CFC Documents
CFC Cyber
Cyber Insurance
CFC Cyber
Is Cyber Insurance Right for My Business?
Cyber insurance is becoming increasingly important for businesses of all sizes, yet many still struggle to understand its value and applicability. This document outlines six key reasons why purchasing a standalone cyber policy can be beneficial for businesses:
1. Prevention and Response Services
Cyber insurance policies often include valuable risk management tools and incident response services. These can help prevent attacks through measures like phishing simulations and dark web monitoring and provide expert support in the event of a cyber incident.
2. Small-to-Medium Businesses are Prime Targets
While major breaches at large companies make headlines, smaller businesses are frequent targets for cybercriminals. Over 75% of small businesses reported a cyber attack in the past year, as they often lack robust IT security resources.
3. Human Error is a Major Risk Factor
Approximately 75% of cyber claims involve preventable human errors, such as clicking on malicious links or accidentally sharing sensitive data. Cyber insurance provides training to reduce these risks and coverage when mistakes occur.
4. Limited Coverage in Traditional Policies
Standard insurance policies often provide inadequate cyber coverage. Standalone cyber policies address gaps left by traditional insurance and offer specialized expertise in handling cyber incidents.
5. Comprehensive Coverage Beyond Data Breaches
Cyber insurance covers a wide range of incidents beyond just data breaches. Common claims include funds transfer fraud and ransomware attacks, which can severely impact businesses without compromising sensitive data.
6. Rising Frequency of Cyber Claims
The number of cyber claims continues to increase year over year. CFC, a cyber insurance provider, handled over 2,500 cyber claims in the past 12 months alone, with a 99% claims acceptance rate over the past two years.
In conclusion, cyber insurance offers businesses comprehensive protection against various digital risks, access to preventative tools and expert support, and coverage for incidents that traditional insurance policies may not address. As cyber threats continue to evolve and increase in frequency, cyber insurance is becoming an essential consideration for businesses of all sizes to mitigate their digital risk exposure.
CFC Cyber
Protecting Businesses
CFC Cyber
Market Leading Cyber Insurance
CFC is a leading cyber insurance provider, offering comprehensive protection for businesses against cyber risks. Their products are designed to prevent cyber attacks and minimize the impact if one occurs.
Proactive Cyber Attack Prevention:
CFC employs vulnerability scanning, threat monitoring, and real-time cyber attack prevention throughout the policy lifecycle. It uses insights from various sources to identify potential threats and proactively alert vulnerable customers.
24/7 Incident Response:
CFC boasts the market’s largest in-house incident response team, available 24/7 with a follow-the-sun approach. They handle over 2,500 cyber events annually, with a technical response time of less than 15 minutes.
Award-Winning Cyber Cover:
Their comprehensive cyber cover includes first-party costs, third-party liability, and in-house cyber security team access. The coverage is 100% backed by Lloyd’s and has received excellent ratings from A.M. Best, Fitch Ratings, and Standard & Poor’s.
Notable Coverage Highlights
- Broad non-physical perils business interruption cover
- Tech supply chain failure coverage
- Nil deductible on initial incident response costs
- Full retroactive cover with a discovery-based trigger
- Emergency costs provision
- No warranties or conditions requiring specific cyber security measures
Response Mobile App
- Critical threat alerts in real-time
- 24/7 access to cyber security experts
- Incident reporting functionality
- Free cyber security tools (dark web monitoring, phishing simulations, deep scanning)
Claims Handling
CFC’s in-house claims team has over 20 years of experience and resolves over 2,000 cyber claims annually. They handle various types of incidents, including ransomware attacks, data breaches, and business interruption.
Company Overview
CFC is a specialist insurance provider headquartered in London with offices in several major cities worldwide. It has over 800 employees and is trusted by over 130,000 businesses across 90 countries. The company uses cutting-edge technology and data science to deliver efficient underwriting and protection against critical business risks.
In summary, CFC offers a comprehensive cyber insurance solution that combines proactive prevention, rapid incident response, and robust coverage, making it a trusted choice for businesses seeking protection against cyber risks.
CFC Cyber
Cyber Glossary
CFC Cyber
Cyber Buzzwords Glossary
CFC Cyber provides a comprehensive overview of key terms and concepts in the field of cybersecurity. It serves as a reference for understanding the rapidly evolving landscape of cyber threats, technologies, and practices.
The glossary begins with Application Whitelisting, a security measure allowing only approved software to run on systems, and Antivirus, which detects and prevents malicious software. Asset Inventory involves listing all IT hardware and devices to assess data security. A Brute Force Attack is a method where attackers attempt multiple passwords to gain network access.
The document explains the concept of the Cloud as a virtual space for storing digital resources, highlighting examples like Google Drive and AWS. Custom Threat Intelligence involves analyzing data from open sources and the dark web to provide organizations with relevant cyber threat information.
Key terms related to cyber threats include Cyber Attack, an unauthorized attempt to exploit networks; Cybercrime, involving extortion and malware; and Cyber Event, indicating unauthorized system access or breaches. Cyber Insurance is mentioned as protection against cybercrime threats.
Cyber Security encompasses technologies and processes to protect IT systems, while Cyber Threat Analysis involves teams dedicated to preventing cyber attacks. The glossary also covers Database Encryption, protecting stored data, and Data Loss Prevention, which identifies potential data exfiltration.
Further entries include DDoS Mitigation, which filters out malicious traffic during attacks, and protocols like DMARC for combating email spoofing. Email Filtering categorizes messages to filter out spam, while Employee Awareness programs train staff on security practices.
The glossary defines various security solutions, such as Endpoint Protection, which stops malware on individual devices, and Firewalls, which control network traffic. It also covers response strategies, such as Incident Response Plans, for managing cyber incidents.
Other notable entries include descriptions of malware types like Ransomware, which encrypts data for extortion, and security measures like Multi-Factor Authentication (MFA) for secure logins. The role of a Managed Service Provider in offering IT services is also highlighted.
Technologies such as Network Monitoring, which oversees network performance, and advanced solutions like Next-Generation Firewalls, combining traditional firewalls with additional features, are explained. The glossary also addresses practices like Patching software to enhance security.
Terms related to attacks include Phishing, mass emails seeking sensitive information, and tools like the Security Operations Centre (SOC), which monitors an organization’s security posture. The glossary concludes with definitions of vulnerabilities, such as Zero-Day Exploits, which are unknown to vendors before being exploited by attackers.
Overall, this glossary provides essential insights into cybersecurity terminology, aiding in understanding the measures necessary to protect against digital threats.
CFC Cyber
Incident Response
CFC Cyber
Nil Deductible and a Separate Limit for Incident Response
CFC Cyber outlines their innovative approach to cyber insurance, emphasizing two main features: a nil deductible for initial incident response and a separate limit for incident response costs. These features are designed to encourage prompt reporting of cyber incidents and provide comprehensive coverage without financial hesitation from policyholders.
Nil Deductible for Incident Response
CFC offers initial cyber incident response services at no deductible cost, meaning policyholders do not have to make any upfront payments when they suspect a cyber incident. This approach aims to eliminate the fear of incurring costs or triggering claims that might increase future premiums. By allowing immediate notification and engagement with their incident response team, CFC helps businesses quickly address potential threats before they escalate, minimizing damage and associated costs.
Separate Limit for Incident Response Costs
Traditional cyber insurance policies typically have a single aggregate limit, which can be depleted quickly by the high costs associated with responding to cyber attacks. CFC addresses this issue by providing two distinct coverage limits: one dedicated to incident response services and another for business resumption, interruption, and cybercrime costs. This dual-limit structure ensures that businesses have adequate coverage for immediate response efforts and longer-term recovery needs, effectively doubling the available resources without additional cost.
Real-World Application
The document provides an example of how these features work in practice. In the case of a retailer facing a ransomware attack, CFC’s policy allowed for immediate forensic investigation and system recovery without initial payment from the insured. The separate incident response limit covered significant costs related to mitigating the attack, while the business resumption limit addressed losses from business interruption. This comprehensive coverage ensured that all expenses were managed within the policy’s limits, providing substantial financial protection.
Market-Leading Coverage
CFC positions its cyber insurance as market-leading due to these features, offering peace of mind to policyholders by ensuring they can rely on robust support during cyber incidents. The document also hints at additional benefits like unlimited reinstatements, further enhancing the appeal of their coverage.
Overall, CFC’s approach aims to transform cyber insurance from merely a financial safety net into an active protective service that supports businesses in both preventing and recovering from cyber attacks efficiently.
CFC Cyber
Unlimited Reinstatements
CFC Cyber
The Power of Unlimited Reinstatements
CFC Cyber outlines the benefits of offering unlimited reinstatements in cyber insurance policies. As cyber attacks become more frequent and impactful, businesses face the risk of experiencing multiple incidents within a single policy period. Traditional cyber insurance policies often have a single aggregate limit, which can be quickly exhausted by a significant attack, leaving businesses vulnerable to subsequent incidents.
Unlimited Reinstatements Explained
CFC introduces the concept of unlimited reinstatements, which provides a new policy limit for each unrelated cyber claim. This approach is inspired by traditional insurance lines where policy limits are reinstated after each claim. For instance, if a business suffers a ransomware attack that uses up the full $1 million policy limit and later experiences an unrelated fund transfer fraud, the policyholder receives a fresh $1 million limit to cover the new incident. This ensures continuous protection without additional premium payments for each new limit.
Business Benefits
The primary advantage of CFC’s unlimited reinstatements is that businesses receive multiple coverage limits for the price of one premium payment. This offers better value for money and ensures long-term protection throughout the policy’s lifespan. Businesses can operate with peace of mind, knowing their insurance will fully respond to each separate incident.
Real-World Application
The document provides a case study of a manufacturing firm that benefited from CFC’s unlimited reinstatements. Within two months, the firm experienced a ransomware attack followed by funds transfer fraud. The initial ransomware attack consumed the entire $1 million policy limit due to costs associated with downtime, forensic investigation, and legal counsel. However, because CFC’s policy included unlimited reinstatements, the firm was fully reimbursed for the subsequent fraud incident.
Market-Leading Cyber Cover
CFC emphasizes that its cyber policies do not impose warranties or conditions specifying security controls at the time of an incident. This allows them to focus on helping businesses recover quickly and effectively from cyber attacks. The document highlights that unlimited reinstatements are essential for businesses facing constant cyber threats, providing robust and flexible coverage in an unpredictable environment.
CFC Cyber
Data Recreation
CFC Cyber
Data Recreation, Not Just Recovery
CFC Cyber emphasizes the importance of selecting a cyber insurance policy that includes data recreation, not just data recovery. This distinction is crucial because data is a critical business asset and a prime target for cybercriminals who aim to encrypt, exfiltrate, or manipulate it to disrupt businesses. Many cyber insurance policies offer data recovery, which involves restoring systems and data from backups. However, if backups are unavailable or have been compromised, data recovery may not be possible.
Data Recreation vs. Data Recovery
Data recreation is a more comprehensive solution provided by CFC cyber policies. It involves recreating lost data from scratch when it cannot be recovered from backups. This process may require the involvement of external industry specialists to rebuild datasets and applications to their pre-incident state. The document highlights the importance of this feature by explaining that cybercriminals often target backups, knowing their value to businesses. If backups are damaged or incomplete, the consequences can be disastrous.
Case Study: Data Recreation in Action
The document provides a case study of an engineering firm that fell victim to the WannaCry ransomware attack. The attack encrypted all data files on the firm’s server and local hard drive backups, including critical technical drawings and design specifications. Although the firm believed it had cloud backups, these had been failing for years, rendering recent projects unrecoverable. Fortunately, the firm had a CFC cyber insurance policy that covered data recreation. The process involved external engineers working with the firm’s management team to recreate lost data at a cost of $270,000, which was covered by the policy.
Choosing the Right Cyber Insurance Policy
The document advises businesses to carefully select cyber insurance providers and ensure their policies include terms like “data recreation” rather than just “recovery.” CFC emphasizes its commitment to clear and understandable policy language to ensure clients receive comprehensive coverage.
Overall, the document underscores the significance of understanding specific policy terms in cyber insurance to ensure adequate protection against data loss incidents.
CFC Cyber
Cyber Insurance Guide
CFC Cyber
Cyber Insurance Guide
CFC Cyber provides an overview of the evolving landscape of cyber risk and the necessity for specialized insurance to address these modern threats. As technology becomes integral to business operations, the potential impact of cyber-related incidents has increased, necessitating a new type of insurance policy distinct from traditional forms.
Understanding Cyber Risk
The guide emphasizes that “cyber” is often misunderstood due to jargon and complexity. Historically, cyber insurance focused on third-party privacy exposures, but it now primarily addresses first-party risks, such as financial losses incurred directly by the insured due to cyber incidents.
Evolution of Cyber Risk
The shift from physical to digital assets has changed the nature of business risks. Cyber insurance protects against the loss, theft, or destruction of digital assets, which are now more accessible and vulnerable to global threats.
Need for Cyber Insurance
Traditional insurance policies were not designed to handle digital threats. Cyber insurance is essential as it covers data, systems, and electronic funds risks, which are not typically covered by standard property or crime insurance policies.
Types of Cyber Claims
The guide categorizes cyber claims into three main types: theft of funds through electronic means, theft of data necessary for identity theft, and damage to digital assets often used for extortion. The majority of claims involve first-party losses rather than third-party liabilities.
How Cyber Policies Work
Cyber insurance policies are modular and cover both first-party losses (e.g., incident response, cyber extortion, system damage) and third-party liabilities (e.g., network security breaches). The guide stresses the importance of comprehensive coverage addressing critical areas like incident response and business interruption.
Claims Examples
Real-world examples illustrate how cyber insurance can mitigate financial losses from social engineering scams, data breaches, and ransomware attacks. These examples highlight the importance of a robust cyber insurance policy.
Overcoming Objections
The guide addresses common objections to purchasing cyber insurance, such as reliance on IT security measures or cloud providers. It argues that no security system is foolproof and that businesses remain liable for data breaches even when using third-party services.
Overall, the document underscores the critical role of cyber insurance in protecting businesses against the rapidly evolving landscape of cyber threats. It highlights the necessity for businesses to adapt their risk management strategies to include comprehensive cyber coverage.
CFC Cyber
Hackers Target SMEs
CFC Cyber
5 Reasons Hackers Attack SMEs
CFC Cyber explores why small and medium-sized enterprises (SMEs) are frequent targets of cybercriminals, especially in the context of increased remote working. It highlights the rising rates of cyber claims, with SMEs often falling victim to crimes like funds transfer fraud and ransomware attacks. The document outlines five key reasons for this trend:
1. Small businesses are low-hanging fruit: SMEs are more commonly targeted than large corporations because they typically invest less in IT security due to limited resources and a lack of cybersecurity training. This makes them easier targets despite potentially smaller rewards for hackers.
2. Vulnerability to social engineering: SMEs are particularly susceptible to social engineering attacks, where individuals are manipulated into divulging confidential information or transferring funds. This vulnerability stems from inadequate security measures like two-factor authentication, insufficient employee training, and reliance on third-party partners, contributing to a significant portion of data breaches.
3. Pressure to pay ransoms: When faced with ransomware attacks, SMEs often feel compelled to pay the ransom to quickly resume operations and avoid prolonged downtime that could cripple their business. This is exacerbated by the lack of access to cyber incident specialists that larger firms might have.
4. SMEs as gateways to larger organizations: Cybercriminals frequently target SMEs as a means to infiltrate larger, more secure organizations with which they have electronic connections. These smaller firms serve as less secure entry points into the IT systems of their larger partners.
5. Collateral damage in larger attacks: SMEs can become unintended victims in large-scale cyber attacks aimed at more significant entities. They may suffer business interruptions, privacy breaches, or reputational damage when their outsourced IT providers or cloud services are attacked.
The document emphasizes that while SMEs might perceive themselves as less attractive targets due to their size, their vulnerabilities make them appealing to cybercriminals seeking easy entry points or collateral damage in broader attacks.
CFC Cyber
Cyber Insurance Cost
CFC Cyber
Does Cyber Insurance Cost Too Much?
CFC Cyber explores the value and necessity of cyber insurance for modern businesses. It emphasizes that while the cost of cyber insurance may seem high, it is a crucial investment given the increasing frequency and sophistication of cyber threats.
Cyber as a Major Risk
Cyber incidents are now considered the top business risk, surpassing traditional risks like fire damage. The document argues that just as businesses routinely insure against fire, they should similarly prioritize cyber insurance. This form of insurance allows businesses to transfer their cyber risks to insurers, which is increasingly important as these risks grow.
High Costs of Cyber Claims
The document highlights the significant financial impact of cyber incidents, such as ransomware attacks, which can lead to operational disruptions, legal fees, and reputational damage. It provides examples of businesses that faced substantial costs due to cyber events but were able to mitigate these losses through comprehensive cyber insurance policies. These policies cover financial losses and provide expert assistance in managing and recovering from such incidents.
Proactive and Reactive Services
Good cyber insurance offers proactive measures to prevent attacks and reactive services to manage them effectively. The document outlines how CFC’s in-house team of cyber experts provides continuous monitoring and threat detection services as part of their insurance package. This includes immediate response capabilities to contain threats and minimize downtime during an attack.
The document concludes by asserting that with global cybercrime costs projected to reach $10.5 trillion by 2025, investing in comprehensive cyber insurance is a cost-effective and invaluable strategy for businesses. CFC positions itself as a leader in providing innovative and expansive coverage that responds to incidents and helps businesses stay ahead of potential cyber risks.
CFC Cyber
Backup Policies
CFC Cyber
Cyber Backup Policies
CFC Cyber provides comprehensive guidance on establishing effective backup policies to safeguard data against potential cyber incidents, such as ransomware attacks, hardware failures, or data corruption. It emphasizes that data is a critical asset for any organization and highlights the importance of having a robust backup policy to ensure business continuity.
Key Elements of a Backup Policy
1. Definition and Importance: A backup policy is a strategic plan designed to prevent data loss. It is crucial for enabling organizations to recover swiftly from adverse events and maintain operational continuity. The complexity of a backup policy depends on factors such as organizational size, the number of applications and databases, and regulatory requirements.
2. Best Practices for Implementation:
- Identify Critical Data: Determine which data is essential for business operations and allocate resources to protect it.
- Frequent Backups: Regularly back up mission-critical data to minimize potential loss.
- 3-2-1 Backup Rule: Maintain three copies of data, using two different media types locally and one offsite, ensuring backups are isolated from the network when not in use.
- Versioning: Keep old versions of data to protect against corruption or ransomware.
- Integrity Testing: Regularly verify that backups are accessible and readable.
3. Challenges and Solutions: Despite diligent efforts, backups can fail due to incorrect data capture or timing issues. In such cases, having cyber insurance that covers data recreation is beneficial. This insurance can help rebuild lost data beyond basic recovery capabilities.
Additional Considerations
- Data Encryption: Encrypt backups to prevent unauthorized access.
- Immutability: Make backups immutable to protect against unauthorized alterations.
- Remote Storage: Utilize cloud-based storage solutions for cost-effectiveness, ensuring they are managed properly.
- Automation: Automate backup processes to integrate them into daily business routines.
- Retention Periods: Define sensible retention periods for backups, considering costs and regulatory obligations.
- Data Retention Policy: Evaluate the necessity of stored data to avoid unnecessary costs and security risks.
The document also references further resources from the UK National Cyber Security Centre and the USA’s Cybersecurity and Infrastructure Security Agency (CISA) for additional advice on backup strategies. Overall, it underscores the critical role of well-planned backup policies in mitigating risks associated with cyber incidents.
CFC Cyber
War Language
CFC Cyber
CFC’s Upgraded War Language
CFC Cyber outlines significant changes to the cyber insurance policies offered by CFC, specifically regarding the language used to address war and cyber war exclusions. The primary aim of these updates is to provide greater clarity and coverage for policyholders in the face of evolving cyber threats.
Explicit Definition of Cyber War
The new policy language introduces a clear definition of “cyber war,” which is described as an attack by one state against another that significantly impacts the targeted state’s functionality or defense and security capabilities. This definition establishes a high threshold for what constitutes an act of cyber war, thereby reducing ambiguity.
High Threshold for Cyber War
By setting a high threshold for what is considered cyber war, the policy narrows the scope of the war exclusion, ensuring that policyholders have a clearer understanding of when their coverage applies.
Incident Response Support
The updated policy continues to provide initial incident response support through CFC’s global in-house team, CFC Response. This support is available even in the event of a cyber war, offering technical advice and cybersecurity assistance crucial for smaller organizations lacking in-house capabilities.
Coverage for Collateral Damage
Recognizing the interconnected nature of modern computer systems, the policy includes coverage for collateral damage. This ensures that organizations unintentionally affected by a cyber war targeting another state are not protected.
Rationale for Changes
The document explains that traditional war language in insurance policies was originally designed to address physical acts of war. It is often too broad, leading to confusion regarding its applicability to cyber attacks. As warfare evolves to include significant cyber components, it is essential for insurance policies to adapt accordingly. By updating the language, CFC aims to eliminate ambiguity and better serve its policyholders.
CFC emphasizes its commitment to being a market leader in cyber insurance by adapting its policies to meet contemporary challenges. With over two decades of experience and a client base spanning 90 countries, CFC’s proactive approach to redefining war language ensures its policies remain relevant and effective.
CFC Cyber
War Language FAQ
CFC Cyber
CFC’s Upgraded Cyber War Language FAQs
CFC Cyber outlines the recent updates made by CFC to its ‘war and cyber war’ language in SME (Small and Medium Enterprises) policies that provide cyber cover. The primary goal of these updates is to address the evolving threat of cyber warfare, ensuring that policyholders have clear and precise information about what is covered under their policies.
Reasons for Updating War Language
CFC has revised its language in response to traditional war exclusions, originally designed for physical acts of war but inadequate for addressing cyber warfare. This update aligns with a recent bulletin from Lloyd’s, prompting many insurers to clarify their stance on cyber war.
Specific Changes Introduced
The updated language includes four key enhancements:
- An explicit definition of ‘cyber war’ is introduced, providing greater clarity.
- A high threshold is established for what constitutes an act of cyber war.
- Coverage is provided for initial support and advice, even during a cyber war.
- Coverage is extended to ‘collateral damage’ resulting from cyber war.
Benefits to Policyholders
By defining cyber war explicitly and establishing a high threshold, CFC aims to reduce ambiguity in the policy. Policyholders will still have access to initial incident response support even if they are victims of cyber war. This ensures that unintended victims are not penalized if they are not the intended target.
Definition of Cyber War
In CFC’s policy, cyber war is defined as any cyber attack carried out by or on behalf of a state that causes another state to suffer a major detrimental impact on its functionality or defense and security capabilities. This sets a high bar for an event to be classified as an act of war.
Coverage for Collateral Damage
If an act of cyber war targets one state but impacts organizations outside that state, these are considered ‘collateral damage.’ CFC provides coverage for such unintended victims, ensuring their computer systems located outside the impacted state are covered.
Incident Response Cover
CFC offers coverage for initial incident response support through its internal team, CFC Response, which consists of over 120 specialists across US, UK, and Australia offices. This service remains a primary driver for purchasing cyber insurance among SME clients.
Implementation Timeline
The new language applies to all quotes and policies issued from May 1, 2023. It will not be applied mid-term to existing policies but will be updated upon renewal.
Amendments and Further Information
The new language cannot be amended or reverted to the old version as it has been designed with policyholders in mind and approved by regulatory and legal reviews.
CFC Cyber
Cyber Excess
CFC Cyber
Cyber Excess Coverage Hightlights
CFC’s Cyber Excess policy offers additional cyber risk protection for businesses seeking to supplement their primary coverage. This policy provides up to $5 million (or £/€ equivalent) of excess cyber capacity with automatic reinstatement, safeguarding clients against multiple cyber events in a single policy period.
The policy includes optional primary policy top-up coverages:
- Side A coverage for lawsuits against directors and officers arising from cyber events
- Theft of funds protection up to $1 million (or £/€ equivalent) for senior executive officers
- Cybercrime top-up for wire transfer fraud
- Access to CFC Response, an award-winning cyber security and incident response team
CFC Response
CFC Response is a comprehensive cyber security and incident response service that comes with every cyber policy. Key statistics include:
- Over 100 attacks were prevented monthly
- 24/7 follow-the-sun support
- Less than 15-minute response time
- Over 2,500 events are handled annually
Proactive Protection
CFC’s cyber threat analysts work continuously to protect businesses from cyber-attacks. They use various sources of intelligence to identify potential threats and alert vulnerable customers preemptively.
Immediate Response
In the event of an incident, CFC’s incident responders are available 24/7 with an average response time of under 15 minutes. They work to triage incidents, contain threats, and repair networks, minimizing business downtime and financial loss.
Real-time Support
CFC offers a mobile app called Response, which provides:
- Real-time threat alerts
- Free 24/7 access to cyber security experts
- Cutting-edge risk management tools
Global Reach
CFC Response operates across three continents, offering continuous support to its clients worldwide.
This comprehensive cyber excess policy, combined with CFC Response’s proactive protection and rapid incident response capabilities, provides businesses with robust protection against the ever-evolving landscape of cyber threats.
CFC Cyber
Risk Management Fanatics
CFC Cyber
Risk Management Fanatics
CFC Underwriting emphasizes a comprehensive approach to cyber risk management through its cyber insurance policies. This approach is structured around the key pillars of Prevent, Detect, and Respond, which are essential components in managing cyber risks effectively.
Prevent
CFC Underwriting collaborates with specialist providers globally to offer various services to prevent cyber incidents before they occur. These preventative measures include enhancing security protocols and implementing best practices tailored to the specific needs of each business. The focus is on minimizing vulnerabilities and fortifying defenses against potential threats. By proactively addressing security weaknesses, companies can significantly reduce the likelihood of experiencing a cyber incident.
Detect
Detection is a critical component of CFC’s cyber risk management strategy. The services include advanced real-time monitoring tools that help businesses identify potential threats. By detecting anomalies or suspicious activities early, businesses can take swift action to mitigate risks before they escalate into more significant issues. This proactive detection capability is vital for maintaining a robust security posture and promptly addressing any potential threats.
Respond
In a cyber incident, having a well-defined response plan is crucial. CFC Underwriting’s services include support for responding to incidents effectively and efficiently. This involves providing guidance on steps to contain and remediate an attack’s impact and offering resources to help businesses recover swiftly. By having a response strategy in place, businesses can minimize downtime and reduce the overall impact of a cyber incident.
Overall, CFC Underwriting’s approach to cyber risk management through their insurance policies is comprehensive, integrating prevention, detection, and response strategies to provide robust protection for their clients.
CFC Cyber
Health Organizations
CFC Cyber
Top 5 Trends Impacting Digital Health Organizations
The attached document discusses the top 5 trends impacting digital health organizations in the healthcare industry. These trends are transforming patient care and addressing challenges in the sector.
1. Telemedicine Revolutionizing Specialty Care
Telemedicine is expanding beyond primary care into specialty care, addressing the projected shortage of up to 120,000 specialty physicians by 2030. About 76% of hospitals now use telemedicine services, with companies like Eagle Telemedicine providing access to specialists in underserved communities. Telemental health is also growing, aiming to improve access to mental health care and reduce stigma.
2. AI-Powered Chatbots for Basic Primary Care
Artificial intelligence is making inroads in primary care diagnostics. In a recent study, Babylon Health’s AI-powered chatbot demonstrated diagnostic abilities comparable to those of human doctors. However, concerns remain about the accuracy and limitations of AI in healthcare, as highlighted by issues with mental health chatbots Woebot and Wysa.
3. Increased Use of Synthetic Patient Records
Due to challenges in accessing and merging patient data across multiple electronic health record systems, there’s a growing trend toward using synthetic patient records. Companies like MITRE have created open-source tools to generate synthetic patient data for research and development purposes, particularly in AI and predictive analytics.
4. Government Schemes Stimulating Growth
Regulatory bodies are adapting to support digital health innovation. The FDA’s Digital Health Action plan includes the Software Precertification (Pre-Cert) Pilot Program, focusing on firms and developers rather than individual products. In the UK, NHSX is taking over digital responsibilities within the NHS, aiming to improve partnerships with digital health companies.
5. Funding Slowdown and Rise in M&A Activity
While funding for digital health slowed in Q1 2019 compared to previous years, mergers and acquisitions activity has increased. Notable acquisitions include AbleTo’s purchase of Joyable and Teladoc’s acquisition of Médecin Direct to expand its international presence.
The document concludes by noting that while these trends present opportunities, they also introduce new risks. It suggests that traditional healthcare policies may not adequately cover these emerging risks, promoting CFC’s bespoke policy for digital healthcare organizations as a solution.
CFC Cyber
Reputation Risks
CFC Cyber
Reputational Repercussions
This document details a case study of an online retailer that experienced a significant data breach and its aftermath. Here’s a summary of the key points:
Incident Overview
The incident began in February 2017 when hackers attacked the retailer’s website, gaining access to a database containing credit card details of over 90,000 customers. The company was alerted when the hackers demanded a ransom to prevent the data’s public release.
Immediate Response
The retailer reported the situation to CFC’s cyber incident response team, who took the following actions:
- Engaged IT forensic partners to address vulnerabilities and remove malicious code
- Involved privacy legal experts to determine notification requirements
- Notified affected individuals and provided identity theft restoration services
The initial costs for IT forensics, legal advice, and breach notification services totaled just over $230,000.
Long-Term Impact
In the months following the breach notification, the business experienced a significant drop in customer loyalty and re-orders:
- Pre-breach re-order rate: 96.4%
- Post-breach re-order rate: Dropped to 85.8% in April and 79.7% in June
- Estimated lost orders: 5,220 over 12 months
- Financial impact: $475,646 in lost profits due to reputational harm
Insurance Coverage
The retailer’s cyber policy with CFC covered the costs of reputational harm following a cyber event over a 12-month indemnity period, which proved crucial in this case.
Key Takeaways
1. Importance of comprehensive coverage: Business interruption coverage should extend to reputational harm, not just system outages.
2. Value of longer indemnity periods: A 12-month indemnity period allowed the insured to recover $475,646, compared to only $188,072 with a 3-month period.
3. Broader consideration of cyber risks: Businesses should consider the full range of potential business interruption exposures beyond just system outages when purchasing cyber policies.
This case study highlights the significant financial impact of reputational damage from a data breach on a business, even without substantial system downtime, and emphasizes the importance of comprehensive cyber insurance coverage.
CFC Cyber
Ransomware
CFC Cyber
Backup Breakdown – Ransomware
This document details a case study of a small engineering firm in London that fell victim to the WannaCry ransomware attack in May 2017. The attack encrypted the firm’s data files, including valuable technical drawings and design specifications crucial for business operations.
The Attack and Its Immediate Impact
The WannaCry ransomware spread rapidly, infecting over 230,000 computers in over 150 countries within 24 hours. It exploited a vulnerability in the Windows operating system, allowing it to spread through shared file structures.
Failed Recovery Attempts
Initially, the firm attempted to recover its data from a remote cloud backup. However, they discovered that their cloud backup had failed since 2014, rendering three years’ worth of project data unrecoverable.
Assessing the Damage
The company explored two approaches to estimate the cost of data re-creation:
1. Assigning a percentage of each project’s value to represent re-creation costs.
2. Calculating the time required to re-create each project and assigning costs based on staff expertise levels.
They opted for the second approach, which provided a more accurate estimate.
Cost Breakdown
The re-creation costs were calculated based on hourly rates for different staff levels:
- Director: $250/hour
- Senior Engineer: $85/hour
- Engineer: $50/hour
- Assistant Engineer: $25/hour
The total cost for data re-creation amounted to over $270,000, in addition to nearly $20,000 spent on IT services, a new server, and initial recovery attempts.
Importance of Comprehensive Cyber Insurance
This case study highlights the critical need for comprehensive cyber insurance that covers data recovery and re-creation costs. The engineering firm had purchased such a policy from CFC, protecting them from the full financial burden of the ransomware attack.
Key Takeaways
The document emphasizes three main tips for businesses:
1. Always backup data
2. Implement and regularly test a backup testing plan
3. Keep backup applications updated and test them with new versions or operating systems
This case study serves as a stark reminder of the potential financial impact of cyber attacks on businesses of all sizes, particularly those that rely heavily on digital assets and intellectual property.
CFC Cyber
Funds Transfer
CFC Cyber
Manufacturing Company – Social Engineering Attack
The document describes a case study of CEO fraud, a type of social engineering attack that resulted in significant financial loss for a manufacturing company.
The Incident
A manufacturing firm specializing in textile machinery fell victim to a sophisticated CEO fraud scheme. The attack began when the company’s CEO unknowingly provided his email credentials to a fraudster through a phishing email disguised as a Microsoft account validation request.
The Fraudster’s Method
Once the attacker gained access to the CEO’s email account, they:
1. Gathered information about the company’s invoice processing procedures
2. Identified key personnel in the finance department
3. Accessed the CEO’s calendar to determine when he would be out of office
4. Set up email forwarding rules to hide suspicious activity
The Fraud
The attacker executed the fraud by:
1. Impersonating a contract manufacturer’s accounts department
2. Sending fake invoices with altered bank details
3. Forwarding these invoices to the finance department, posing as the CEO
4. Requesting urgent payment while the CEO was on a business trip
The Outcome
The company unknowingly transferred $190,000 to the fraudster’s account over multiple transactions. The fraud was only discovered upon the CEO’s return to the office. Despite efforts to recover the funds, they were deemed unrecoverable.
Key Takeaways
1. CEOs and senior executives are prime targets for cybercriminals due to their high profiles and authority.
2. Cybercriminals are becoming increasingly sophisticated in their methods.
3. Human error remains a significant vulnerability, even with robust IT security measures in place.
4. Cyber insurance is crucial as a safety net against such attacks, as no organization can be completely impervious to these threats.
The case study emphasizes the importance of robust cybersecurity practices, employee training, and authentication procedures. It also highlights the value of cyber insurance as part of a comprehensive risk management strategy for businesses of all sizes.
CFC Cyber
Payment Scams
CFC Cyber
Insurance Brokerage: Payment Scam
The document describes a case study of customer payment fraud involving an insurance brokerage. Here’s a summary of the key points:
Incident Overview
A small insurance brokerage fell victim to a sophisticated cyber scam that diverted a client’s premium payment to a fraudulent account. The incident began when an employee of the brokerage was tricked into revealing their email login credentials through a phishing attack.
Fraudster’s Method
The cybercriminal used the following tactics:
1. Gained access to the broker’s email account
2. Set up an email forwarding rule to hide communications from the client
3. Impersonated the broker to send fraudulent payment instructions to the client
4. Provided a false reason for changing the payment account
5. Created a sense of urgency to prompt quick payment
6. Confirmed receipt of funds to avoid suspicion
Consequences
- The client transferred $14,580 to a fraudulent account in Hong Kong
- The fraud was discovered weeks later when the broker inquired about the payment
- By the time the scam was uncovered, the funds had been emptied from the fraudulent account
Resolution
- The client held the brokerage responsible for the compromised email system
- The brokerage accepted responsibility and paid the client’s premium from their own funds
- The brokerage recouped the loss through their cyber policy with CFC, which covered customer payment fraud up to $50,000
Key Takeaways
1. Cybercriminals are becoming increasingly sophisticated in their methods
2. Businesses may be held responsible when their systems are compromised, even if the customer is the one who transfers funds
3. Customer payment fraud coverage in cyber policies is crucial for businesses to protect against such incidents
The case study emphasizes the importance of robust cybersecurity measures and appropriate insurance coverage to mitigate the financial impact of customer payment fraud.
CFC Cyber
Operation Disruption
CFC Cyber
Beyond The Beach
This document details a case study of a cyber attack on a mid-sized American hospital, highlighting the severe operational disruption caused by malware rather than a data breach.
The Incident
In late August 2017, the hospital discovered that all its devices and servers were malfunctioning, rendering electronic patient data inaccessible. This malware attack affected approximately 2,000 devices and servers, causing significant operational challenges:
- Medical staff couldn’t access patient histories, allergies, or drug prescriptions
- Electronic monitoring of patients became impossible
- Medication dispensing machines were inoperable
- Additional nurses were required to ensure effective patient monitoring
Immediate Impact
The hospital was forced to implement manual processes, leading to substantial service delays. By mid-afternoon, they declared a Red Alert, a protocol allowing ambulances to inform patients of longer wait times and offering alternatives. This resulted in a decline in patient numbers.
Recovery Process
Restoring normal operations proved to be a complex and costly process:
- All affected devices and servers had to be wiped and rebuilt from scratch
- In many cases, replacing devices was more cost-effective than wiping them
- The hospital was disconnected from its electronic health records system until it declared malware-free
- A temporary cloud network was required at an additional cost of $2,000 per day
Financial Consequences
The malware attack resulted in significant financial losses:
- $2.6 million in system damages costs (replacing hardware and software)
- $4.5 million in business interruption costs (primarily due to reduced patient income)
- Total losses exceeded the hospital’s $5 million cyber insurance policy limit
Key Takeaways
1. Malware attacks can be as devastating as data breaches, especially for businesses reliant on computer systems.
2. Cyber insurance policies should cover physical property and hardware replacement costs when necessary for restoring operations.
3. Organizations should consider the full range of cyber risks, including operational disruption, when selecting insurance coverage and limits.
4. The hospital’s focus on data breach protection left them underinsured for the malware attack they experienced.
This case study emphasizes the importance of comprehensive cyber risk assessment and adequate insurance coverage for all types of cyber threats, not just data breaches.
CFC Cyber
Payment Scam
CFC Cyber
Poached Payment Scam
The document describes a case study of customer payment fraud involving an insurance brokerage. Here’s a summary of the key points:
Incident Overview
A small insurance brokerage fell victim to a sophisticated cyber scam that resulted in a client’s premium payment being diverted to a fraudulent account. The incident began when an employee of the brokerage was tricked into revealing their email login credentials through a phishing attack.
Fraudster’s Method
The cybercriminal used the following tactics:
1. Gained access to the broker’s email account
2. Set up an email forwarding rule to hide communications from the client
3. Impersonated the broker to send fraudulent payment instructions to the client
4. Provided a false reason for changing the payment account
5. Created a sense of urgency to prompt quick payment
6. Confirmed receipt of funds to avoid suspicion
Consequences
- The client transferred $14,580 to a fraudulent account in Hong Kong
- The fraud was discovered weeks later when the broker inquired about the payment
- By the time the scam was uncovered, the funds had been emptied from the fraudulent account
Resolution
- The client held the brokerage responsible for the compromised email system
- The brokerage accepted responsibility and paid the client’s premium from their own funds
- The brokerage recouped the loss through their cyber policy with CFC, which covered customer payment fraud up to $50,000
Key Takeaways
1. Cybercriminals are becoming increasingly sophisticated in their methods
2. Businesses may be held responsible when their systems are compromised, even if the customer is the one who transfers funds
3. Customer payment fraud coverage in cyber policies is crucial for businesses to protect against such incidents
The case study emphasizes the importance of robust cybersecurity measures and appropriate insurance coverage to mitigate the financial impact of customer payment fraud.
CFC Cyber
Notification Importance
CFC Cyber
Healthcare Provider – Quick Fix Compilation
This document details a case study involving a US-based medical service provider that fell victim to a ransomware attack in the summer of 2017. The attack encrypted 120 computer workstations and 15 servers, rendering patient management records and electronic medical records inaccessible.
The healthcare provider initially engaged their IT vendor, who quickly rebuilt and reimaged the affected systems from backups. While this action restored operations and minimized business interruption costs, it inadvertently complicated the organization’s breach notification requirements under the Health Insurance Portability and Accountability Act (HIPAA).
HIPAA requires healthcare providers to notify patients within 60 days if their Protected Health Information (PHI) is compromised. The Office for Civil Rights (OCR) guidance states that in ransomware cases, organizations must prove a low probability of PHI being viewed or stolen to avoid triggering the Breach Notification Rule.
The IT vendor’s actions of wiping the systems clean made it nearly impossible to forensically analyze the attack vector and determine if PHI had been compromised. Initially, the organization’s legal counsel advised notifying all 100,000 patients, which would cost over $200,000 and likely trigger an OCR investigation.
At this point, the policyholder informed CFC, their cyber insurance provider. CFC’s in-house cyber incident response team recognized the importance of identifying the ransomware variant. They discovered an employee photographed the ransom note containing an email address. This information allowed them to identify the ransomware as LockCrypt.
CFC engaged two forensic IT consultants who independently concluded that LockCrypt was an automated ransomware that was unlikely to have accessed or exfiltrated data. Based on these findings, the law firm reassessed the situation and determined that patient notification was unnecessary, avoiding costly notification procedures and potential reputational damage.
The case study highlights two crucial lessons:
1. Policyholders should engage their cyber insurance provider immediately after a cyber event to ensure a coordinated response and preserve crucial evidence.
2. Having an experienced cyber insurer with a dedicated in-house incident response team can make a significant difference in managing claims and protecting the organization’s reputation.
In conclusion, while the cyber insurance market is becoming increasingly competitive, the expertise and experience of well-established insurers can be invaluable in navigating complex cyber incidents and mitigating potential damages.
CFC Cyber
Website Hack
CFC Cyber
Appliance Retailer – Website Hack
This document details a case study of a cyber attack on an appliance retailer’s website, highlighting the growing threat of Distributed Denial of Service (DDoS) attacks in the digital age.
The incident began when a hacker emailed, threatening to take down the company’s website unless a $4,000 Bitcoin ransom was paid. Unfortunately, this email was caught in spam filters and went unnoticed. True to the threat, the hacker launched a DDoS attack using a botnet, overwhelming the retailer’s website with traffic and rendering it inaccessible to customers.
The company’s IT department attempted several countermeasures:
1. Blocking traffic from outside their country
2. Changing the website’s IP address
However, the hacker quickly adapted to these tactics, using proxy servers and redirecting the attack to new IP addresses.
After multiple failed attempts to mitigate the attack, the retailer contacted CFC’s cyber incident response team. The team connected them with a specialized DDoS mitigation service, which successfully restored website access within minutes.
The attack lasted from 7 AM to just after 4 PM, with only brief periods of regular operation. This downtime resulted in a significant sales shortfall. The company had budgeted $1,126,838 in online sales for the month but only achieved $951,632, a difference of $175,206. After adjustments, this translated to a business interruption loss of $51,506, covered by the retailer’s cyber insurance policy with CFC.
Key takeaways from this incident include:
1. The importance of investing in DDoS protection, especially as attacks grow in size and power.
2. The value of promptly notifying insurers of cyber incidents to minimize damage and downtime.
3. The critical role of cyber insurance in protecting digital assets, as traditional policies often don’t cover these modern threats.
This case study underscores the vulnerability of businesses to cyber attacks and the potential financial impact of website downtime. It also highlights the effectiveness of specialized cyber insurance and incident response services in mitigating such threats.
CFC Cyber
Ransomware Attack
CFC Cyber
Kitchen Manufacturer – Ransomware Attach
The document describes a cyber attack on a medium-sized kitchen unit manufacturer, highlighting the importance of cyber insurance for businesses across all industries, including manufacturing.
The Incident
The attack began when a hacker accessed the company’s computer systems through the Remote Desktop Protocol (RDP), which was directly exposed to the internet. Using a brute force attack, the hacker obtained credentials for the local administrator account, which had a weak password. The hacker then escalated their access to obtain domain administrator credentials and launched ransomware across multiple servers.
Impact on Business Operations
The ransomware attack severely disrupted the company’s operations for four working days:
- Sales staff couldn’t access CAD software to produce quotes or finalize designs.
- The admin team couldn’t access the CRM system to arrange appointments or respond to customer queries.
- Manufacturing was limited to existing orders, resulting in reduced output.
Financial Consequences
The attack resulted in significant financial losses:
- Business interruption loss of $130,959 due to lost sales.
- Additional costs of $38,371 for ransom payment, decryption, and system analysis.
- Total loss exceeding $700,000 for just four days of downtime.
Key Takeaways
1. Security Measures: Businesses should use VPNs for remote access, implement strong password policies, and enable two-factor authentication.
2. Business Interruption Coverage: Cyber insurance policies should include business interruption coverage, as system unavailability can lead to substantial losses.
3. Universal Cyber Exposure: Even businesses that don’t rely heavily on computer systems for their core operations can face significant disruptions and losses from cyber attacks.
This case study demonstrates that manufacturers and other businesses previously considered low-risk for cyber attacks are vulnerable and should consider comprehensive cyber insurance coverage.
Stay Ahead in the Cyber Security Game
Learn More about CFC Coverage & Pricing
No Spam. Promise!
What is Cyber Insurance
Cyber insurance is a specialized insurance product designed to protect businesses against the financial losses and disruptions that can arise from cyber-related incidents, such as data breaches, ransomware attacks, and other cyber threats. This type of insurance typically covers costs related to data recovery, legal fees, notification of affected parties, regulatory fines, and business interruption losses. Businesses need cyber insurance to mitigate the financial impact of cyber-attacks, ensuring they can quickly recover and continue operations while minimizing the potential damage to their reputation and customer trust.
What does cyber insurance cover?
Cyber insurance typically covers costs related to data breaches, including data recovery, legal fees, notification of affected parties, and regulatory fines. It may also cover business interruption losses and expenses related to restoring business operations.
Why is cyber insurance important for SMBs?
Small businesses, often with potentially weaker security measures, are prime targets for cyber attacks. Cyber insurance is a crucial tool in managing the financial burden of such attacks, ensuring they can recover quickly and sustain minimal operational disruption.
How is the cost of cyber insurance determined?
Factors such as the size of the business, the industry, the amount and type of data handled, and the company’s existing cybersecurity measures influence the cost of cyber insurance. Higher-risk businesses or those with poor security practices may face higher premiums.
What are the exclusions in a cyber insurance policy?
Standard exclusions in cyber insurance policies include claims related to pre-existing breaches, acts of war or terrorism, and the failure to maintain minimum security standards. It’s essential for businesses to review policy details to understand specific exclusions and limitations.