Gowlings - November 12, 2014
In an ever-increasing digital world, all businesses face challenges in managing and protecting sensitive and confidential information. In this presentation Gowlings and Marsh Canada Limited addressed best practices for responding to a cyber breach, and what types of insurance may be available to respond to such a loss. Topics included:
• Trends, and the evolution of cyber insurance/products
• The D&O connection, cyber is a strategic business risk
• Risk Management Strategies
• Best Practices in Breach Response.
This presentation examines to what extent that cyber-insurance can be a useful tool to manage the risks and harms caused by massive cyber-attacks from the national as opposed to enterprise standpoint,
Managing and insuring cyber risk - coverage of insurance policiesIISPEastMids
Tim Johnson, a Cyber Insurance specialist from Browne Jacobson, looks in detail at what Cyber Insurance will cover businesses for and gave some tips on what to consider when deciding on a policy. Given as part of the East Midlands Cyber Security Forum on 21st May. More details at https://www.nexor.com/iisp-east-midlands/may-2015.
Cyber Liability - Insurance Risk Management and PreparationEric Reehl
See how Adaptive Solutions is delivering leading cyber risk management solutions through its strategic alliance with Willis Towers Watson and Darklight Technologies.
Basics of insurance coverage and evolving issues surrounding cyber, data breaches, and a big picture overview of how it impacts businesses and the lawyers advising them.
This presentation examines to what extent that cyber-insurance can be a useful tool to manage the risks and harms caused by massive cyber-attacks from the national as opposed to enterprise standpoint,
Managing and insuring cyber risk - coverage of insurance policiesIISPEastMids
Tim Johnson, a Cyber Insurance specialist from Browne Jacobson, looks in detail at what Cyber Insurance will cover businesses for and gave some tips on what to consider when deciding on a policy. Given as part of the East Midlands Cyber Security Forum on 21st May. More details at https://www.nexor.com/iisp-east-midlands/may-2015.
Cyber Liability - Insurance Risk Management and PreparationEric Reehl
See how Adaptive Solutions is delivering leading cyber risk management solutions through its strategic alliance with Willis Towers Watson and Darklight Technologies.
Basics of insurance coverage and evolving issues surrounding cyber, data breaches, and a big picture overview of how it impacts businesses and the lawyers advising them.
Hacking the Human - How Secure Is Your Organization?CBIZ, Inc.
This presentation covers:
Social Engineering
Targets, Costs, Frequency
Real Life Examples
Mitigating Risks
Internal Programs
Data Security & Privacy Liability
Cyber Liability
Cyber Insurance
Financial Impact
Key Coverage Components
Checklist for Assessing your Level of Cyber Risk
Cyber crimes are growing rapidly and cyber liability insurance is the safest way for companies to stay harmless. Information security is expected by all the customers and loss of these information could cost a company loyal customers and financial crisis.
“Cyber Liability & Cyber Insurance” - A discussion on best practices around Prevention, Detection, and Response!
Sponsored by Datto and Webster Bank
Series brought to you by the Connecticut Technology Council.
____________
TOPIC FOCUS:
1. Evolution and acceptance of Cybersecurity insurance
a. Understanding risk & effect on businesses
i. Used to be major brands, now widespread.
ii. Risk recognized, business leaders looking to minimize risk
b. Describing changes in cybersecurity insurance
How coverages have evolved - not just for biggest companies
i. Insurers are working with (tech) companies to get it right
ii. Where is it going from here? Trends, specialty insurance
2. Describe insurance types/ specifics and how they perform when needed
. Not all policies are the same
a. What to look for
b. How they vary by type of business (Healthcare vs. Retail vs. Software Co.)
c. What gaps still remain (What can’t get covered?)
3. How to minimize cost, get most value for your company
. Some protections on your current policies
a. Gating elements - What the insurance companies want to see - how that might help costs
4. Best practices generally
All product and company names mentioned herein are for identification and educational purposes only and are the property of, and may be trademarks of, their respective owners.
The trends continue to point upward for data incidents and 2013 is becoming a pace setter. The shifting regulatory landscape promises to add further complications for companies struggling to prepare for and respond to data privacy incidents.
This webinar will feature two leading data breach experts who have performed a two year trend analysis across hundreds of cases to offer a powerful and up-to-date perspective on what has happened and their predictions for the future. It will also cover how these factors are shaping regulations which are in turn influencing decision-making in the C-Suite.
Our featured speakers for this timely webinar will be:
-Bill Hardin, Director of Data Privacy Response & Investigations, Navigant
-Jennifer Coughlin, Privacy and Data Security Attorney, Nelson, Levine
-Gant Redmon, Esq. General Counsel and VP of Business Development, Co3 Systems
Crossing the streams: How security professionals can leverage the NZ Privacy ...Chris Hails
Security professionals often struggle with the ‘double intangibility’ of security - the intangibility of risk and intangibility of protection.
Changes hearts and minds often requires legislation and new compliance frameworks to motivate investment.
New Zealand's new Privacy Act comes into play on 1st December 2020 and there are ways security professionals can leverage new aspects including mandatory breach notifications to focus efforts on securing personal information and preventing privacy harms.
Think You’re Covered? Think Again. Cybersecurity, Data Privacy, Payments Frau...Withum
In the last year, hacker techniques have become even more sophisticated and every business’ threat landscape has widened making companies increasingly vulnerable to cyberattacks and breaches. The average cost of a data breach today in the United States is ~$8.19 Million. Ransomware attacks occur every 11 seconds. Cybercriminals are ready – exploiting employees working from home and companies operating on unsecured networks.
Withum cybersecurity expert Matthew Ferrante and Eric Jackson discussed how organizations can successfully reduce the likelihood of compliance failures and mitigate the impact of cybersecurity incidents. They were joined by Capital One Commercial Bank Treasury Management Lead Stephen Susnak, who discussed how to build more effective defenses against payments fraud.
How to handle data breach incidents under GDPRCharlie Pownall
A presentation to senior UK public sector insurance and risk management executives on data breach response communications challenges and best practices
New York Department of Financial Services Cybersecurity RegulationsShawn Tuma
Getting in Shape – NYDFS Cyber Security Regulations Webinar
Presenters: Shawn Tuma, Cybersecurity & Data Protection Attorney, Scheef & Stone LLP | Bill Belcher, VP Americas, Boldon James In an initiative to protect New York’s financial services industry, a new State regulation has been introduced to protect consumers and financial institutions from cyber-attacks. Effective March 1, 2017, this risk-driven regulation requires all financial services institutions regulated by the Department of Financial Services (DFS) to establish and maintain a cyber security program that will protect both customers’ private data and the technology that supports this. The impact stretches down through the supply chain, as any organization that conducts business with the NYC financial services sector has to adopt the same level of data protection.
Watch this webcast to learn:
The key requirements of the NYC Cyber security regulation
How compliance is about process first, then people and technology
What organizations need to be doing to ensure they comply
How data classification can help ensure compliance
NYDFS Cybersecurity Regulations (23 NYCRR 500) New York is one of the biggest financial hubs in the world; as you can imagine where there is sensitive financial information, there are people who want to get their hands on it. It is for this reason major financial firms operating in New York will face stiff cyber security obligations under the new New York Department of Financial Services Cybersecurity Regulations (23 NYCRR 500). This regulation will apply to firms holding a banking, insurance or financial services licence to operate in New York. 23 NYCRR 500 has been effective as of March 1st 2017, although firms have 180 days from this introduction date to change internal systems in order to meet new compliance and regulation standards. This fact sheet outlines:
23 NYCRR 500 overview
Key dates for covered entities
Key tasks for compliance
How Boldon James can help
Please complete the adjoining form to request it.
From the largest to the smallest company, the inescapable truth is that with the click of a few keys or even a simple phone call, intruders can bypass all of your carefully constructed security. According to the Ponemon Institute's 2015 Cost of Data Breach Study, the average total cost of a data breach increased from $3.52 million to $3.79 million in 2014.
While a number of major data breaches have made the news, often overlooked are the events and decisions that set the stage for the breach to occur. In this hour-long webinar, Global Knowledge instructor Phill Shade will walk through a number of key areas in which today's decisions set the stage for tomorrow's breach.
Hacking the Human - How Secure Is Your Organization?CBIZ, Inc.
This presentation covers:
Social Engineering
Targets, Costs, Frequency
Real Life Examples
Mitigating Risks
Internal Programs
Data Security & Privacy Liability
Cyber Liability
Cyber Insurance
Financial Impact
Key Coverage Components
Checklist for Assessing your Level of Cyber Risk
Cyber crimes are growing rapidly and cyber liability insurance is the safest way for companies to stay harmless. Information security is expected by all the customers and loss of these information could cost a company loyal customers and financial crisis.
“Cyber Liability & Cyber Insurance” - A discussion on best practices around Prevention, Detection, and Response!
Sponsored by Datto and Webster Bank
Series brought to you by the Connecticut Technology Council.
____________
TOPIC FOCUS:
1. Evolution and acceptance of Cybersecurity insurance
a. Understanding risk & effect on businesses
i. Used to be major brands, now widespread.
ii. Risk recognized, business leaders looking to minimize risk
b. Describing changes in cybersecurity insurance
How coverages have evolved - not just for biggest companies
i. Insurers are working with (tech) companies to get it right
ii. Where is it going from here? Trends, specialty insurance
2. Describe insurance types/ specifics and how they perform when needed
. Not all policies are the same
a. What to look for
b. How they vary by type of business (Healthcare vs. Retail vs. Software Co.)
c. What gaps still remain (What can’t get covered?)
3. How to minimize cost, get most value for your company
. Some protections on your current policies
a. Gating elements - What the insurance companies want to see - how that might help costs
4. Best practices generally
All product and company names mentioned herein are for identification and educational purposes only and are the property of, and may be trademarks of, their respective owners.
The trends continue to point upward for data incidents and 2013 is becoming a pace setter. The shifting regulatory landscape promises to add further complications for companies struggling to prepare for and respond to data privacy incidents.
This webinar will feature two leading data breach experts who have performed a two year trend analysis across hundreds of cases to offer a powerful and up-to-date perspective on what has happened and their predictions for the future. It will also cover how these factors are shaping regulations which are in turn influencing decision-making in the C-Suite.
Our featured speakers for this timely webinar will be:
-Bill Hardin, Director of Data Privacy Response & Investigations, Navigant
-Jennifer Coughlin, Privacy and Data Security Attorney, Nelson, Levine
-Gant Redmon, Esq. General Counsel and VP of Business Development, Co3 Systems
Crossing the streams: How security professionals can leverage the NZ Privacy ...Chris Hails
Security professionals often struggle with the ‘double intangibility’ of security - the intangibility of risk and intangibility of protection.
Changes hearts and minds often requires legislation and new compliance frameworks to motivate investment.
New Zealand's new Privacy Act comes into play on 1st December 2020 and there are ways security professionals can leverage new aspects including mandatory breach notifications to focus efforts on securing personal information and preventing privacy harms.
Think You’re Covered? Think Again. Cybersecurity, Data Privacy, Payments Frau...Withum
In the last year, hacker techniques have become even more sophisticated and every business’ threat landscape has widened making companies increasingly vulnerable to cyberattacks and breaches. The average cost of a data breach today in the United States is ~$8.19 Million. Ransomware attacks occur every 11 seconds. Cybercriminals are ready – exploiting employees working from home and companies operating on unsecured networks.
Withum cybersecurity expert Matthew Ferrante and Eric Jackson discussed how organizations can successfully reduce the likelihood of compliance failures and mitigate the impact of cybersecurity incidents. They were joined by Capital One Commercial Bank Treasury Management Lead Stephen Susnak, who discussed how to build more effective defenses against payments fraud.
How to handle data breach incidents under GDPRCharlie Pownall
A presentation to senior UK public sector insurance and risk management executives on data breach response communications challenges and best practices
New York Department of Financial Services Cybersecurity RegulationsShawn Tuma
Getting in Shape – NYDFS Cyber Security Regulations Webinar
Presenters: Shawn Tuma, Cybersecurity & Data Protection Attorney, Scheef & Stone LLP | Bill Belcher, VP Americas, Boldon James In an initiative to protect New York’s financial services industry, a new State regulation has been introduced to protect consumers and financial institutions from cyber-attacks. Effective March 1, 2017, this risk-driven regulation requires all financial services institutions regulated by the Department of Financial Services (DFS) to establish and maintain a cyber security program that will protect both customers’ private data and the technology that supports this. The impact stretches down through the supply chain, as any organization that conducts business with the NYC financial services sector has to adopt the same level of data protection.
Watch this webcast to learn:
The key requirements of the NYC Cyber security regulation
How compliance is about process first, then people and technology
What organizations need to be doing to ensure they comply
How data classification can help ensure compliance
NYDFS Cybersecurity Regulations (23 NYCRR 500) New York is one of the biggest financial hubs in the world; as you can imagine where there is sensitive financial information, there are people who want to get their hands on it. It is for this reason major financial firms operating in New York will face stiff cyber security obligations under the new New York Department of Financial Services Cybersecurity Regulations (23 NYCRR 500). This regulation will apply to firms holding a banking, insurance or financial services licence to operate in New York. 23 NYCRR 500 has been effective as of March 1st 2017, although firms have 180 days from this introduction date to change internal systems in order to meet new compliance and regulation standards. This fact sheet outlines:
23 NYCRR 500 overview
Key dates for covered entities
Key tasks for compliance
How Boldon James can help
Please complete the adjoining form to request it.
From the largest to the smallest company, the inescapable truth is that with the click of a few keys or even a simple phone call, intruders can bypass all of your carefully constructed security. According to the Ponemon Institute's 2015 Cost of Data Breach Study, the average total cost of a data breach increased from $3.52 million to $3.79 million in 2014.
While a number of major data breaches have made the news, often overlooked are the events and decisions that set the stage for the breach to occur. In this hour-long webinar, Global Knowledge instructor Phill Shade will walk through a number of key areas in which today's decisions set the stage for tomorrow's breach.
Secrets to managing your Duty of Care in an ever- changing world.
How well do you know your risks?
Are you keeping up with your responsibilities to provide Duty of Care?
How well are you prioritising Cybersecurity initiatives?
Liability for Cybersecurity attacks sits with Executives and Board members who may not have the right level of technical security knowledge. This session will outline what practical steps executives can take to implement a Cybersecurity Roadmap that is aligned with its strategic objectives.
Led by Krist Davood, who has spent over 28 years implementing secure mission critical systems for executives. Krist is an expert in protecting the interconnectedness of technology, intellectual property and information systems, as evidenced through his roles at The Good Guys, Court Services Victoria and Schiavello.
The seminar will cover:
• Fiduciary responsibility
• How to efficiently deal with personal liability and the threat of court action
• The role of a Cybersecurity Executive Dashboard and its ability to simplify risk and amplify informed decision making
• How to identify and bridge the gap between your Cybersecurity Compliance Rating and the threat of court action
How'd we do in 2013 from a data breach perspective? As we close out the year, are the cupboards / budgets bare and will it be a lean holiday season? Or should we be budgeting a holiday celebration with all of the trappings and a sumptuous New Year?
Borrowing themes from the Charles Dickens holiday classic, this webinar will review industry statistics and other indicators to evaluate how we did in 2013 from a privacy breach and security incident response perspective. Will our mythical CSO and CPO get the Scrooge-like CFO to approve their budget increases? And what will 2014 hold from a security, privacy, and regulatory perspective? Register below to find out.
Our featured speakers for this Dickensian webinar will be:
- Ebenezer Scrooge, Chief Financial Officer, Acme Inc. played by Ted Julian, Chief Marketing Officer, Co3 Systems
- Bob Cratchit, Chief Privacy Officer, Acme Inc. played by Gant Redmon, General Counsel, Co3 Systems
- Tiny Tim, Chief Security Officer, Acme Inc. played by "Tiny" Tim Armstrong, Incident Response Specialist, Co3 Systems
Rick Borden, Chief Privacy Officer, White & Williams LLP - #InfoGov17 - Cyber...ARMA International
While information governance has been a best practice in cybersecurity, outside of the Federal government and Sarbanes-Oxley financial reporting requirements, for the most part, regulations have not required information governance. That is rapidly changing. The New York Department of Financial Services new cybersecurity regulation has intensive information governance requirements that go beyond personal information. the European Global Data Protection Regulation also has significant information governance requirements. This session will discuss some of these regulatory requirements and where regulation is going in these areas.
Cyber risk has become a leading issue for many organisations as awareness of cloud computing, social media, corporate Bring Your Own Device (BYOD) policies and big data has grown, especially in light of the recent malicious cyber attacks experienced by companies across the European Union (EU). In an increasingly punitive legal and regulatory environment, and in the face of more frequent contractual insurance requirements specifying cyber liability, forward-thinking companies are taking proactive steps to explore and transfer cyber risk.
Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...Don Grauel
Steve Robinson of RPS Technology & Cyber presented "Discussing Cyber Risk Coverage With Your Commercial Clients" to the 68th Annual F. Addison Fowler Fall Seminar on October 17, 2014.
Legal vectors - Survey of Law, Regulation and Technology RiskWilliam Gamble
Survey of law, regulation and technology risk including new cyber security regulations, HIPAA, European Privacy GDPR, Internet of Things Liability, State Law
William Gamble
E. Andrew Keeney led a Cybersecurity Workshop at The Credit Union League of Connecticut's Compliance Series: Social Media Compliance Risks on February 10, 2015.
Managing and insuring cyber risks - Chamber of Commerce seminar 21 May 2015, ...Browne Jacobson LLP
At the Chamber of Commerce seminar Tim Johnson talks about managing and insuring cyber risks – cyber policies, available covers, common pitfalls and more.
Cybersecurity mitigation strategies webinar AIG ecoDa FERMA 24 March 2016FERMA
PART II – Cyber Security: the mitigation strategies – how to identify, assess and mitigate cyber risks
The Risk Manager must be responsible, as for others risks, for the quantification aspect of cyber security. It is a necessary step towards understanding and managing the exposure of the company. He/she should act as a facilitator between the Board and the operational department (IT, Finance, Legal and other functions).
A key subject to unlock the cyber insurance development and to support the economic growth the Digital world is bringing to Europe.
This presentation discusses how to select, protect and properly use a trademark so it can become a powerful brand for your products and services.
As well, it discusses "hot issues" in promotions and advertising law, including:
- recent Competition Bureau enforcement regarding misleading advertising;
- the use of social media in contests and promotions, including the need for transparency when engaging bloggers, endorsers and other "influencers" to promote your brand.
Le gestion de crise : considérations juridiques et pratiques pour traverser l...This account is closed
Au cours de ce programme de formation préparé spécifiquement pour les conseillers juridiques en entreprise, nous vous présenterons une série d’outils visant à vous équiper pour affronter la tempête, peu importe quand et comment elle se présente.
This presentation includes information about legal project management fundamentals, creating a framework for legal project management (define, plan, monitor and manage, review and improve), ethics and the law, conflicts from outside counsel and the general counsel.
Canadian Procurement/Construction Delivery Methods
Various procurement/construction delivery methods exist to provide alternatives as to how risks and responsibilities are allocated for a project and how key factors such as time and price are addressed.
Traditional Delivery Method:
Design-Bid-Build
- Stipulated Price
- Cost Plus
- Unit Price
Contemporary Delivery Methods:
- Construction Management (not-at-risk / at-risk)
- Design-Build
- P3’s
The Canadian government recently announced that the 12 Pacific Rim countries (Australia, Brunei, Canada, Chile, Japan, Malaysia, Mexico, New Zealand, Peru, Singapore, Vietnam and the United States) negotiating the Trans-Pacific Partnership Treaty (TPP) reached an agreement. According to our government, the TPP will set a “strong regional standard” for the protection and enforcement of Intellectual Property (IP) rights, and will give investors and businesses confidence that the same IP rules will be applied across the TPP region. Before coming into force, the agreement must be ratified by each country.
In this presentation, Scott Foster discusses the IP provisions of the TPP, and examines potential changes to the IP regimes that may arise following an implementation of the TPP in Canada.
In this presentation, Gowlings partner Parul Armitage will look at current trends in life sciences licensing and collaborations.
Topics to be explored include:
Financial terms
Valuations
The continuing saga of the patent cliff
“More payer pressure, more commercialization risk”
Licensing as a commercialization strategy
Academic to industry licensing
The Cloud Computing Contract Playbook - Contracting for Cloud Services, Sept. 30This account is closed
Gowlings partner Paul Armitage discusses what is and isn’t unique about contracting for cloud services; key terms to look for and the differences between cloud and traditional IT services contacts; what to look for in a cloud services provider and its contract; storing data in the cloud; and tips and best practices for cloud services procurement.
It’s widely known that foreign companies looking to acquire strong targets are drawn to Canada’s vast resource sector. But there’s also plenty of M&A activity — and opportunity — across many other Canadian industries, such as technology, life sciences, media and communications, manufacturing and retail.
In this one-hour webinar, experts from Gowlings will share their insights on the Canadian M&A legal regime, and offer tips on how to navigate the complexities of the market and successfully acquire a Canadian company. Topics include:
- Building your acquisition model and determining the most appropriate structure for a Canadian company acquisition
- Determining the applicable tax rules and assessing the potential tax advantages
- An overview of competition law and the Investment Canada Act — due diligence, thresholds and the review process
PLSAs, SEPs and PAEs: The Antitrust/IP Acronyms You Should Know and UnderstandThis account is closed
In this presentation from June 2015, Davit Akman and a panel of other antitrust experts provide an overview of recent regulatory and jurisprudential developments in the U.S., Europe and Canada, and their impact on antitrust counselling and risk assessment.
Key topics discussed include:
• Patent litigation settlement agreements (PLSAs)
• Standard setting and conduct involving standard essential patents (SEPs)
• Conduct involving patent assertion entities (PAEs)
Your company’s people, products, profits and politics have a direct impact on its bottom line.
In this seminar presentation aimed at in-house counsel, HR and other business leaders, you’ll learn from legal and industry insiders on how to master these four key pillars ― and succeed in today’s competitive manufacturing market.
Car Accident Injury Do I Have a Case....Knowyourright
Every year, thousands of Minnesotans are injured in car accidents. These injuries can be severe – even life-changing. Under Minnesota law, you can pursue compensation through a personal injury lawsuit.
NATURE, ORIGIN AND DEVELOPMENT OF INTERNATIONAL LAW.pptxanvithaav
These slides helps the student of international law to understand what is the nature of international law? and how international law was originated and developed?.
The slides was well structured along with the highlighted points for better understanding .
ALL EYES ON RAFAH BUT WHY Explain more.pdf46adnanshahzad
All eyes on Rafah: But why?. The Rafah border crossing, a crucial point between Egypt and the Gaza Strip, often finds itself at the center of global attention. As we explore the significance of Rafah, we’ll uncover why all eyes are on Rafah and the complexities surrounding this pivotal region.
INTRODUCTION
What makes Rafah so significant that it captures global attention? The phrase ‘All eyes are on Rafah’ resonates not just with those in the region but with people worldwide who recognize its strategic, humanitarian, and political importance. In this guide, we will delve into the factors that make Rafah a focal point for international interest, examining its historical context, humanitarian challenges, and political dimensions.
Military Commissions details LtCol Thomas Jasper as Detailed Defense CounselThomas (Tom) Jasper
Military Commissions Trial Judiciary, Guantanamo Bay, Cuba. Notice of the Chief Defense Counsel's detailing of LtCol Thomas F. Jasper, Jr. USMC, as Detailed Defense Counsel for Abd Al Hadi Al-Iraqi on 6 August 2014 in the case of United States v. Hadi al Iraqi (10026)
2. Today’s Topics
• Nature and extent of cyber losses
• Traditional commercial cover
• Coverage jurisprudence
• D&O connection
• Risk management considerations
• Regulatory framework
• Privacy breach jurisprudence
• Best practices in breach response
2
3. Cyber Threats
• More electronic data will be produced in the year
2017 then will have been produced in total up to
that point in time
• Web based information technology changing
risk profiles
• Outsourced IT services and cloud based IT
services have increased potential data loss
3
4. Cyber Threats
• More devices being connected on-line
• Widening potential entry points for disruption
• Broadening impacts of a disruption
4
6. Sources of Risk
• Targeted attacks
• Human error
• Rogue employees
• Physical loss/theft of devices
• Phishing
• POS
6
7. Potential Consequences
• Large scale privacy breaches
• Theft of funds/IP
• Business Interruption
• Cyber extortion
7
8. Data Breaches
• Breaches increasing in number and severity
• Number of known data breaches in 2013 tripled
from that in 2012
• On average, attackers in system for over 200
days
8
9.
10. Cost of Breach
• Poneman Institute study:
• Average cost of breach is US$3.5 Million
• Average cost per record is US$145
10
11. Insurable Cyber Losses
• First-party losses
• Data breach response
• Crisis management costs
• Lost income
• Online defamation
• Regulatory defence costs and fines
• Cyber-extortion
11
12. Insurable Cyber Losses
• Third-party losses
• Customer or client losses resulting from data breach
• Invasion of privacy claims
• Client losses resulting from inability to access systems
12
13. Uninsurable Cyber Losses
• Damage to reputation/brand
• Loss of goodwill
• Loss of future earnings
• Opportunity cost
13
15. E&O
• Damages or losses that insured legally obligated
to pay as a result of a “claim”
• Ordinarily tied to “wrongful act” or negligence
arising from delivery of “professional services”
• May contain privacy/data breach exclusion
15
16. D&O
• Damages or losses that insured legally obligated
to pay as a result of a “claim”
• Claim arising from decisions and actions taken
on behalf of the corporation
16
17. CGL
• ‘Bodily injury' or 'property damage’
• Caused by an 'occurrence,'
• ‘Advertising injury' or 'personal injury'
17
18. CGL
• In 2001, Insurance Services Office (U.S.) revised
its standard CGL policy form to exclude
“electronic data” from the definition of “property
damage”
• In 2005, Insurance Service Bureau of Canada
followed suit
18
19. CGL
Zurich American Insurance Company v Sony
Corporation of America, (NY Sup Ct, Feb 21 2014).
• Sony’s online systems breached by hackers
• Personal data of 77 million users stolen
• Approximately 12 million credit card numbers
stolen
• Estimated $2 billion in losses
• 55 class actions commenced
• Sony claimed under CGL and excess policies
19
20. CGL
Zurich v Sony, cont’d
•• Sony’s CGL policy included coverage for “oral or
written publication, in any matter, of material that
violates a person’s right of privacy”
• Zurich argued that “publication” required an
intentional act on the part of the insured
• Court agreed with Zurich and denied coverage; the
acts of third-party hackers did not satisfy the
“publication” requirement in the CGL policy
20
21. CGL
• Sony decision has been appealed, with no date set
yet for the hearing
• Travellers has recently sought a Court ruling that it
is not required to defend or indemnify P.F. Chang
under CGL in class actions commenced in
connection with data breach
• No finality yet as to how Courts are going to deal
with this issue
21
22. CGL
• Effective May, 2014, ISO has released standard
form electronic data exclusion for CGL policies
• No guidance yet on how that exclusion will hold
up
22
23. Conclusions
• Remains to be seen how Courts will interpret
various coverage issues
• Businesses should be aware of the scope of
cyber risks and proactively assess insurance
coverage
• Businesses should not assume that
CGL/D&O/E&O policies will be sufficient to cover
all losses associated with a cyber event.
23
24. Thank You
Belinda Bain
Partner
Tel: 416-369-6174
Email: belinda.bain@gowlings.com
montréal ottawa toronto hamilton waterloo region calgary vancouver beijing moscow london
25. CYBER IS A STRATEGIC RISK
MARSH CANADA LIMITED
12 NOVEMBER, 2014
Gregory L. Eskins
National Cyber Practice Leader
gregory.eskins@marsh.com
27. A Structured Approach to Cyber Risk
“What does the
organization’s current
posture look like?
“What are the top risks
which could materially
impact the organization?
“How can we mitigate
these risks?”
“What are the economic
implications of the risks
identified?
1 Risk Assessment 2 risk exposure 3 Recommendation
• Dependency on Vendors
(cloud mobile hosting
• Review existing risk
• Generate loss scenario’s
priority • Based on the outcomes ,
Understanding the Risk Quantification
s and
prioritization 4
cloud, mobile, hosting,
etc…)
• Domicile of Customers
• Compliance with
Regulatory Requirements
assessment material and
identify top cyber risk
elements
• Conduct interviews with
internal business units
and based on the risk
categories
• Model the costs of a
privacy breach, if relevant
• Quantify economic loss
seek to identify the root
causes
• Align largest risks with risk
appetite
• Create risk mitigation
(including PCI)
• Critical Asset Inventory
(what protections are in
place?)
• operational
departments
• Based on the above, and
understanding of the
business, create a
common risk taxonomy
stemming from an
interruption to the business
due to a technology failure
(internal or external –
vendor)
recommendations for the
highly exposed risk
elements
Conduct platform
operational maturity
assessment
• Reliance of technology to
conduct business
operations?
y
with cyber risk categories
and the cyber risk
elements within each
category
• Prioritize risk categories in
p
MARSH
terms of economic impact
and frequency (likelihood)
28. Getting Key Stakeholders Involved.
• It has long been recognized that D&O’s have a fiduciary duty to protect the assets of
their organization. Today this duty extends to digital assets.
• Is the board informed about the most serious cybersecurity risks facing the industry,
and has it worked with executives to develop a cybersecurity risk appetite
statement?
• Does the company have a written cybersecurity risk management strategy and
governance framework? How is it measured and how well is it working? When was it
last reviewed?
• What are the most likely types of external threats? What are the internal threats?
• Security risk is complex, widespread, technical, and ever-changing. As a result, it is
difficult to quantify probability – there is little data.
• The process of applying for cyber insurance is itself a constructive exercise for raising
awareness and identifying potential vulnerabilities.
• What insurance policies cover the company against network security breaches and
other MARSH
cybersecurity incidents? Is this coverage up to date and is it adequate?
28
30. Current Purchasing Patterns
5%
1%
11%
4%
13%
5%
Transportation
Sports Entertainment &
Events
number of 8%
8%
10%
10%
13%
14%
Retail and Wholesale
Power and Utilities
The Marsh clients
purchasing cyber insurance
increased 21% from 2012 to
2013
32%
4%
37%
8%
45%
16%
Hospitality and Gaming
Health Care
10%
19%
13%
22%
17%
Financial Institutions
7%
10%
11%
10%
10%
13%
Education
Communications, Media and
Tecnology
All I d t i
2013
2012
2011
MARSH
7%
Industries 30
31. Security and Privacy Insurance Policy Risk Matrix
For Illustrative Purposes Only
Not
covered
Covered Dependent upon specifics of claims,
may have some coverage
Privacy and Cyber Perils Property
General
Liability
Traditional
Crime
Computer
Crime E&O Special Risk
Broad Privacy and
Cyber Policy
Indemnification of your notification costs costs, including
Privacy Liability
credit monitoring services
(sub-limited)
Defense of regulatory action due to a breach of
privacy regulation
Privacy Liability
(sub-limited)
Coverage for Fines and Penalties due to a breach of
privacy regulation
Privacy Liability
(sub-limited)
Threats or extortion relating to release of
confidential information or breach of computer
security
Cyber Extortion
•Liability resulting from disclosure of electronic
information and electronic information assets
Network Security
Liability from disclosure of confidential commercial
and/or personal information (i.e. breach of privacy)
Privacy Liability
Liability for economic harm suffered by others from a
failure of your computer or network security
(including written policies and procedures designed
Network Security
to prevent such occurrences)
Website infringes on IP or is defamatory Media/Content
Coverage
Destruction, corruption, or theft of your electronic
information assets/data due to failure of computer or
t k
Digital Assets
network
Theft of your computer systems resources Digital Assets
Loss of revenue and extra expense incurred due to
a failure of security
MARSH
Business Interruption
31
32. Privacy and Cyber Coverage Overview
• Privacy Liability: Harm suffered by others due to the collection or disclosure
of confidential information.
• others from a 3rd
Network Security Liability: Harm suffered by failure of your network
security.
• Cyber Extortion: The cost of investigation and the extortion demand (limited
crisis consultant expenses).
•• Regulatory Defense: Legal counsel for regulatory actions including coverage
for fines and penalties where permissible.
• Event/Breach Costs: The costs of complying with the various breach notification
laws and regulations including legal expense, call centers, credit
monitoring, and forensic investigation.
• Digital Assets: The value of data stolen, destroyed, or corrupted by a cyber
attack.
• Business Interruption: Business income that is interrupted by a cyber attack
or expense)
1st
a failure of technology (including the extra expense).
Coverage for privacy liability requires no negligence on the part of the insured and
provides defense to the entity for the intentional acts of the insured’s employees.
MARSH 32
33. Where are the Risks Going?
Coverage Spectrum Exposures
Standard Cyber
• Network Security & Privacy Liability
• Privacy Breach Complexi
Policy
Response Costs
• Regulatory Investigations
• Cyber Extortion
ity of Insur
Some insurers are silent;
others explicitly address • Cyberterrorism
rance Solu
Manuscript Language • Business interruption attributable to a network
outage for any reason, e.g. operational error.
utions
Emerging Products
• Cyber CAT
• 1st Party Property Damage and Bodily Injury
• Reputational Damage
MARSH
p g
33
35. The Board’s Role is Critical
“Until such time as cyber security becomes a regular
board of director's agenda item…the potential for
disruption is real and serious and we all pay the price.”
— Howard A. Schmidt, former Cyber Security Coordinator for President
Obama
MARSH 35
36. Cyber Breach Related Derivative Lawsuit
Cyber Liability: Data Breach Incident
““If our efforts to protect the security of personal information about our
customers and employees are unsuccessful, we could be subject to costly
government enforcement actions and private litigation and our reputation
could suffer. “ Company X, Inc. 10 (K) Risk Factors
D&O Liability: Derivative Lawsuit
A shareholder for Company X. has initiated a derivative lawsuit against
MARSH
certain directors and officers of the company, as well as against the
company itself as nominal defendant, related to the multiple data breaches
the company sustained.
36
37. Cybersecurity Securities Class Actions are Likely
Cyber Liability: Data Breach Incident
“If our efforts to protect the security of personal information about our
customers and employees are unsuccessful, we could be subject to costly
government enforcement actions and private litigation and our reputation
could suffer. “ Company X. 10 (K) Risk Factors
D&O Liability: Securities Class Action
There appears to be a growing consensus that stock drops are inevitable
when the market better understands cybersecurity threats the cost of
MARSH
breaches, and the impact of threats and breaches on companies’ business
models.
37
38. Directors and Officers Liability – Cyber
• The SEC guidance does not create a new obligation as far as reporting of
material events, but it does shine a spotlight on the issue
• Both the CSA and OSFI have weighed in on the increasing risks associated
with cyber security and crime. Specifically, the CSA has issued Staff Notice 11-
326, and OSFI has put forth their Cyber Security Self Assessment template (for
FRFI’s).
• Privacy and IT security exposure can be difficult for boards and senior
management to fully understand and keep pace with, BUT,
• This does not relieve them of the duty of oversight
– Directors need to ensure their organization’s have appropriate privacy and IT
security risk management measures in place
– Process, risk assessment, governance, and risk mitigation are critical
MARSH 38
39. D&O Liability Claims - Cyber
• Limited amount of cyber-related D&O litigation to date
– Issue not high on the list of exposures for D&O underwriters
– Expected to rise as the exposure continues to grow
• D&O insurance may be implicated:
– If directors and officers are sued for failing to properly disclose exposure to
IT security
– If privacy risks lead to a financial loss and/or drop in a company’s stock price
– A plaintiff’s attorney will look at the adequacy of the disclosures
around the risk
• To date, most claims have been brought by customers and regulators against
the company—claims that are typically not covered under a D&O policy (unless
entity coverage is purchased – private companies only)
• A steady growth in the dependence of business on technology and a steady
growth in cyber attacks means that the exposure is growing
• In terms of disclosure, the issue of materiality may be in the eye of the beholder
MARSH
, y y y
or investor: Could prove a fertile area of litigation
39
40. Directors and Officers Liability - Cyber
Board members need to be informed of the risks associated with privacy and
IT security
• Protection from claims of negligence
• Defense under the business judgment rule
They need to understand:
• The magnitude of the risks
• The procedures in place to mitigate the risks
And thus, Organizations may want to look at:
• How often the board receives reports on privacy and IT security risks?
• How comprehensive are those reports?
MARSH 40
42. Privacy Breach: Canadian Legal
Update, Notification Obligations
and Risk Mitigation
Peter Murphy
(416) 369-4674
peter.murphy@gowlings.com
43. Legal Update: PIPEDA
PIPEDA established an “ombudsman” privacy
enforcement system
• A complaint is made to PCC for breach of PIPEDA
• PCC may investigate and issue a report
• The complainant may apply to court in respect of the
complaint or the report
• The court may grant remedies, order the defendant to
change its practices, and/or award damages, including
damages for any humiliation the complainant has
suffered
43
44. Legal Update: PIPEDA
Chitrakar v. Bell TV, 2013 FC 1103
• Bell TV ran a credit check on complainant without
permission
• If performed with sufficient frequency, this type of
credit check impacts on the credit rating
• Bell TV gave complainant “the royal runaround” and
did not resolve his privacy concerns
• Bell TV responded to PCC in a “disingenuous”
manner. First it denied it knew which employee
ordered the credit check, then it said the employee
was terminated
44
45. Legal Update: PIPEDA
• PCC upheld complaint and issued recommendations
• Complainant applied to court
• Bell did not appear in court
• Justice Phelon concluded that Bell TV “violated
Chitrakar’’s privacy rights under PIPEDA””
• The court acknowledged common law principles of
compensation, deterrence and vindication when
granting damages
• Court awarded $10,000 damages, $10,000 exemplary
damages, and $1,000 costs
45
46. Legal Update: Ontario Privacy Tort
Jones v. Tsige, 2012 ONCA 32
• Created tort of “intrusion upon seclusion” in Ontario
• Jones sued Tsige, a BMO employee, for accessing
Jones’ banking records for personal reasons at least
174 times over four years
• Jones sued Tsige for invasion of privacy and breach of
fiduciary duty
• OCA recognized “intrusion upon seclusion” as a cause
of action and awarded $10,000 damages
46
47. Legal Update: Ontario Privacy Tort
To find “intrusion upon seclusion”:
• The defendant must have acted intentionally or
recklessly;
• The defendant must have invaded the plaintiff’s private
affairs or concerns; and
• A reasonable person would regard the invasion as
highly offensive, causing distress, humiliation or
anguish
Proof of actual loss is not an element of the cause of
action!
47
48. Legal Update: Ontario Privacy Tort
Limits on “intrusion upon seclusion”:
• Claims can only arise for significant invasions of
personal privacy
• The right of privacy may be subject to competing rights
• Damages for this tort are ““symbolic”” or ““moral”” and will
likely be no more than $20,000
Note the British Columbia Court of Appeal has ruled that,
despite Jones, in B.C. there is no common law tort of
breach of privacy.1
1 Uf k A i I C ti f B iti h C l bi BCSC 48
Ufuk Ari v. Insurance Corporation of British Columbia, 2013 1308
49. Legal Update: Privacy Class Actions
During 2013:
• 81% year-over-year increase in breach reports to PCC
from private sector organizations
• PIPEDA complaints increased from 220 to 426
• Privacy class action suits exploded
49
50. Legal Update: Privacy Class Actions
Condon v. Canada, 2011 FC 250
• Motion to certify a class action against the Minister of
Human Resources and Skills Development Canada
(“MHR”)
•• Alleges MHR lost a hard drive that contained student
loan information of 583,000 individuals
• Hard drive was not encrypted and went missing from
cabinet
• MHR notified PCC 3 weeks after becoming aware
• MHR argued that plaintiffs suffered no compensable
damages
50
51. Legal Update: Privacy Class Actions
• Plaintiffs allege (a) breach of contract and warranty, (b)
intrusion upon seclusion, (c) negligence, (d) breach of
confidence:
• application forms provided that application information
would be held confidential and secure
• for intrusion upon seclusion, plaintiffs argue a reckless
breach of privacy by MHR
•• the court held that the claims based on negligence and
breach of confidence would fail because there is no
evidence of damages
• class proceeding approved on the questions of alleged
breach of contract and warranty and tort of intrusion upon
seclusion
51
52. Legal Update: Privacy Class Actions
Hopkins v. Kay, 2014 ONSC 321
• Alleges that 280 patient records in a hospital were
wrongfully accessed and disclosed amounting to
intrusion upon seclusion
•• The defendant argues that PHIPA governs, such that
common law tort claims are precluded
• PHIPA sets out a complaint resolution scheme similar
to PIPEDA, but also has a $10,000 cap on damages
and immunity provisions that protects custodians from
acts or omissions done in good faith and reasonable in
the circumstances
52
53. Legal Update: Privacy Class Actions
Evans v. Scotia 2014 ONSL 2135
• Alleges that Bank employee disclosed customer
information for fraudulent and improper purposes
• Both employee and employer named as defendants
• The claim is for intrusion upon seclusion, negligence
and breach of contract
• Bank argues it is not liable for its employee and there
is no cause of action
• The court decided it is not “plain and obvious” that the
Bank will not be held vicariously liable for the
employees’ tort or for resulting “symbolic and moral”
damages
53
54. Legal Update: Privacy Class Actions
Key Privacy Class Action Issues
• Where the breach was inadvertent, what will the
standard for “recklessness” be?
• Will privacy breaches amount to “breach of contract”
where a privacy policy was not followed?
• Will the dispute resolution scheme in PHIPA (or other
privacy statues) pre-empt or limit actions for inclusion
upon seclusion?
• When will an organization be vicariously liable for its
employees’ breach of privacy?
• How does the “cap” on damages under Jones v. Tsige
($20,000) apply to class actions?
54
55. Breach Notification
Statutory Breach Notification Requirements:
• At present, only Alberta and Manitoba have statutory
breach notification requirements for the private sector.
55
56. Breach Notification
Alberta PIPA
1. An organization must, without unreasonable delay, give
notice to the Privacy Commissioner of any loss,
unauthorized access to or unauthorized disclosure of
personal information under its control if a reasonable
person would consider that there is a real risk of
significant harm to an individual as a result of the
security breach. (PIPA s. 34.1(1))
2. The Privacy Commissioner may require the
organization to notify affected individuals where there
is a real risk of significant harm as a result of the
security breach (s. 37.1(1))
3. The notice must comply with PIPA regulations s. 19.1(1)
as to content
56
57. Breach Notification
Manitoba PIPITPA
1. An organization must, as soon as reasonably
practicable, notify an individual if personal information
about the individual under the organization’s custody is
stolen, lost or accessed in an unauthorized manner.
2. The requirement does not apply where the organization
is satisfied it is not reasonably possible for the personal
information to be used unlawfully.
57
58. Breach Notification
Bill s. 4 will amend PIPEDA
• Requires mandatory breach reporting to PCC and
affected individuals:
• notice required as soon as “feasible”
•• where it is reasonable in the circumstance to believe that
the breach creates a real risk of significant harm to an
individual
• requires records be kept relating to such a breach and
their disclosure to PCC on request
• establishes fines up to $100,000 for breach of the
reporting or record keeping requirements
58
59. Breach Notification
Canadian health sector statutory breach reporting
obligations
• Ontario Personal Health Information Protection Act, s.
12(2)
•• New Brunswick’s Personal Health Information Privacy
and Access Act, s. 49(1)(c)
• Nova Scotia’s Personal Health Information Act, s. 69
• Newfoundland and Labrador’s Personal Health
Information Act, s. 15(3)
59
60. Breach Notification
U.S. Statutory Breach Notification Obligations
• Most U.S. States require notice of security breaches
involving personally identifiable information (only
Alabama, New Mexico and South Dakota do not)
•• Requirements vary state by state as to who is subject
to the law, who to notify, the subject information, what
constitutes breach and exemptions
60
61. Breach Notification
The case of California
• California was the first state to require data breach
notification (2003); there, both businesses and state
agencies must report to individuals and the Attorney
General
• As of January 2015, California will require persons or
businesses that suffer a breach that exposed the
individual’s name and either SSN or D/L number,
where the information was not encrypted, to offer
identity theft prevention or mitigation services at no
cost to the affected individuals for at least 12 months
61
62. Guidelines
Privacy Commissioners in Canada have published
guidelines for responding to security breaches
• The guidelines contain consistent approaches to
security breaches, the main components being:
1. Contain the Breach
2. Evaluate the Risks
3. Notification
4. Prevention
62
63. Guidelines
1. Contain the Breach
• Take immediate practical and technological steps to
contain the breach
• Activate breach management policy (you should have
one!)
• Designate a response team (e.g., Privacy Officer,
security, IT, communications and legal) to investigate
the breach and handle the situation
• Appoint a company spokesperson
• Contact external legal counsel and media relations
advisor
63
64. Guidelines
• Plan reactive customer and media statements
• Conduct interviews (consider using lawyers to protect
the discussions with privilege)
• Preserve all internal and external data and records
necessary for subsequent investigation
64
65. Guidelines
2. Evaluate the Risks
• How sensitive is the information?
• Is the information encrypted or protected?
• Are the recipients known or unknown, and possibly
criminal?
• What harm could result from the breach?
• identity theft
• financial loss
• loss of business or employment opportunities
• damage to reputation
• physical safety, security
65
66. Guidelines
3. Notification
• Is notification required?
• statutory requirements
• Commissioner guidelines
• contractual requirements (e.g., services contracts, credit
agreements, insurance policies)
• would notification prevent or mitigate potential harm to the
affected individuals?
• When to notify?
•• notification should occur as soon as possible following
assessment and evaluation of the breach
66
67. Guidelines
• Who to notify? Consider:
• Privacy Commissioners, to help them provide advice or
guidance to the organization in responding to the breach,
including notification, and to meet legal obligations
• affected individuals, to help them prevent or mitigate
potential harm from the breach
• police, if theft or other crime is suspected
•• insurers, banks
• professional or regulatory bodies, if required by
applicable regulatory standards
• third parties who may be impacted, e.g., contractors,
suppliers, trade unions
• public at large for publicly traded companies under
securities laws/guidelines
67
68. Guidelines
4. Prevention
• Investigate the cause of the breach and develop a plan
to prevent breaches
• Prevention Tips:
• audit administrative, physical and technical safeguards
• review and update policies and procedures (e.g., security
policies, records retention policies, incident response
plan, etc.)
• ensure policies are followed in practice
•• employee training
• review service providers, partners, distribution channels
68
69. Guidelines
• use encryption where appropriate
• inventory your PI
• review/consider insurance coverage
69
70. Thank You
montréal ottawa toronto hamilton waterloo region calgary vancouver beijing moscow london