[BreachExchange] Cybercrime Is A Growing Threat To All Employers

[Audrey McNeil]

https://www.cybersecurityintelligence.com/blog/cybercrime-is-a-growing-
threat-to-all-employers-2351.html

There has been a significant upward tren reported in inquiries about data
breach and other cyber-threats from all types of business this year and the
subject area is a complex mix of technical and legal issues and it touches
nearly every aspect of the current business environment.

Moreover, the costs to companies that are the victims of cybercrime and
data breach are significant and, unfortunately, it is no longer uncommon
for the costs to bankrupt small and medium-sized businesses within a short
time after the breach is discovered.

Types of Cyber-Crime incidents

Data breach and other cyber-threats come from all quarters and they affect
individuals and organisations of all sizes.

Given the recent news about the Central Intelligence Agency and the
National Security Agency being the subject of now infamous data thefts,
including the CIA losing control of its own toolbox of hacking tricks, many
employers are likely to think that there is little that can be done when
the government agencies tasked to defend our country’s cyber-security and
armed with a government-sized budget have proven vulnerable.

But the size and scope of cyber-threats are not exaggerated and require
vigilance and defenses regardless of your organisation’s size.

So-called “Black Hat” hackers and cyber-criminals are after all types of
information that are useful to further a hacking scheme or that can be
monetized easily and anonymously, making it an attractive crime.

Phishing attacks, which prey on human psychology, are attempts to get a
victim unwittingly to click on a link in an email or otherwise provide
information that can be used to unleash malware in an organisation’s
network or to provide an entryway for theft of critical or confidential
information.

Ransomware attacks steal access to business data by encrypting the content
of company-owned devices preventing users from accessing it until a ransom
is paid. The advent of Bitcoin and other cyber-currencies, which allow for
anonymous transactions over the Internet, have only emboldened ransomware
schemes by making them very difficult to trace.

Both types of attacks are designed to exploit weaknesses in human
psychology more than technical weaknesses in software or hardware. Simple
theft or loss also can be a source of data breach. Employees now carry
around huge troves of business data in their mobile phones, laptops, and
other devices. The theft of a mobile phone or the loss of a laptop by
leaving it behind at airport security can be an event that causes all kinds
of headaches for an employer.

Data breach incidents have a panoply of repercussions for businesses that
suffer them. Not only is there the threat of liability for the damage, but
also the reputational harm with client relationships and in the
marketplace. Retailer Target Corporation, which was the subject of a 2013
data breach, reported $61 million in losses from the breach and received
only $44 million in insurance coverage for the fourth quarter of 2013, when
the breach was announced.

Those figures do not include the costs of litigation, fraud claims, and
investigation expenses that Target continued to incur well after the breach
was announced. In 2015, Target paid a settlement of approximately $10
million to settle a class action suit by consumers affected by the data
breach. And the data does not include the lost sales that may have been
attributable to the lost confidence in Target’s security.

What information do you have that you need to protect?

Even organisations that are not specifically tasked with handling or
protecting sensitive data should carefully consider what kinds of
information they possess that requires protection and where it is located.

A firm does not need to be a financial services company or a healthcare
provider to have sensitive data that may subject it to legal liability if
the information is lost or compromised through a data breach incident.

Small businesses of all types will have personnel information about their
employees, customer lists, and other intellectual property that should be
kept from prying eyes either because it is personal information or it
contains the trade secrets for the business.

Employee and benefits files with information about payroll, tax
withholding, insurance, and retirement plans likely will contain personal
identifying information that is subject to, federal and state law governing
protection of data, such as social security numbers, bank account numbers,
and dates of birth. The electronic payment systems at retailers large and
small can be an avenue for stealing the credit card numbers of customers.

Employers also need to think about where their data is located and how it
moves around. Company data is not just on company personal computers and
servers. It now moves around on a wide variety of devices and storage
locations.

Mobile phones, tablets, and laptops all carry company data and files and
travel with your employees. Cloud-based services also may hold data. And
employees may use their own devices or download company files to their home
computers and networks or use their own cloud-service providers such as
DropBox, Google Drive, or iCloud. Some of this data may even be replicated
or stored in unforeseen ways by data backup systems that move data to other
storage formats or locations.

Moreover, most businesses rely on many vendors that provide services for
which confidential information needs to be passed back and forth and that
transmission can be a weak spot that is susceptible to exploitation.

Examples of these vendors are banks, payroll processing companies,
accountants, bookkeepers, lawyers, IT consultants, or any Internet-services
vendors, such as an Internet service provider or a cloud-based software
provider.

What are an employers’ responsibilities and potential liabilities around
data breach?

Courts and government agencies are constantly evolving their approach to
cybercrime and data breach issues. The Federal Trade Commission has taken
the lead for the federal government as the enforcement agency for data
breach and cybercrime incidents.

A 2015 decision from the US Court of Appeals for the Third Circuit affirmed
the FTC’s authority to regulate cybersecurity under its authority to
regulate “unfair or deceptive acts or practices in or affecting commerce.”

The case involved the Wyndham Hotels and Reports where hackers had
successfully accessed Wyndham’s computer systems and stolen personal and
financial information of consumers leading to over $10 million in
fraudulent credit card charges. The court concluded that the FTC has a
broad mandate to hold businesses accountable for not adhering to
cybersecurity practices that unreasonably expose personal data to
unauthorised access and theft.

The FTC does not limit its enforcement to large hotel chains. From 2013
through the present, it has pursued LabMD, Inc., a small medical testing
laboratory in Georgia that exposed the medical information of approximately
10,000 consumers to a peer-to-peer file sharing network called Limewire
that had been set up by an employee on a billing department computer. As a
result, LabMD’s billing files were exposed to the entire peer-to-peer
network.

Files from the company were later discovered in California during a
criminal investigation. The FTC’s order faulted LabMD for failure to
protect its computer network or employ adequate risk assessment tools,
failure to provide data security training to its employees, and failure to
adequately restrict and monitor computer practices of individuals using its
network. LabMD began to wind down its operations in 2014, largely due the
fallout from the data beach and FTC enforcement action.

In a more salacious case, the FTC and 13 states and the District of
Columbia recently settled with Ruby Corporation, the firm that ran the
infamous Ashley Madison site for matching people looking to have
extramarital affairs. Millions of subscribers to the site had their usage
exposed when hackers attacked the site.

Ashley Madison had sold a service for an extra fee that purportedly removed
all traces of a user’s usage of the site. But the data was retained and
exposed in the hacking incident. The firm settled for $17.5 million, but
was only able to pay $1.66 million.

State attorneys general also are taking up the mantel for protection of
employees and consumers within their jurisdictions. State statutes
requiring notification of employees or consumers in the event of a data
breach are now on the books in 47 states and the District of Columbia.

These statutes have provisions for the timing and content of a notice of
data breach that vary from state to state. Employers faced with a data
breach situation involving employee or consumer data may have both a notice
obligation to the employees or consumers and an obligation to notify the
state attorney general’s office of the breach.

Such notice brings with it reputational risks and the attention of law
enforcement agencies. In February 2017, Boeing Corporation notified the
Attorney General in Washington that personal information, including birth
dates and social security numbers for 36,000 employees, was sent to the
spouse of an employee who wanted help with formatting a spreadsheet.

While cyber-crime and data breach are relatively new subjects for courts,
old legal doctrines, such as breach of fiduciary duty and negligence can be
used to assign liability to employers or other parties.

Companies may also face contractual liability to their clients or customers
if their contracts include indemnification provisions for damage or have
other contractual requirements that are breached through a cyber-crime
incident. And the possibility of trebled damages exists if employers are
found to have breached unfair trade practices statutes.

Defenses and other protection

Employers should think about their defenses from cyber-crime and data
breach from three different angles: (1) technical solutions; (2) employee
training; and (3) insurance.

1. With respect to technical solutions, employers should make sure that
they are constantly updating their software with the latest updates and
patches so that they are protected by their software vendors’ latest
efforts at closing known hacking exploits.

Employers should purchase and deploy malware and anti-virus software and
should consider tools available to filter and prevent employees from using
websites that are known to be in the control of hackers and
cyber-criminals. Password policies should require both a complex password
and changing of the password on a periodic basis. Password management
software can be employed to ease the burden of these policies on employees
and also give employers a way to enforce the policies.

2. Employee training also is essential. Most technical solutions can be
defeated by an employee who unwittingly or carelessly opens the door to a
hacker as in the Boeing incident. Insurance industry data shows that
one-third of data breach and cyber-threat claims have at their root some
form of employee negligence.

Training regimens should not only include how to use malware and anti-virus
software or password managers, but also should include real-world drills
for phishing attacks. IT staff or consultants can test organizational
readiness by sending out emails designed to induce an employee into
clicking on link or providing their login information for a critical
business system such as email.

The results can be provided to management. Employees should be trained to
identify telltale signs of phishing scheme, such as poor grammar or
spelling in the message, strange syntax from a sender you know, a message
about an otherwise unknown event, or links that do not look like they go to
where you would expect them to go, such as to domains located in foreign
countries.

3. Insurance is the third element of the defense triad. Data protection or
cyber-crime insurance policies are being marketed aggressively by insurance
companies due to the constantly expanding threat.

Insurance always should play some role in any strategy to defend against
legal liability, just as businesses use general liability insurance to
protect against liability for other hazards. Indeed, many insurance
carriers offer cyber-crime insurance as a rider to their general liability
policies. Insurance can provide coverage for the costs of investigation and
notification in the event of data breach or cyber-crime.

But employers should read policy language carefully and think about the
risks and exposures that they are trying to cover through an insurance
contract. The insurance industry also is grappling with the nature of
cyber-crime and data breach risks and how to assess premiums based on those
risks. A careful reading of any policy exclusions is important.

Many policies do not cover certain types of negligence incidents, attacks
that can be linked to nation states, data breach events affecting your
information at third-party vendors, or expenses imposed by government
enforcement agencies, such as a requirement to provide identity-theft
protection to everyone affected by the breach.

Some policies also exclude coverage for devices that are not employing
encryption at the time that they were lost or stolen. In such cases, your
insurance coverage may depend upon whether you have an encryption solution
in place and your employees trained to use it. All three defensive elements
must be in place.

Conclusion

Unfortunately, the problems have become so pervasive that significant time
and resources must be devoted to them regardless of your profession or
industry. Employers must remain vigilant about their weak points and
regularly check on the defenses they employ, whether technical solutions,
employee training, or through insurance to ensure that they remain current
in this constantly evolving and hostile environment.

Additional resources for cyber-security information are abundant, but among
the most prominent is the US is National Institute of Standards and
Technology’s (NIST) Framework for Improving Critical Infrastructure
Cybersecurity, published in 2014.

NIST has a web site with documents and webinar materials about its
framework that will help you start thinking about managing the risks of
cyber-security.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20170425/0d774428/attachment.html>