Advocacy area of the main Big I web site.
Limiting Exposures to Data Breaches

4. INTRODUCTION
Perhaps the largest security risk arises from employee mistakes that often result from the failure to properly train them on agency procedures to protect the privacy of protected personal information.
Additional information can be found on the VU web site and the Legal Advocacy area of the main Big I web site.
Limiting Exposures to Data Breaches

5. GOOD BUSINESS & THE LAW
Agencies have an obligation to secure protected personal information whether it is in electronic or paper form and to dispose of it appropriately
Additional information can be found on the VU web site and the Legal Advocacy area of the main Big I web site.
Limiting Exposures to Data Breaches

6. Data Breach Exposures Legal Responsibilities
Fair Credit Reporting Act (FCRA)
Gramm-Leach-Bliley Act (GLBA)
Health Insurance Portability and Accountability Act (HIPAA)
Various state laws (at least 29 states) require reporting of security breaches…“Security Breach Notification Chart”:
These laws effectively require agencies to implement security plans, conduct training, and do security audits
Additional information can be found on the VU web site and the Legal Advocacy area of the main Big I web site.
Limiting Exposures to Data Breaches

7. Data Breach Exposures Data Breach Costs
Average cost estimated to be $214 per record, or about $250K for the average agency
Direct Costs
Cost to handle breach…legal fees, consultants, implementing new technology and training
Cost to notify and remediate affected parties
Indirect Costs
Loss of trust of customers
Damage to reputation in the community
Cost to notify and remediate affected parties
Nashville Election Commission laptops stolen in burglary and the cost was $1 million to notify registered voters and pay for identity theft protection for them
Limiting Exposures to Data Breaches

8. Data Breach Exposures Identify Data at Risk
Paper files in cabinets and on desks in premises
Archived files (paper and electronic) outside premises
Computer hard drives, laptops, cell phones, CDs, USB drives, agency management system providers, carriers, call centers, etc.
Limiting Exposures to Data Breaches

9. Data Breach Exposures Identify Physical Threats
Majority of breaches occur from stolen or lost devices
Secure the building, server room, and file cabinets
Screen cleaning crews
Immediately prevent access to data when employees leave
Practice sound password security
Limit personal information on mobile devices
Limiting Exposures to Data Breaches

10. Data Breach Exposures Identify Virtual Threats
Firewall
Secure WiFi connections
Virus and malware protection
Secure data backups and archived files
Connect remotely via SSL/VPN connections
Use secure SSL connections (https) to collect data
Secure with Transport Layer Security (TLS)
Limiting Exposures to Data Breaches

11. LIMIT YOUR RISK
Only keep the data you need and for only the length of time that you need it
Have written guidelines and training regarding employee use of all protected consumer information
Have written mandatory procedures in place for the proper disposal of sensitive information.
 Physical damage to host computer equipment and network equipment
 Breaches of security by employees, former employees or contract professionals
 Breaches of security by outsiders (hackers)
 Destruction of information technology assets by employees, former employees or contract employees
 Destruction of information technology assets by outsiders (hackers)
 Disruption of computer networks due to computer viruses, e.g., Melissa virus
 Destruction of credit card or other credit information from customers leading to lost sales
 Credit injury to customers whose credit card numbers may be misused by unauthorized parties
 Lost revenues due to technological disruption (including telephone, data or internet service disruption on or off premises), particularly for time-sensitive industries like on-line brokerage firms
 Lost advertising revenues due to website disruption
 Disruption of eCommerce due to "smurf" or "spam" attacks or incidents
 Lost new customers due to various forms of disruption (given Internet firm valuations based on number of customers, this can have a severe impact on valuations)
 Non-repudiation for various forms of disruption of time-sensitive E-Commerce
 Theft of intellectual property, trade secrets and other confidential information on company networks
 Cost of litigating against those who have infringed on company intellectual property
 Cost to restore damaged websites or networks
 Cost to repair or upgrade security systems/firewalls in the aftermath of a breach of security
 Extra expenses arising out of disruptions to Intranets and Extranets
Limiting Exposures to Data Breaches