1. Forensic and Investigative Accounting Chapter 16 Cybercrime Loss Valuations © 2013 CCH Incorporated. All Rights Reserved. 4025 W. Peterson Ave. Chicago, IL 60646-6085 800 248 3248 CCHGroup.com

2. Chapter 16Forensic and Investigative Accounting2 Reasons to Quantify Loss To report the crime to law enforcement. To report the crime to law enforcement. To recover damages under an insurance policy. To recover damages under an insurance policy. To record for internal purposes. To record for internal purposes.

3. Crime Survey The 2010 CSI Computer Crime and Security Survey based on 351 returned surveys determined that: 67.1 percent of respondents experienced malware infection compared to 2009’s 64.3 percent 16.8 percent experienced denial-of-service attacks, compared to 2009s 29.2 percent ; 11.4 percent experienced password sniffing, compared to 17.3 percent in 2009. ChapterForensic and Investigative Accounting3

4. Chapter 16Forensic and Investigative Accounting4 State Statutes Describing Losses The following factors are shown as remediable activities and loss classifications: –Verification costs to check systems (diagnosis–remediation). –Restoration costs to put systems back online (testing). –Market value or replacement value of the property destroyed or services. (continued on next slide)

5. Chapter 16Forensic and Investigative Accounting5 State Statutes Describing Losses –Lost profits. –Reasonable value of loss caused by “unavailability.” –Investigation costs. –Past or future losses. –Injury suffered. –Loss of computer time (lost productivity). –Cost of replacing lost data.

6. Chapter 16Forensic and Investigative Accounting6 Federal Identification of Damage Losses The federal government identifies the following damage losses in cyber attacks: –Responding to an attack. –Costs of making a damage assessment. –Time and costs of restoring the system. –Loss of revenues from the interruption. –“Other damages” related to an interruption of service.

7. Securities and Exchange Commission In October 2011, the Securities and Exchange Commission has issued a recommendation that potential attacks from cyber criminals need to be disclosed in financial statement footnotes. Chapter 16Forensic and Investigative Accounting7

8. Chapter 16Forensic and Investigative Accounting8 Examples of Tangible Losses Market value or replacement cost of property destroyed in attack. Market value or replacement cost of property destroyed in attack. External investigation costs. External investigation costs. Lost worker productivity. Lost worker productivity. Cost of replacing lost data. Cost of replacing lost data.

9. Chapter 16Forensic and Investigative Accounting9 Productivity Losses Productivity losses arise from the reduction of efficient, “normal” production of work due to an event such as a cyber attack.

10. Chapter 16Forensic and Investigative Accounting10 Examples of Intangible Losses Unavailability of a website. Unavailability of a website. Lost profits. Lost profits. General injury. General injury. Destroyed or lost information contained on compromised PCs. Destroyed or lost information contained on compromised PCs. Loss of optioned opportunities. Loss of optioned opportunities.

11. Chapter 16Forensic and Investigative Accounting11 Costs and Types of Insurance Coverage First-party liability coverage is for direct damage to the insured from a cyber attack. First-party liability coverage is for direct damage to the insured from a cyber attack. Third-party liability provides coverage from the negligent acts of the insured as, for example, when the insured’s computers are unknowingly used to launch an attack against a primary target. Third-party liability provides coverage from the negligent acts of the insured as, for example, when the insured’s computers are unknowingly used to launch an attack against a primary target. Premiums for these policies can cost $20,000 to $40,000 annually for coverage up to $50 million each. Premiums for these policies can cost $20,000 to $40,000 annually for coverage up to $50 million each.

12. Chapter 16Forensic and Investigative Accounting12 First-Party Cyber Insurance First-party cyber insurance usually includes coverage of losses from: –Malicious destruction or alteration of information. –Theft of data such as credit card numbers. –Lost business income up to 12 months after the attack. –Extortion from threats such as introducing viruses into a network. (continued on next slide)

13. Chapter 16Forensic and Investigative Accounting13 First-Party Cyber Insurance –Introducing fraudulent information into a network. –Defamation. –Cost to repair and replace data. –Unintentional virus transmission. –Denial of service attacks. –IP infringement from website squatters. –Illegitimate use of network. –Defacement of a website and related losses. (continued on next slide)

14. Chapter 16Forensic and Investigative Accounting14 First-Party Cyber Insurance –Coverage of extra expense incurred during a disruption. –External consultant fees. –Intellectual property infringement from the disclosure of trade secrets. –Rehabilitation expenses to reestablish the insured’s reputation and market share. –Crisis communication expenses with clients to provide assurances the system is reliable and safe.

15. Chapter 16Forensic and Investigative Accounting15 Seeking Insurance Coverage Qualifying for coverage Qualifying for coverage –Risk survey –Security audit What insureds should know about coverage What insureds should know about coverage –Third-party lawsuits –Intangible losses

16. Risk Evaluation and Coverage A risk evaluation determines how much a company should be charged for cyber insurance. For example, extensive and proper use of encryption and an updated and properly patched operating system would have the effect of reducing the cost of a policy. Chapter 16Forensic and Investigative Accounting16