© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
© 2011. Copyright GuardTime. All Rights Reserved.
Data Authentication and Cyber Liability in a Networked World
Chris Venvell, Business Development Director – Insurance, Guardtime
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
2
Enhanced Trust and Data Integrity For InsuranceBusinesses Rely on Trustworthy Information Insurance industry data is arguably its greatest asset. Insurance data by nature can reside in multiple locations How can insurance players know data is authentic and intact. Regulatory policy and industry standards dictate the process Data can be called upon for evidence many years from now Content received must have come from the entity that sent it Data must withstand organizational and operational changes Insurance is a social business • Insurance is the industry of risk• It protects people and companies • Data privacy, transparency and integrity are key • Regulators are there to firstly protect the policyholder
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Protecting Your Intellectual Property
Your IP is your most important asset - once it's gone you can’t get it back
Companies are facing a constantly changing landscape (with regards to addressing cybersecurity issues), which includes: executive orders and legislation; evolving regulatory requirements; increases in penalties and fines; and, liability from class action lawsuits (USA but now globally)
In order to minimize risk, it’s important to keep abreast of changing requirements as they are being proposed so that you have the opportunity to affect the process
Companies are engaging internal IP lawyers for example
3
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Setting the Scene
As cyber attacks resulting in data breaches are often targeted at high profile companies and data networks , it increases the need for cyber liability insurance protection and the subsequent warranties and prevention programs. The effect on assets and
bottom line can be severe. 4
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Recent Surveys on Cyber Liability • CEO’s had Cyber Risk and E&O Risk at the top • Brokers did not have cyber risk at the top • 80% of survey said they were not keeping pace• 75% said legal compliance was driving adoption• 69% concerned on reputational risk than financial • 82% believe hackers are the primary cause but
71% also believe human error is major factor5
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Lloyds of London – Cyber Liability
r
Lloyds of London, AIG and large brokers lead the drive for new insurance products in cyber for Europe and USA, soon to spread to the rest of the world. To get insurance cover for data breach companies will have to prove that overall security and operational risk management have been improved
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
7
Problem: How to Validate Electronic Data?Inside the organization: validation based on procedure and trusted insiders
Most data needs to be taken at face valuePhishing, malware, electronic fraudWith emergence of Cloud computing outsiders become insiders as
perimeter is gone and as data leaves the perimeter the proof stays behind.
Outside the organization: minimal validation
Explosion in cyber-espionage and enterprise data tamperingCyber attackers increasingly good at hiding their tracksOver 70% of fraud is conducted by insiders Management, regulators, auditors, courts have no transparency
Over USD 60 Billion in 2011 in cyber security equipment, software and servicesOver USD 100 Billion in 2011 in shifting physical paper around the world
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Seismic Blue Shift in Risk
Risk management is about managing or minimizing the exposures to loss. Developing and incorporating policies and procedures is as important in the Cyber
Liability arena as it is in the property and casualty arena!
“As operational and security risk change, a broader gap between the protection of risk and the reality of risk is being created.”
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Organised Hacking
100 + Countries with dedicated cyber attack capabilities Main source of revenue for Eastern Bloc gangsRussian and Sicilian mafias actively recruiting “hacking” experts
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Catastrophe Data
10
The need for catastrophe modeling of risk is increasing due to rising catastrophes, climate changes and higher penetration of insured people in urban areas. As this data is used for solvency and pricing purposes it is essential to make sure this data is not tampered with or altered from the original sources of data.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
The Last Mile Problem In The Cloud
“Why should I trust you with my data?”
Cyber criminals will erase their digital tracksAdmins can cover up accidents and misbehaviorApplications can be changed or compromisedData is inherently at risk as it stored and shared
11
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Cyber Liability Risks
CYBER CRIME
Data Theft
Extortion
Network Damage
Electronic Theft
Denial of Service
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Impact of Cyber Risk
Operations
Litigation and
Regulatory Exposures
Financial
Brand Equity
Assets
Your Company
• Reputational Risk• Breaches by cloud providers• Breaches in off site storage• Aggregation of exposure of all cloud risks
correlated together • Breaches of an individual customer• Cyber crime breaches of digital assets• Business interruption and loss of revenue• Supply chain and industrial clusters.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Potential Cyber Crime ScenarioDuring his lunch break, an employee opens an “Important Security Update” supposedly from your IT department.
The email contains malicious code designed to discreetly take control of the employee’s desktop.
A remote attacker leverages the desktop to launch subsequent attacks on your backend network.
The attacker gains access to systems with increasing levels of security – eventually compromising a customer database.
Your CEO then receives an email containing the names, addresses and social security numbers of 5,000 of your customers.
The hacker will publish the email on an Internet bulletin board unless he is paid $250,000
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Property and Crime Policies generally:
Respond only to loss of or damage to tangible property;
Exclude indirect or consequential loss Liability Insurance Policies
generally: Respond only to loss from defined
professional services or defined acts or offenses;
Exclude Loss from violations of privacyThe Short Answer is “NO”.
Won’t My Insurance Cover That Cyber Liability?
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Covers liability for monetary damages sustained by a person arising from the actual or potential unauthorized access to that person’s personal information. Includes mental anguish & emotional distress.
E-Business Income Loss Cyber Extortion Expense E-Vandalism Expense Violation of Privacy Notification Expense Covers unauthorized access by employees
Cyber Insurance Policy Features
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Security – Risk Management Identify information assets Conduct periodic risk assessments to identify the specific
vulnerabilities your company faces Develop and implement a security program to manage and
control the risks identified Monitor and test the program to ensure that it is effective Continually review and adjust the program in light of ongoing
changes Oversee third party service provider arrangements Maintain training for all staff on Information Security
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Why Would a Customer Sue a Company?
An Error or Omission (London market slip or equivalent)
Intellectual Property (copyright/trademarks)
Breach of contract (for professional services i.e. website design)
Failure to render professional services (invasion of privacy, liable/slander)
Breach of security (hackers, virus)
Misrepresentation
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Adaption to Cyber Liability
Privacy Policy Breaches and Data Mismanagement
Establish a privacy policy and post it on your homepage of your website and adhere to the promises your privacy statement makes by day to day compliance.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Maintaining Customer Trust
More and more, companies customize products, services, and technology to address individual customers’ needs; so, they collect personal information
Privacy practices should include: assessments of current protection practices, analysis and incorporation of relevant privacy/security laws, employee training, and periodic monitoring
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Creation of Standards for Mitigation
There are no absolute industry standards for due care as relates to security right now
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Security Breach Incident Response
Insurance Broker Client service offering providing guidance in setting up a risk management plan and process to address data breaches including:• Process guidelines• Content and scope of plan• Workshops and meetings to assist client team• Provide Competitive Edge • Outside resources (legal, forensics, credit protection resources, etc.)Technology must exist that informs management immediately of breach otherwise insurance cover may not be intact and long term effect of tampering is serious in terms of recovery from attack. Also notification is becoming law.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
23
CoverBenefits
Privacy/ Security Regulation. Aggregate sub limits.
.
Notification/Crisis Management: Aggregate sub-limits.
Cyber Liability Coverages
Defense costs, civil fines and penalties, regulatory issues.
Mailing costs, credit issues, identity theft, computer forensics, outside PR and legal advice, professional call centre, credit card issues.
Civil Liability Defense costs, class actions and plaintiff issues.
.
World Wide Coverage
CYBER LIABILITY INSURANCE CONTENT
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
© Copyright Allianz SE, May 2010 24
CoverBenefits
Reputational Harm from Data Breach
.
Electronic Information Assets Tampering.Direct Non Physical Damage to NetworkContingent Business Interruption
Cyber Liability Coverages
Corruption, deletion, operational mistakes.
Viruses, terrorism, denial of service and operational mistakes including London Line Slip
Counterparty Risk and offshoring extra expense
Cyber Extortion
.
Monoline, Included or Additional Coverages
FIRST PARTY DATA AND NETWORK RISKS
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
S:/UNI
T50/UNI
T FILES/SE
MINARS/2
008/FEB 200
8 CYBE
R/RETAILINDU
STRYC
YBERupdated.PPT
Underwriting Process – Submission
Customer Contacts Broker for Cyber Liability CoverageSupporting documents – Broker sends risk assessment IT security questionnaire to customer. This includes warranty on data integrity. Broker passes specifications and coverage requests to panel of insurers. Underwriters (and perhaps their IT security consultant) request a security conference call with the IT security officer of the applicant to discuss controls in more detail prior to binding and this may include a visit for more complex accounts to provide more comprehensive overview of operations, controls, and coverage requirements.Technology that provides a “lie detector” for data in the cloud will be the warranty and liability protection for the present and future.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Trust via PKI (Public Key Infrastructure)PKI has two primary applications
Encryptionprivacy of information
Proof digital signatures
digital timestamps
26
Key-based solutions are too intrusive for our enterprise clients.
Carlos Domingo, CEO, Telefonica R&D
As a mechanism for delivering proof it has been a complete failure
It is expensive, cumbersome, and does not scaleStill requires trust (someone has to manage the keys)Not appropriate in the cloud: keys reside in memory
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Converting Trust To Proof
GuardTime maintains a global infrastructure delivering Keyless Signatures which provide proof of time, origin and integrity for all the world’s electronic data, whether on disk, in transit or in the cloud.
27
By allowing an independent audit of data and activity in a cloud environment GuardTime’s technology will be a key element in accelerating enterprise adoption of cloud computing.
Yvon Le Renard, Head of Strategic Alliances, Alcatel Lucent
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Technology: The keyless signature KSI
28
HASH VALUE
TIME
ORIGIN
The time of signatureThe origin of the signing requestNot a single bit has changed
Proves:
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Validation relies only on mathematics
29
Simple and lightweightSignature never expiresCan be used repeatedly by multiple partiesRelies only on mathematicsNo exposure to GuardTime or any third party
=+
Features:
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Background | What it really means
trust in people vs. mathematical proof
Keyless signatures remove the need to rely on any human being for evaluating the authenticity of electronic documents and data.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Keyless Signature Applications At Glance
1. Cloud Infrastructure 2. Documents & Archiving
3. Messaging & Mobile 4. Cyber Security
Keyless Signature
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Technology | Keyless Signature Infrastructure (KSI)
Features:
Core cluster distributed between Europe, North America and Asia
264 requests / second
Fixed core network load
No single point of failure
Ultra high availability (99.999%)
Stateless (nothing to hack)
Certified and EU-accredited service infrastructure
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Technology | KSI Partnerships
Guardtime partners operate a client facing part of the Keyless Signature Infrastructure (KSI) with potentially exclusive rights:
by geography
by vertical
by specific clients
China Telecom (China)Hutchison Telecom (Hong Kong)Bharti (India)Trust Technologies (Philippines)
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
© 2011. Copyright GuardTime. All Rights Reserved.
Sample Case Studies
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Case Study: Maritime Industry Agency - Philippines
35
Problem:It is difficult to enable rapid and consistent verification of physical document authenticity in the field and restrain document fraud.
Solution:Guardtime’s QRSealer provides officials an easy, portable and consistent way to compare the physical document with a securely stored image of the same document to spot any tampering or fraud immediately.
????IS IT REAL OR FAKE?
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
How QRSealer Works
36
Issuing Physical Documents
• Create a digital image of the physical document: scan or select a digital file from the computer
• Upload the digital image of the document to the QRSealer service to secure it
• Print the received QR-code with a label printer and attach it to the physical document
Verifying Physical Documents
• Point the smartphone camera to the QR-code to view the secure digital image of the document
• Compare the secure digital image with the physical document
Secure Cloud Infrastructure
2.
4.
3.
1.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Documents & Archiving | Philippines Land Title Registry
Client:Philippines State23 million land title documents18+ million digitized, ongoing…
Summary:
Land Title Registry needed to be able to prove that its digitized and archived electronic Land Title documents are authentic and not tampered with since their creation and the evidence needed to be portable and transparent to all users
Land Title Registry
Public Services
AsiaService Provider
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Documents & Archiving ACORD Documents
Recipient drops a received document to a webpage to authenticate
Document Verification
Document Verification
ACORD signs documents with simple desktop application
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
3. Messaging & Mobile | Certified Email
SMTP Verification
Forward received email to a Verification Agent to validate email integrity
AsiaService Provider
Validation report is automatically received by emailalong with a link to online copy
of the certified Email
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Messaging & Mobile | Secure “Dropbox”
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
3. Messaging & Mobile | Certified SMS
SMS GW Verification
Forward received SMS to a Verification Agent to validate SMS integrity
AsiaService Provider
Validation report is automatically received by SMSalong with a link to online copy
of the certified SMS
Huge Benefits for Microinsurance
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Cybersecurity | Event Level Data Integrity
Each record issigned by keyless
signature
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Cybersecurity Financial Services Transaction Logs
Summary:
Every ATM transaction, every internet banking transaction, every single mobile payment comes with a keyless signature preventing insider fraud and increasing transparency.
In 2011 SWIFT selected Guardtime as the world’s most innovative startup in banking and finance based on our insider fraud solution.
With Guardtime UBS rogue trader Kweku Adoboli could not have committed his fraud.
Log Archive
Central Log Server
POTENTIAL CHANGES TO POLICY WORDING
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Cybersecurity | Connected Car
authorities
Telematics Server
AsiaService Provider Summary:
Live in production for Tokyo emergency services and under development in China with China Telecom.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
X-Ray Outsourcing and Telemedicine
Outsourcing Market Medical Insurance FraudKSI Stamping of X-Ray
45
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
© 2011. Copyright GuardTime. All Rights Reserved.
About GuardTime
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
47
GuardTime: Born in Estonia/Partner in PhilippinesMost wired country on Earth with 98% of transactions conducted onlineHome of Skype and NATO Cybersecurity HQ
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
Summary PointsIdentifying, preventing, mitigating and transferring privacy/security is a major priority, particularly in high compliance industries (such as utilities, finance etc.), any company that accepts a debit or credit card as a form of payment, and public traded companies.
Outsourcing and offshoring is a fact of life, but definitely increases data protection risks. Vendor management process is needed which includes due diligence, contract protections, and vendor insurance requirements.
This is a risk of survivability, not invincibility. Develop a team and plan for a data breach incident response, just like your contingency plans for other threats.
Client should consider insurance protection, either on a combination with professional liability coverage or stand-alone coverage. Insurance is not a substitute for best security practices, but deals with the potential severity risk you cannot prevent.
Quality of coverage and management of claims very important, as well as experience of the underwriter; be a thoughtful buyer.
© 2
011.
Cop
yrig
ht G
uard
Tim
e. A
ll Ri
ghts
Res
erve
d.
© 2011. Copyright GuardTime. All Rights Reserved.
Data Authentication and Cyber Liability in a Networked World
THANK YOU - [email protected]