Data Security &
Beazley
Breach
Response
Beazley
presentation
master
February 2008
Max Perkins
October 4, 2013
Agenda
• A Brief Review of Data Breaches
• What is Beazley Breach Response?
• Beazley Breach Response Timeline
• Questions?
• Appendix
2
A Brief Review of Data
Breaches
What is a Data Breach?
• Actual release or disclosure of information to an unauthorized individual/entity that
relates to a person and that:
o May cause the person inconvenience or harm (financial/reputational)
 Personally Identifiable Information (PII)
 Protected Healthcare Information (PHI)
o May cause your company inconvenience or harm (financial/reputational)
 Customer Data, Applicant Data
 Current/Former Employee Data, Applicant Data
 Corporate Information/Intellectual Property
4
Types of Data Security Breaches
• Improper Disposal of Data
o Paper
 Un-shredded Documents
 File cabinets without checking for contents
o Electronic assets
 computers, smart phones, backup tapes, hard drives, servers, copiers, fax
machines, scanners, printers
• Phishing/Spear Phishing Attacks
• Network Intrusions/Hacks/Malware Viruses
• Lost/Missing/Stolen Electronic Assets
• Mishaps due to Broken Business Practices
• Rogue Employees
5
What Kinds of Information are at Risk?
Consumer Information
• Credit Cards, Debit Cards, and other payment information
• Social Security Numbers, ITIN’s, and other taxpayer records
• Customer Transaction Information, like order history, account numbers, etc.
• Protected Healthcare Information (PHI), including medical records, test results, appointment history
• Personally Identifiable Information (PII), like Drivers License and Passport details
• Financial information, like account balances, loan history, and credit reports
• Non-PII, like email addresses, phone lists, and home address that may not be independently sensitive, but may be more
sensitive with one or more of the above
Employee Information
• Employers have at least some of the above information on all of their employees
Business Partners
• Vendors and business partners may provide some of the above information, particularly for Sub-contractors and
Independent Contractors
• All of the above types of information may also be received from commercial clients as a part of commercial transactions or
services
• In addition, B2B exposures like projections, forecasts, M&A activity, and trade secrets
Many people think that without credit cards or PHI, they don’t have a data breach risk. But can you think of any
business without any of the above kinds of information?
6
A Simplified View of a Data Breach
Discovery of a Data
Breach
Evaluation of
the Data
Breach
Managing the
Short-Term
Crisis
Handling the
Long-Term
Consequences
Class-Action
Lawsuits
Theft, loss, or Unauthorized
Disclosure of Personally
Identifiable Non-Public
Information or Third Party
Corporate Information that
is in the care, custody or
control of the Insured
Organization, or a third
party for whom the Insured
Organization is legally liable
Notification and
Credit/Identity File
Monitoring
Forensic
Investigation and
Legal Review
Regulatory Fines,
Penalties, and
Consumer Redress
Reputational
Damage
Public Relations
Income Loss
7
What is Beazley Breach
Response for the
Commonwealth of Virginia?
Beazley Breach Response is more than an insurance policy
Network / Data Liability
•
Based on current, state-of-the-art Beazley
Information Security & Privacy Insurance
•
Breach Response
Notification/Credit or Identity Monitoring
indemnification is replaced with Privacy
Breach Response Services
•
Services
Integrated Breach-Handling Services using
top industry experts and vendors
•
Privacy Breach Response insurance has a
limit of coverage that is separate from and
in addition to the third party limit of
liability
•
A comprehensive solution to the risks of
security breaches, data loss and
unauthorized disclosures
•
A unique insurance product tailored to the
needs of data owners, including higher
education, healthcare, retail and other
consumer-facing organizations
Insurance
+
_____________________
Beazley Breach Response
Beazley Breach Response
• Insuring Agreement A
o Information Security and Privacy
1. theft, loss or unauthorized disclosure of personally
identifiable non-public information or third party corporate
information
2. failure of computer security to prevent a security breach
3. failure to timely disclose a breach
4. failure to comply with privacy policy
10
• Insuring Agreement B
o Breach Response Services
1. Computer forensics to determine existence and cause of breach.
Includes costs of a PCI Forensic Investigator, when applicable to the
suspected incident
2. Legal fees to determine the applicability of and actions necessary to
comply with breach notice laws or in responding to credit card system
operating regulation requirements (PCI)
3. To provide notification to individuals required to be notified under a
breach notice law or if a potential risk of financial, reputational, or other
harm exists to the individuals
4. Call center services to the notified individuals
5. One year credit or identity file monitoring and reasonable third party
admin costs associated with program
6. Access to educational and loss control information
11
• Insuring Agreement C
o Regulatory Defense and Penalties
• Claims expenses and penalties insured is obligated to pay because
of a claim in the form of regulatory proceedings – (HIPAA, HiTech)
• Insuring Agreement D
o Crisis Management and Public Relations
• Public relations and Crisis Management Expenses incurred as a
result of a the publication or imminent publication in a newspaper,
radio or television broadcast of a covered Claim under the policy.
• Insuring Agreement E
o PCI Fines and Costs
• Indemnity coverage of PCI Fines and Costs (Defined Term)
12
What Else Makes Beazley Breach Response Different?
Beazley Breach Response:
• Pre-Breach Education and Services
• Dedicated Breach Response Services team: breaches are very different from liability
claims
• Hand-picked vendors: expertise makes a big difference for breach outcome, higher
education organizations are note expected to have the in-house expertise to respond
to a breach
• Beazley insureds are encouraged to activate services when they think have a breach,
because little breaches can turn into big problems if they aren’t handled properly
• It only takes one phone call or email (bbr.claims@beazley.com) to activate services
Pre-Breach Response Services
• Policy Holder Services from ePlace Solutions, Inc. through nodatabreach.com to provide
Data Security Risk Management services such as:
o Training and Awareness programs
o Animated Staff training Programs
o HIPAA Compliance Tools
o On-Line Compliance Materials – quick tips, links to statutes and regulations updates
o Expert Support from consultants and attorneys on data security issues including
 Healthcare & HIPAA compliance issues
 Contractual Considerations
 Data Breach Prevention Issues
 Data Security Best Practices and Corporate Policies
 Computer Forensic Issues
 Data Breach Prevention Guidance
14
Pre-Breach Response Services Continued
• Alex Ricardo - Breach Response Services - Broker/Client Outreach
Specialty Lines
• Alex joined Beazley in April 2011
• Graduated from Stevens Institute of Technology, BE Engineering
• Worked in privacy sector for 15 years
• Certified Information Privacy Professional (CIPP/US)
• Based in Beazley's New York City office.
• He is responsible for assuring BBR Insureds take full advantage of the professional
services made available to them to reduce their risk & liability profile prior to or in the
event of a privacy breach incident.
15
Post Breach Response Services
• Dedicated Internal Breach Response Services Focus Group lead by Katherine Keefe, Esq.
o 25 years practicing lawyer with extensive experience in data privacy and security
issues and related regulatory matters.
o Team responsible for providing breach response services to policyholders
immediately following the report of a suspected data breach
o Development of Beazley’s risk management services designed to minimize the
occurrence and impacts of data breaches.
o Client Advocacy during breach that is separate from claims staff handling regulatory
and liability matters
16
Beazley Breach Response
Timeline
Questions?
Appendix
• Best Practices – Breach Preparedness & Prevention
• Best Practices – Breach Response Management
Best Practices – Breach Preparedness and Prevention
• Encryption of Portable Devices
• PCI-DSS Compliance
• Data Segregation
• Data Mapping
• Log Files
• Data Loss Prevention (DLP)
22
Best Practices – Breach Preparedness and Prevention
• Background Screening Program
• Pre-Arrange Breach Response Services
• e-Learning Initiative
• Written Data Breach Incident Response Plan
• Tabletop Exercises
• Legislative updates
23
Best Practices – Breach Response Management
• Retain Outside Counsel
• “Notify Correctly vs.. Quickly”
• Outside Call Center When Appropriate
• Reputational Risk Advisor When Appropriate
• Investigate – Investigate – Investigate
• Leverage External Resources – Privacy Counsel, Forensics
24
Max Perkins
Underwriter; Specialty Lines
Beazley
Two Liberty Place
t: +1 (215) 446 8446
th
50 S. 16 Street, Suite 2700 c: +1 (336) 549 9999
Philadelphia, PA 19102
e: max.perkins@beazley.com
For More Information:
www.beazley.com
The descriptions contained in this broker communication are for preliminary informational purposes only. The product is available on an admitted
basis in some but not all US jurisdictions through Beazley Insurance Company, Inc., and is available on a surplus lines basis through licensed
surplus lines brokers underwritten by Beazley syndicates at Lloyd's. The exact coverage afforded by the product described herein is subject to and
governed by the terms and conditions of each policy issued. The publication and delivery of the information contained herein is not intended as a
solicitation for the purchase of insurance on any US risk. Beazley USA Services, Inc. is licensed and regulated by insurance regulatory authorities
in the respective states of the US and transacts business in the State of California as Beazley Insurance Services (License#: 0G55497).