SlideShare a Scribd company logo
www.globalcyberconsultants.com
Who Are We and Why Are We Here?
Steven Schwartz
• TheCyberSteve
• CEO of Global Cyber Consultants
• Founding Board Member of Personal Data
Trade Association
• Co-Founder & Vice-Chairman of Clean Data
Institute
Harumi Urata-Thompson
• The Michelin 3-Star #FinChef
• Executive and Strategic Advisor
• President and Founding Board Member of
Personal Data Trade Association
Where to Start
First we need to acknowledge that we
are accelerating into this era of data
proliferation changing not only how
we evaluate business risk, but the
nature of the business’ operations as
well
1
Almost every company is shifting
towards becoming a “data” company
whether they are collecting data,
storing data, transacting data,
analyzing data, monetizing, etc
2
How Does This
Translate to
Cybersecurity?
Two Fold – for one, cybersecurity
is now and will increasingly be a
critical foundation. Trust is the
new currency
A company’s objective should be
to increase the business’ trust &
confidence in data and quality of
analytic insights that come from it.
Secondarily and really where the dynamic
is changing, is that cybersecurity is no
longer just another cost center item on
your balance sheet. It’s no longer
something to be done just for
compliance. Evaluating cyber risk is a data
driven exercise that is encapsulated
within you’re overall business strategy.
Requirement Impact & Potential Consequence Methods of Control
Confidentiality – Protection of
Information from Unauthorized
Exposure
- Disclosure of information
governed by privacy laws
- Loss of Intellectual Property
- Reputational Damage
- Legal repercussions
- Access Controls
- File Permissions
- Encryption
Integrity – Accuracy and
Completeness of Information
- Fraud
- Inaccurateness
- Erroneous Decisions
- Access Controls
- Logging
- Digital Signatures
- Hashes
- Encryption
Availability – The ability to access
information and resources
- Loss of Functionality
- Loss of Productivity
- Interference with Enterprise
Objectives
- Redundancy
- Backups
- Access Controls
Is there a Critical Foundation within Data & Cyber Security?
What is the
ROI?
So Where Do
We Start in
Quantifying
the Risk?
First we need to acknowledge that
cyber risk is business risk and must
speak the same language
The quality of the data will drive
the overall effectiveness of your
security program.
No Assumptions!
How do we
Define or
Decompose
Risks as it
Relates to
Cybersecurity?
• Let’s define Risk as the the probable magnitude
of future loss (an undertain event).
• Terminology and classification is critical in
translating the conversation towards business
strategy
Which of the
Following Are
Risks?
• Disgruntled Insiders?
• Internet facing web servers?
• Untested Recovery processes?
• Sensitive Customer Information?
• Weak Passwords?
• Cyber criminals?
None of Them
Are…
• They are all part of the risk landscape…
• Disgruntled Insiders = Threat Community
• Internet facing web servers = Asset
• Untested Recovery processes = Deficient Control
• Sensitive Customer Information? = Asset
• Weak Passwords? = Deficient Control
• Cyber criminals? = Threat Community
How Do We Start to Quantify Cyber Risk?
Loss Event Frequency
RISK
Loss Event Magnitude
Examples of Loss Events:
• A data center outage due to extreme weather
• A corrupted database
• An employee stealing intellectual property
• A hacker stealing sensitive customer information
Develop a Loss Flow
• Threat Agent
• Asset
• Stakeholder
• Primary
• Secondary
Loss Flow
1. Asset at risk
1. Personal Information
2. Operating System
3. Applications
2. Threat Actors
3. Threat Effect: Confidentiality, Integrity, Availability
Building a Cyber Risk Scenario
Where Does
Insurance
Come into
Play
Running through these scenarios moves from tactical
to strategic, evaluating multiple scenarios to provide
a probabilistic view of enterprise risk. Now that we’ve
identified our risk and mitigation controls, let’s assess
how much risk we want/need to transfer
When you understand the assets at risk, the threats
and the control mechanisms in place to prevent, you
can understand how much risk is mitigated
Then it’s a strategic decision on how much risk you
want to transfer
Cyber Insurance is “Your Last Line of Defense” when Technology Fails
A Cyberattack can burden your company with substantial time and costs that can put YOU out of BUSINESS if YOU’RE NOT PROTECTED.
Cyber Insurance covers a business’s liability for a data breach in which their customer’s information (PII, Tax Info, Health Info, etc.….)
is exposed or stolen by a criminal or someone with unauthorized use who has gained access to the company’s network.
Crisis
Management
Costs
Notification
Costs
Business
Interruption
Costs
Regulatory
Fines and
Penalties
Legal Liability
Reputational
Damage
Why Do You Need Cyber Insurance?
What Does Cyber Insurance Coverage?
What Does Cyber Insurance Coverage?
Company
# of Records
Breached
Costs Insurance
Root Cause
of the Breach
Notes
130 Million
$140M
to Date
$30M
SQL Injection code that
allowed Hackers into each
their systems for 6 months
Stock fell by 80%, resulting
in Shareholder Suits
110 Million $252M $90M
Malware was introduced
by a much smaller
corporate partner
46% drop in sales in the quarter that
the breach hit
70 Class Action Lawsuits
4 Shareholder Derivative Demands
94 Million
Approx.
$1.6B
No Evidence
Hackers broke into their wireless
network and stole the records in the 2nd
half of 2005 and throughout 2006
25 Class Action lawsuits following the
breach settlements
TJ Maxx paid out several hundred
million dollars
So How much do these Data Breaches Cost?
Company
# of Records
Breached
Costs Insurance
Root Cause
of the Breach
Notes
2.6 TB of Data;
11.5M Confidential
Documents;
4.8M Emails;
214K Offshore Entities
TBD –
Possible most in
Direct Losses
Loss of Reputation
NA
Outdated firewalls, antivirus, password
protection, encryption
Outside hacker
Offshore Holdings of
12 world leaders,
140 Political Leaders and
29 Forbes-listed Billionaires
78.8 Million
$142m
to Date
NA
State-Nation Cyber Attack, executing a
sophisticated attack to gain unauthorized
access
Post-Breach, Anthem spent $65M in
Cybersecurity Enhancements
in both 2015 and 2016
83 Million Estimates $1 Billion NA
Employee's Personal Computer was
injected with malware that stole login
credential
IT Spending expected to increase
additional $250M
Both this year and next year
So How much do these Data Breaches Cost?

More Related Content

What's hot

A data-centric program
A data-centric program A data-centric program
A data-centric program
at MicroFocus Italy ❖✔
 
Executive Summary of the 2016 Scalar Security Study
Executive Summary of the 2016 Scalar Security StudyExecutive Summary of the 2016 Scalar Security Study
Executive Summary of the 2016 Scalar Security Study
Scalar Decisions
 
Corporate Treasurers Focus on Cyber Security
Corporate Treasurers Focus on Cyber SecurityCorporate Treasurers Focus on Cyber Security
Corporate Treasurers Focus on Cyber Security
Joan Weber
 
In the news
In the newsIn the news
In the news
Rob Wilson
 
2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...
2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...
2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...
Scalar Decisions
 
How to Establish a Cyber Security Readiness Program
How to Establish a Cyber Security Readiness ProgramHow to Establish a Cyber Security Readiness Program
How to Establish a Cyber Security Readiness Program
Matt Moneypenny
 
The Cyber Security Readiness of Canadian Organizations
The Cyber Security Readiness of Canadian OrganizationsThe Cyber Security Readiness of Canadian Organizations
The Cyber Security Readiness of Canadian Organizations
Scalar Decisions
 
Cyber Defense For SMB's
Cyber Defense For SMB'sCyber Defense For SMB's
Cyber Defense For SMB's
Guise Bule
 
Cyber Security, IP Theft, and Data Breaches
Cyber Security, IP Theft, and Data BreachesCyber Security, IP Theft, and Data Breaches
Cyber Security, IP Theft, and Data Breaches
Ethisphere
 
10 best cybersecurity companies in healthcare for 2021
10 best cybersecurity companies in healthcare for 202110 best cybersecurity companies in healthcare for 2021
10 best cybersecurity companies in healthcare for 2021
insightscare
 
MT118 Risk Intelligence - Making the Right Choices in Cybersecurity
MT118 Risk Intelligence - Making the Right Choices in CybersecurityMT118 Risk Intelligence - Making the Right Choices in Cybersecurity
MT118 Risk Intelligence - Making the Right Choices in Cybersecurity
Dell EMC World
 
ThreatMetrix Minimizes Payment Fraud Reduce Fraud and Protect Revenue Without...
ThreatMetrix Minimizes Payment Fraud Reduce Fraud and Protect Revenue Without...ThreatMetrix Minimizes Payment Fraud Reduce Fraud and Protect Revenue Without...
ThreatMetrix Minimizes Payment Fraud Reduce Fraud and Protect Revenue Without...
Ken Lam
 
Where Is Your Sensitive Data Wp
Where Is Your Sensitive Data   WpWhere Is Your Sensitive Data   Wp
Where Is Your Sensitive Data Wp
tbeckwith
 
CISO_Paper_Oct27_2015
CISO_Paper_Oct27_2015CISO_Paper_Oct27_2015
CISO_Paper_Oct27_2015Scott Smith
 
CISO_Paper_Oct27_2015
CISO_Paper_Oct27_2015CISO_Paper_Oct27_2015
CISO_Paper_Oct27_2015John Budriss
 
ThreatMetrix ARRC 2016 presentation by Ted Egan
ThreatMetrix ARRC 2016 presentation by Ted EganThreatMetrix ARRC 2016 presentation by Ted Egan
ThreatMetrix ARRC 2016 presentation by Ted Egan
Ken Lam
 
Issp for Uadigitals 2019
Issp for Uadigitals 2019Issp for Uadigitals 2019
Issp for Uadigitals 2019
Elena Peday
 
Scalar security study2017_slideshare_rev[1]
Scalar security study2017_slideshare_rev[1]Scalar security study2017_slideshare_rev[1]
Scalar security study2017_slideshare_rev[1]
Tracey Ong
 
Material de apoyo Un replanteamiento masivo de la seguridad.
Material de apoyo Un replanteamiento masivo de la seguridad.Material de apoyo Un replanteamiento masivo de la seguridad.
Material de apoyo Un replanteamiento masivo de la seguridad.
Universidad Cenfotec
 

What's hot (20)

A data-centric program
A data-centric program A data-centric program
A data-centric program
 
Executive Summary of the 2016 Scalar Security Study
Executive Summary of the 2016 Scalar Security StudyExecutive Summary of the 2016 Scalar Security Study
Executive Summary of the 2016 Scalar Security Study
 
Corporate Treasurers Focus on Cyber Security
Corporate Treasurers Focus on Cyber SecurityCorporate Treasurers Focus on Cyber Security
Corporate Treasurers Focus on Cyber Security
 
In the news
In the newsIn the news
In the news
 
2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...
2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...
2016 Scalar Security Study: The Cyber Security Readiness of Canadian Organiza...
 
How to Establish a Cyber Security Readiness Program
How to Establish a Cyber Security Readiness ProgramHow to Establish a Cyber Security Readiness Program
How to Establish a Cyber Security Readiness Program
 
The Cyber Security Readiness of Canadian Organizations
The Cyber Security Readiness of Canadian OrganizationsThe Cyber Security Readiness of Canadian Organizations
The Cyber Security Readiness of Canadian Organizations
 
Event Guide V8
Event Guide V8Event Guide V8
Event Guide V8
 
Cyber Defense For SMB's
Cyber Defense For SMB'sCyber Defense For SMB's
Cyber Defense For SMB's
 
Cyber Security, IP Theft, and Data Breaches
Cyber Security, IP Theft, and Data BreachesCyber Security, IP Theft, and Data Breaches
Cyber Security, IP Theft, and Data Breaches
 
10 best cybersecurity companies in healthcare for 2021
10 best cybersecurity companies in healthcare for 202110 best cybersecurity companies in healthcare for 2021
10 best cybersecurity companies in healthcare for 2021
 
MT118 Risk Intelligence - Making the Right Choices in Cybersecurity
MT118 Risk Intelligence - Making the Right Choices in CybersecurityMT118 Risk Intelligence - Making the Right Choices in Cybersecurity
MT118 Risk Intelligence - Making the Right Choices in Cybersecurity
 
ThreatMetrix Minimizes Payment Fraud Reduce Fraud and Protect Revenue Without...
ThreatMetrix Minimizes Payment Fraud Reduce Fraud and Protect Revenue Without...ThreatMetrix Minimizes Payment Fraud Reduce Fraud and Protect Revenue Without...
ThreatMetrix Minimizes Payment Fraud Reduce Fraud and Protect Revenue Without...
 
Where Is Your Sensitive Data Wp
Where Is Your Sensitive Data   WpWhere Is Your Sensitive Data   Wp
Where Is Your Sensitive Data Wp
 
CISO_Paper_Oct27_2015
CISO_Paper_Oct27_2015CISO_Paper_Oct27_2015
CISO_Paper_Oct27_2015
 
CISO_Paper_Oct27_2015
CISO_Paper_Oct27_2015CISO_Paper_Oct27_2015
CISO_Paper_Oct27_2015
 
ThreatMetrix ARRC 2016 presentation by Ted Egan
ThreatMetrix ARRC 2016 presentation by Ted EganThreatMetrix ARRC 2016 presentation by Ted Egan
ThreatMetrix ARRC 2016 presentation by Ted Egan
 
Issp for Uadigitals 2019
Issp for Uadigitals 2019Issp for Uadigitals 2019
Issp for Uadigitals 2019
 
Scalar security study2017_slideshare_rev[1]
Scalar security study2017_slideshare_rev[1]Scalar security study2017_slideshare_rev[1]
Scalar security study2017_slideshare_rev[1]
 
Material de apoyo Un replanteamiento masivo de la seguridad.
Material de apoyo Un replanteamiento masivo de la seguridad.Material de apoyo Un replanteamiento masivo de la seguridad.
Material de apoyo Un replanteamiento masivo de la seguridad.
 

Similar to Quantifying Cyber Risk, Insurance and The Value of Personal Data

Cyber Security Privacy Brochure 2015
Cyber Security Privacy Brochure 2015Cyber Security Privacy Brochure 2015
Cyber Security Privacy Brochure 2015sarah kabirat
 
Netwealth educational webinar: Peace of mind in a digital world
Netwealth educational webinar: Peace of mind in a digital worldNetwealth educational webinar: Peace of mind in a digital world
Netwealth educational webinar: Peace of mind in a digital world
netwealthInvest
 
Cybersecurity risk assessments help organizations identify.pdf
Cybersecurity risk assessments help organizations identify.pdfCybersecurity risk assessments help organizations identify.pdf
Cybersecurity risk assessments help organizations identify.pdf
TheWalkerGroup1
 
Too Small to Get Hacked? Think Again (Webinar)
Too Small to Get Hacked? Think Again (Webinar)Too Small to Get Hacked? Think Again (Webinar)
Too Small to Get Hacked? Think Again (Webinar)
OnRamp
 
Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
Anil
 
Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
Anil
 
What CIOs Need To Tell Their Boards About Cyber Security
What CIOs Need To Tell Their Boards About Cyber SecurityWhat CIOs Need To Tell Their Boards About Cyber Security
What CIOs Need To Tell Their Boards About Cyber Security
Karyl Scott
 
nist_small_business_fundamentals_july_2019.pptx
nist_small_business_fundamentals_july_2019.pptxnist_small_business_fundamentals_july_2019.pptx
nist_small_business_fundamentals_july_2019.pptx
JkYt1
 
Cyber Security for the Small Business Experience
Cyber Security for the Small Business ExperienceCyber Security for the Small Business Experience
Cyber Security for the Small Business Experience
National Retail Federation
 
Cyber Risk Quantification | Safe Security
Cyber Risk Quantification | Safe SecurityCyber Risk Quantification | Safe Security
Cyber Risk Quantification | Safe Security
Rahul Tyagi
 
A CIRO's-eye view of Digital Risk Management
A CIRO's-eye view of Digital Risk ManagementA CIRO's-eye view of Digital Risk Management
A CIRO's-eye view of Digital Risk ManagementDaren Dunkel
 
4th Digital Finance Forum, Simon Brady
4th Digital Finance Forum, Simon Brady4th Digital Finance Forum, Simon Brady
4th Digital Finance Forum, Simon Brady
Starttech Ventures
 
Strategic Insights on IT & Cyber Risk Assessments.pdf
Strategic Insights on IT & Cyber Risk Assessments.pdfStrategic Insights on IT & Cyber Risk Assessments.pdf
Strategic Insights on IT & Cyber Risk Assessments.pdf
lilabroughton259
 
Fortify Your Enterprise with IBM Smarter Counter-Fraud Solutions
Fortify Your Enterprise with IBM Smarter Counter-Fraud SolutionsFortify Your Enterprise with IBM Smarter Counter-Fraud Solutions
Fortify Your Enterprise with IBM Smarter Counter-Fraud Solutions
Perficient, Inc.
 
Insight2014 mitigate risk_fraud_6863
Insight2014 mitigate risk_fraud_6863Insight2014 mitigate risk_fraud_6863
Insight2014 mitigate risk_fraud_6863
IBMgbsNA
 
Cyber risk management-white-paper-v8 (2) 2015
Cyber risk management-white-paper-v8 (2) 2015Cyber risk management-white-paper-v8 (2) 2015
Cyber risk management-white-paper-v8 (2) 2015
Accounting_Whitepapers
 
Nonprofit Cybersecurity Risk Assessment Basics
Nonprofit Cybersecurity Risk Assessment BasicsNonprofit Cybersecurity Risk Assessment Basics
Nonprofit Cybersecurity Risk Assessment Basics
Community IT Innovators
 
Cyber Security and Data Protection
Cyber Security and Data ProtectionCyber Security and Data Protection
Cyber Security and Data Protection
Strategic Insurance Software
 
Cal cpa meeting infosec challenge - 160511
Cal cpa meeting infosec challenge - 160511Cal cpa meeting infosec challenge - 160511
Cal cpa meeting infosec challenge - 160511
Stan Stahl, PhD
 
Untitled document.otd
Untitled document.otdUntitled document.otd
Untitled document.otd
hamzarajpoot33
 

Similar to Quantifying Cyber Risk, Insurance and The Value of Personal Data (20)

Cyber Security Privacy Brochure 2015
Cyber Security Privacy Brochure 2015Cyber Security Privacy Brochure 2015
Cyber Security Privacy Brochure 2015
 
Netwealth educational webinar: Peace of mind in a digital world
Netwealth educational webinar: Peace of mind in a digital worldNetwealth educational webinar: Peace of mind in a digital world
Netwealth educational webinar: Peace of mind in a digital world
 
Cybersecurity risk assessments help organizations identify.pdf
Cybersecurity risk assessments help organizations identify.pdfCybersecurity risk assessments help organizations identify.pdf
Cybersecurity risk assessments help organizations identify.pdf
 
Too Small to Get Hacked? Think Again (Webinar)
Too Small to Get Hacked? Think Again (Webinar)Too Small to Get Hacked? Think Again (Webinar)
Too Small to Get Hacked? Think Again (Webinar)
 
Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
 
Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
 
What CIOs Need To Tell Their Boards About Cyber Security
What CIOs Need To Tell Their Boards About Cyber SecurityWhat CIOs Need To Tell Their Boards About Cyber Security
What CIOs Need To Tell Their Boards About Cyber Security
 
nist_small_business_fundamentals_july_2019.pptx
nist_small_business_fundamentals_july_2019.pptxnist_small_business_fundamentals_july_2019.pptx
nist_small_business_fundamentals_july_2019.pptx
 
Cyber Security for the Small Business Experience
Cyber Security for the Small Business ExperienceCyber Security for the Small Business Experience
Cyber Security for the Small Business Experience
 
Cyber Risk Quantification | Safe Security
Cyber Risk Quantification | Safe SecurityCyber Risk Quantification | Safe Security
Cyber Risk Quantification | Safe Security
 
A CIRO's-eye view of Digital Risk Management
A CIRO's-eye view of Digital Risk ManagementA CIRO's-eye view of Digital Risk Management
A CIRO's-eye view of Digital Risk Management
 
4th Digital Finance Forum, Simon Brady
4th Digital Finance Forum, Simon Brady4th Digital Finance Forum, Simon Brady
4th Digital Finance Forum, Simon Brady
 
Strategic Insights on IT & Cyber Risk Assessments.pdf
Strategic Insights on IT & Cyber Risk Assessments.pdfStrategic Insights on IT & Cyber Risk Assessments.pdf
Strategic Insights on IT & Cyber Risk Assessments.pdf
 
Fortify Your Enterprise with IBM Smarter Counter-Fraud Solutions
Fortify Your Enterprise with IBM Smarter Counter-Fraud SolutionsFortify Your Enterprise with IBM Smarter Counter-Fraud Solutions
Fortify Your Enterprise with IBM Smarter Counter-Fraud Solutions
 
Insight2014 mitigate risk_fraud_6863
Insight2014 mitigate risk_fraud_6863Insight2014 mitigate risk_fraud_6863
Insight2014 mitigate risk_fraud_6863
 
Cyber risk management-white-paper-v8 (2) 2015
Cyber risk management-white-paper-v8 (2) 2015Cyber risk management-white-paper-v8 (2) 2015
Cyber risk management-white-paper-v8 (2) 2015
 
Nonprofit Cybersecurity Risk Assessment Basics
Nonprofit Cybersecurity Risk Assessment BasicsNonprofit Cybersecurity Risk Assessment Basics
Nonprofit Cybersecurity Risk Assessment Basics
 
Cyber Security and Data Protection
Cyber Security and Data ProtectionCyber Security and Data Protection
Cyber Security and Data Protection
 
Cal cpa meeting infosec challenge - 160511
Cal cpa meeting infosec challenge - 160511Cal cpa meeting infosec challenge - 160511
Cal cpa meeting infosec challenge - 160511
 
Untitled document.otd
Untitled document.otdUntitled document.otd
Untitled document.otd
 

Recently uploaded

ModelingMarketingStrategiesMKS.CollumbiaUniversitypdf
ModelingMarketingStrategiesMKS.CollumbiaUniversitypdfModelingMarketingStrategiesMKS.CollumbiaUniversitypdf
ModelingMarketingStrategiesMKS.CollumbiaUniversitypdf
fisherameliaisabella
 
The-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic managementThe-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic management
Bojamma2
 
Unveiling the Secrets How Does Generative AI Work.pdf
Unveiling the Secrets How Does Generative AI Work.pdfUnveiling the Secrets How Does Generative AI Work.pdf
Unveiling the Secrets How Does Generative AI Work.pdf
Sam H
 
Memorandum Of Association Constitution of Company.ppt
Memorandum Of Association Constitution of Company.pptMemorandum Of Association Constitution of Company.ppt
Memorandum Of Association Constitution of Company.ppt
seri bangash
 
Enterprise Excellence is Inclusive Excellence.pdf
Enterprise Excellence is Inclusive Excellence.pdfEnterprise Excellence is Inclusive Excellence.pdf
Enterprise Excellence is Inclusive Excellence.pdf
KaiNexus
 
Premium MEAN Stack Development Solutions for Modern Businesses
Premium MEAN Stack Development Solutions for Modern BusinessesPremium MEAN Stack Development Solutions for Modern Businesses
Premium MEAN Stack Development Solutions for Modern Businesses
SynapseIndia
 
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
BBPMedia1
 
LA HUG - Video Testimonials with Chynna Morgan - June 2024
LA HUG - Video Testimonials with Chynna Morgan - June 2024LA HUG - Video Testimonials with Chynna Morgan - June 2024
LA HUG - Video Testimonials with Chynna Morgan - June 2024
Lital Barkan
 
ENTREPRENEURSHIP TRAINING.ppt for graduating class (1).ppt
ENTREPRENEURSHIP TRAINING.ppt for graduating class (1).pptENTREPRENEURSHIP TRAINING.ppt for graduating class (1).ppt
ENTREPRENEURSHIP TRAINING.ppt for graduating class (1).ppt
zechu97
 
20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf
tjcomstrang
 
Putting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptxPutting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptx
Cynthia Clay
 
5 Things You Need To Know Before Hiring a Videographer
5 Things You Need To Know Before Hiring a Videographer5 Things You Need To Know Before Hiring a Videographer
5 Things You Need To Know Before Hiring a Videographer
ofm712785
 
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
BBPMedia1
 
ikea_woodgreen_petscharity_cat-alogue_digital.pdf
ikea_woodgreen_petscharity_cat-alogue_digital.pdfikea_woodgreen_petscharity_cat-alogue_digital.pdf
ikea_woodgreen_petscharity_cat-alogue_digital.pdf
agatadrynko
 
VAT Registration Outlined In UAE: Benefits and Requirements
VAT Registration Outlined In UAE: Benefits and RequirementsVAT Registration Outlined In UAE: Benefits and Requirements
VAT Registration Outlined In UAE: Benefits and Requirements
uae taxgpt
 
falcon-invoice-discounting-a-premier-platform-for-investors-in-india
falcon-invoice-discounting-a-premier-platform-for-investors-in-indiafalcon-invoice-discounting-a-premier-platform-for-investors-in-india
falcon-invoice-discounting-a-premier-platform-for-investors-in-india
Falcon Invoice Discounting
 
What are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdfWhat are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdf
HumanResourceDimensi1
 
Discover the innovative and creative projects that highlight my journey throu...
Discover the innovative and creative projects that highlight my journey throu...Discover the innovative and creative projects that highlight my journey throu...
Discover the innovative and creative projects that highlight my journey throu...
dylandmeas
 
What is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdfWhat is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdf
seoforlegalpillers
 
Sustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & EconomySustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & Economy
Operational Excellence Consulting
 

Recently uploaded (20)

ModelingMarketingStrategiesMKS.CollumbiaUniversitypdf
ModelingMarketingStrategiesMKS.CollumbiaUniversitypdfModelingMarketingStrategiesMKS.CollumbiaUniversitypdf
ModelingMarketingStrategiesMKS.CollumbiaUniversitypdf
 
The-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic managementThe-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic management
 
Unveiling the Secrets How Does Generative AI Work.pdf
Unveiling the Secrets How Does Generative AI Work.pdfUnveiling the Secrets How Does Generative AI Work.pdf
Unveiling the Secrets How Does Generative AI Work.pdf
 
Memorandum Of Association Constitution of Company.ppt
Memorandum Of Association Constitution of Company.pptMemorandum Of Association Constitution of Company.ppt
Memorandum Of Association Constitution of Company.ppt
 
Enterprise Excellence is Inclusive Excellence.pdf
Enterprise Excellence is Inclusive Excellence.pdfEnterprise Excellence is Inclusive Excellence.pdf
Enterprise Excellence is Inclusive Excellence.pdf
 
Premium MEAN Stack Development Solutions for Modern Businesses
Premium MEAN Stack Development Solutions for Modern BusinessesPremium MEAN Stack Development Solutions for Modern Businesses
Premium MEAN Stack Development Solutions for Modern Businesses
 
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
 
LA HUG - Video Testimonials with Chynna Morgan - June 2024
LA HUG - Video Testimonials with Chynna Morgan - June 2024LA HUG - Video Testimonials with Chynna Morgan - June 2024
LA HUG - Video Testimonials with Chynna Morgan - June 2024
 
ENTREPRENEURSHIP TRAINING.ppt for graduating class (1).ppt
ENTREPRENEURSHIP TRAINING.ppt for graduating class (1).pptENTREPRENEURSHIP TRAINING.ppt for graduating class (1).ppt
ENTREPRENEURSHIP TRAINING.ppt for graduating class (1).ppt
 
20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf
 
Putting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptxPutting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptx
 
5 Things You Need To Know Before Hiring a Videographer
5 Things You Need To Know Before Hiring a Videographer5 Things You Need To Know Before Hiring a Videographer
5 Things You Need To Know Before Hiring a Videographer
 
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
 
ikea_woodgreen_petscharity_cat-alogue_digital.pdf
ikea_woodgreen_petscharity_cat-alogue_digital.pdfikea_woodgreen_petscharity_cat-alogue_digital.pdf
ikea_woodgreen_petscharity_cat-alogue_digital.pdf
 
VAT Registration Outlined In UAE: Benefits and Requirements
VAT Registration Outlined In UAE: Benefits and RequirementsVAT Registration Outlined In UAE: Benefits and Requirements
VAT Registration Outlined In UAE: Benefits and Requirements
 
falcon-invoice-discounting-a-premier-platform-for-investors-in-india
falcon-invoice-discounting-a-premier-platform-for-investors-in-indiafalcon-invoice-discounting-a-premier-platform-for-investors-in-india
falcon-invoice-discounting-a-premier-platform-for-investors-in-india
 
What are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdfWhat are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdf
 
Discover the innovative and creative projects that highlight my journey throu...
Discover the innovative and creative projects that highlight my journey throu...Discover the innovative and creative projects that highlight my journey throu...
Discover the innovative and creative projects that highlight my journey throu...
 
What is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdfWhat is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdf
 
Sustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & EconomySustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & Economy
 

Quantifying Cyber Risk, Insurance and The Value of Personal Data

  • 2. Who Are We and Why Are We Here? Steven Schwartz • TheCyberSteve • CEO of Global Cyber Consultants • Founding Board Member of Personal Data Trade Association • Co-Founder & Vice-Chairman of Clean Data Institute Harumi Urata-Thompson • The Michelin 3-Star #FinChef • Executive and Strategic Advisor • President and Founding Board Member of Personal Data Trade Association
  • 3. Where to Start First we need to acknowledge that we are accelerating into this era of data proliferation changing not only how we evaluate business risk, but the nature of the business’ operations as well 1 Almost every company is shifting towards becoming a “data” company whether they are collecting data, storing data, transacting data, analyzing data, monetizing, etc 2
  • 4. How Does This Translate to Cybersecurity? Two Fold – for one, cybersecurity is now and will increasingly be a critical foundation. Trust is the new currency A company’s objective should be to increase the business’ trust & confidence in data and quality of analytic insights that come from it. Secondarily and really where the dynamic is changing, is that cybersecurity is no longer just another cost center item on your balance sheet. It’s no longer something to be done just for compliance. Evaluating cyber risk is a data driven exercise that is encapsulated within you’re overall business strategy.
  • 5. Requirement Impact & Potential Consequence Methods of Control Confidentiality – Protection of Information from Unauthorized Exposure - Disclosure of information governed by privacy laws - Loss of Intellectual Property - Reputational Damage - Legal repercussions - Access Controls - File Permissions - Encryption Integrity – Accuracy and Completeness of Information - Fraud - Inaccurateness - Erroneous Decisions - Access Controls - Logging - Digital Signatures - Hashes - Encryption Availability – The ability to access information and resources - Loss of Functionality - Loss of Productivity - Interference with Enterprise Objectives - Redundancy - Backups - Access Controls Is there a Critical Foundation within Data & Cyber Security?
  • 7. So Where Do We Start in Quantifying the Risk? First we need to acknowledge that cyber risk is business risk and must speak the same language The quality of the data will drive the overall effectiveness of your security program. No Assumptions!
  • 8. How do we Define or Decompose Risks as it Relates to Cybersecurity? • Let’s define Risk as the the probable magnitude of future loss (an undertain event). • Terminology and classification is critical in translating the conversation towards business strategy
  • 9. Which of the Following Are Risks? • Disgruntled Insiders? • Internet facing web servers? • Untested Recovery processes? • Sensitive Customer Information? • Weak Passwords? • Cyber criminals?
  • 10. None of Them Are… • They are all part of the risk landscape… • Disgruntled Insiders = Threat Community • Internet facing web servers = Asset • Untested Recovery processes = Deficient Control • Sensitive Customer Information? = Asset • Weak Passwords? = Deficient Control • Cyber criminals? = Threat Community
  • 11. How Do We Start to Quantify Cyber Risk? Loss Event Frequency RISK Loss Event Magnitude Examples of Loss Events: • A data center outage due to extreme weather • A corrupted database • An employee stealing intellectual property • A hacker stealing sensitive customer information Develop a Loss Flow • Threat Agent • Asset • Stakeholder • Primary • Secondary
  • 13. 1. Asset at risk 1. Personal Information 2. Operating System 3. Applications 2. Threat Actors 3. Threat Effect: Confidentiality, Integrity, Availability Building a Cyber Risk Scenario
  • 14. Where Does Insurance Come into Play Running through these scenarios moves from tactical to strategic, evaluating multiple scenarios to provide a probabilistic view of enterprise risk. Now that we’ve identified our risk and mitigation controls, let’s assess how much risk we want/need to transfer When you understand the assets at risk, the threats and the control mechanisms in place to prevent, you can understand how much risk is mitigated Then it’s a strategic decision on how much risk you want to transfer
  • 15. Cyber Insurance is “Your Last Line of Defense” when Technology Fails A Cyberattack can burden your company with substantial time and costs that can put YOU out of BUSINESS if YOU’RE NOT PROTECTED. Cyber Insurance covers a business’s liability for a data breach in which their customer’s information (PII, Tax Info, Health Info, etc.….) is exposed or stolen by a criminal or someone with unauthorized use who has gained access to the company’s network. Crisis Management Costs Notification Costs Business Interruption Costs Regulatory Fines and Penalties Legal Liability Reputational Damage Why Do You Need Cyber Insurance?
  • 16. What Does Cyber Insurance Coverage?
  • 17. What Does Cyber Insurance Coverage?
  • 18. Company # of Records Breached Costs Insurance Root Cause of the Breach Notes 130 Million $140M to Date $30M SQL Injection code that allowed Hackers into each their systems for 6 months Stock fell by 80%, resulting in Shareholder Suits 110 Million $252M $90M Malware was introduced by a much smaller corporate partner 46% drop in sales in the quarter that the breach hit 70 Class Action Lawsuits 4 Shareholder Derivative Demands 94 Million Approx. $1.6B No Evidence Hackers broke into their wireless network and stole the records in the 2nd half of 2005 and throughout 2006 25 Class Action lawsuits following the breach settlements TJ Maxx paid out several hundred million dollars So How much do these Data Breaches Cost?
  • 19. Company # of Records Breached Costs Insurance Root Cause of the Breach Notes 2.6 TB of Data; 11.5M Confidential Documents; 4.8M Emails; 214K Offshore Entities TBD – Possible most in Direct Losses Loss of Reputation NA Outdated firewalls, antivirus, password protection, encryption Outside hacker Offshore Holdings of 12 world leaders, 140 Political Leaders and 29 Forbes-listed Billionaires 78.8 Million $142m to Date NA State-Nation Cyber Attack, executing a sophisticated attack to gain unauthorized access Post-Breach, Anthem spent $65M in Cybersecurity Enhancements in both 2015 and 2016 83 Million Estimates $1 Billion NA Employee's Personal Computer was injected with malware that stole login credential IT Spending expected to increase additional $250M Both this year and next year So How much do these Data Breaches Cost?