Immediate Vault Immediate Access

What the 2015 State of the Union Means for Risk Managers

state of the union 2015

Last night, President Obama delivered the annual State of the Union. Unsurprisingly, the speech covered a variety of topics ranging from foreign affairs to civil rights to climate change. While these issues may ultimately have little impact on the insurance industry or risk management, there were two topics raised that could be of significant interest.

The first relates to tax reform:

“As Americans, we don’t mind paying our fair share of taxes, as long as everybody else does, too. But for far too long, lobbyists have rigged the tax code with loopholes that let some corporations pay nothing while others pay full freight. They’ve riddled it with giveaways the superrich don’t need, denying a break to middle class families who do,” Obama said.

buy sinequan online www.delineation.ca/wp-content/uploads/2023/10/jpg/sinequan.html no prescription pharmacy

For the past few years, the Obama administration’s annual budget proposal has included a measure that would deny a tax deduction for certain reinsurance premiums paid to foreign-based affiliates by domestic insurers. While the administration and some members of Congress deem this deduction a “loophole,” it is actually a commonly used and effective risk management tool.

buy cenforce online www.delineation.ca/wp-content/uploads/2023/10/jpg/cenforce.html no prescription pharmacy

Doing away with this particular “loophole” would force the industry as a whole to reduce the size and scope of its U.S. offerings. A previous economic impact study found that this proposal would reduce the net supply of reinsurance in the United States by 20%, thus increasing prices by to billion annually for the same coverage.

buy zocor online www.delineation.ca/wp-content/uploads/2023/10/jpg/zocor.html no prescription pharmacy

If Congress does take up comprehensive tax reform, this is certainly an initiative that many in the industry will need to keep an eye on.

The other issue is cybersecurity:

“And tonight, I urge this Congress to finally pass the legislation we need to better meet the evolving threat of cyberattacks, combat identity theft, and protect our children’s information. If we don’t act, we’ll leave our nation and our economy vulnerable. If we do, we can continue to protect the technologies that have unleashed untold opportunities for people around the globe,” the president said.

Cybersecurity and the management of cyberrisks is certainly one of the hottest topics in the industry. While it remains unclear what proposed legislation will look like, we will almost certainly see at least one major piece of cybersecurity legislation introduced in the next few months. Previous efforts have focused on information-sharing. With the number of attacks and damage inflicted only increasing, however, it is quite possible that new legislation may be even broader in scope.

It is also important to note that simply including something in a State of the Union address does not always translate into real action. It is quite possible that tax reform will get tabled again as various factions are unable to agree. It’s also possible that Congress will be unable to come up with a cybersecurity bill that achieves many of its goals without undermining the privacy or personal security of individuals. It is, however, an overview of the administration’s priorities for the coming year, and that does still carry some weight.

Human Error Caused 93% of Data Breaches

Despite tremendous increased attention, the number of reported cyberbreach incidents rapidly escalated in 2014. According to Information Commissioner’s Office data collected by Egress Software Technologies, U.K. businesses saw substantially more breaches last year, with industry-wide increases of 101% in healthcare, 200% in insurance, 44% among financial advisers, 200% among lenders 200%, 56% in education and 143% in general business. As a result, these industries also saw notable increases in fines for data protection violations.

The role of employees was equally alarming.

buy rogaine online haveagreatsmile.com/wp-content/uploads/2023/10/jpg/rogaine.html no prescription pharmacy

“Only 7% of breaches for the period occurred as a result of technical failings,” Egress reported.

buy vidalista online haveagreatsmile.com/wp-content/uploads/2023/10/jpg/vidalista.html no prescription pharmacy

“The remaining 93% were down to human error, poor processes and systems in place, and lack of care when handling data.

buy celexa online haveagreatsmile.com/wp-content/uploads/2023/10/jpg/celexa.html no prescription pharmacy

Check out more of the findings from Egress’ review in the infographic below:

Infographic: Human error causes alarming rise in data breaches

Lessons Learned from Data Breaches

Recent data breaches have left some large organizations reeling as they deal with the aftermath. They include the Target data breach, compromises at Home Depot, JP Morgan, USPS (which exposed employee Social Security Numbers and other data) and, most recently, Sony Pictures. The Sony hack also proved to be embarrassing to some of the company’s executives, as private email correspondences were exposed.

Collateral damage from data breach is significant: one in nine customers affected by a data breach stopped shopping at a particular retailer. According to LifeLock, a recent survey of corporate executive decision-makers found that while concern for a breach is 4 or 5 on a 5-point scale, only 10% to 20% of their total cyber security budgets go to breach remediation. Establishing an incident response plan in advance can reduce the cost per compromised record by $17.

While strengthening cybersecurity is important, the impact on breached organizations shows that preparing a response must be part of the breach-management equation. These breaches present an opportunity for business leaders and risk professionals to learn important lessons about how to protect their companies, customers and employees if a breach should occur.

Below are steps companies can take to establish a response plan, as well as information on the data breach landscape.

 

 

 

Lessons from MBIA: When Breaches Go Viral

data breach

We can add another breached company to the ever-growing list: the Municipal Bond Insurance Association (MBIA). While not necessarily unique from other breaches we’ve seen lately, the MBIA incident brought another aspect of breach fallout into the public eye, and that’s the potential for data exposures to go viral. These viral breaches generate tendrils of compromised information that reach far and wide, creating a nightmare for containment—and public relations.

Known as the largest bond insurer in the country, MBIA services accounts for many government investment pools. In late September, the company was alerted by an ethical hacker that hundreds of pages of customer data were showing up online for all to see. We’ve since learned that one of the company’s database servers had been improperly configured, resulting in the exposure of highly sensitive data. Account numbers were compromised along with customers’ names, account balances and other confidential information. But the damage didn’t stop there. Not only was MBIA’s customer data floating around the Internet for all to see, it also had been indexed by several search engines. Information that should have been heavily protected was now on the Web in multiple locations, far outside the control of MBIA.

The release of customer data wasn’t the only problem. High-level security keys were also exposed and indexed, including administrative credentials and instructions for creating new deposit accounts. Not only were cybercriminals given a nearly perfect tutorial to dig into additional data held by MBIA that hadn’t been compromised in the first go-round, the instructions also provided a way for thieves to quietly pull funds out of the compromised accounts. The integrity of MBIA’s systems had been damaged far beyond a simple data breach.

Piling on to the organization’s woes were two failures of their own making. One is that their Oracle server is commonly known to need careful configuration to avoid a potential security gap.

buy atarax online meadfamilydental.com/wp-content/uploads/2023/10/jpg/atarax.html no prescription pharmacy

Oracle has even provided documentation to help administrators configure it correctly and ensure the servers are secure. The other was that MBIA was actually notified of the exposure more than a week before the company finally cut off access to the compromised server.

buy diflucan online meadfamilydental.com/wp-content/uploads/2023/10/jpg/diflucan.html no prescription pharmacy

Not only was the company behind the curve in configuring its critical infrastructure correctly, it then delayed in fixing a problem that was brought to its attention.

In many respects, MBIA’s breach wasn’t all that different from other breaches. Network vulnerabilities are common avenues for hackers, and security warnings have been known to be overlooked. Target’s massive 2013 breach and similar recent exposures back this up.

buy estrace online meadfamilydental.com/wp-content/uploads/2023/10/jpg/estrace.html no prescription pharmacy

Unfortunately for MBIA, these factors all came together in a perfect storm that resulted in a truly viral breach. Sensitive customer data was compromised and unspeakably valuable credentials and account creation instructions were also exposed. The indexing of that information on more than one major search engine spread the leaked data far and wide. Containment and mitigation became exponentially more difficult.

There is some reasonably good news in all of this. At this time, it doesn’t appear any of MBIA’s clients were defrauded as a result of the breach—yet. There are also important lessons we can learn from MBIA’s mistakes. Network assets must be carefully administered, as their security is one of the first lines of defense against criminals. In addition, security warnings—whether they’re provided by ethical hackers, concerned customers or automated intrusion detection systems—must be immediately checked out.

We have the tools to thwart thieves.
buy temovate online https://royalcitydrugs.com/temovate.html no prescription

Now is the time to use them.