Under the Radar Industries Prime for Cyber Hackers

Enticed by these four industries' high customer volume, access to personal data and trade secrets, cyber thieves have no reservations attacking entities in these industries. What makes them vulnerable are the numerous access points into the network and high employee turnover.

For example, some hospitals now have a laptop in almost every patient room as well as on service carts that are often left unattended in hallways as nurses move about the floor. In higher education, thousands of students, alumni and professors can be in a college's system.

Bob Russo, GM of the PCI Security Standards Council, has stated that “franchised hospitality locations are at an exponentially greater risk. Standardization of computer systems among the franchise (and hospitality) models is common and, in the event a security deficiency exists within a specific system, deficiencies will be duplicated among the entire franchise base.”

Law firms are also at a higher risk because they generally allow every employee access to their entire network of client files.

Unfortunately, the common belief is that many businesses in these industries are not implementing best security practices due to the lack of industry standards, poor implementation of software and security, and the overall nature of these industries where broad access into the network is common.

Verizon's 2016 Data Breach Investigation Report places hospitality, healthcare and education among the top eight industries having the largest number of security incidents with confirmed data loss. And just when things can't look worse, ransomware is exploding across the cyber universe. Make no mistake, each of these sectors maintain valuable data that criminals have myriad ways to monetize. Financial motive remains by far the number one factor for perpetrating cyber crimes.

Tips to Manage Your Cyber Risk

Given that cyber criminals have identified four industry sectors as soft targets, what can be done to deny the criminals? Here are 10 tips from industry watchdogs:

1. Minimize data collection. If it's not needed, then do not collect it.
2. Understand and comply with PCI-DSS. Make sure the business is completely aware of its “cardholder data environment” and is providing appropriate protections.
3. Find and digitally shred unneeded information. Old, forgotten data is dangerous. Don't be “data blind” ' eliminate what you no longer need.
4. Limit access. Employees should be on a “need to know” basis with PCI and HR data.
5. Split up the network. Create electronic firewalls that limit the spread of viruses and attacks.
6. Encrypt. Proper encryption renders hacked data unusable.
7. Understand the network. Review network logs for unauthorized activity, and make sure the security professionals do, too.
8. Security is not just for IT professionals. Make sure the entire organization creates and respects a culture of privacy that prioritizes security as the basis for all of its operations.
9. Have a comprehensive incident response plan in place. Test it regularly through desktop exercises.
10. Work closely with the broker and an insurance coverage attorney to procure appropriate data privacy insurance.

One major source of the problem is employee negligence. Phishing attacks remain a potent method to infiltrate a network. Because these four industries have such large numbers of people in the system, the likelihood of success for the hacker is even greater.

The Verizon report notes that, in a testing of employees, 30% will open a test phishing message, and another 12% will click on it. These numbers are a dramatic rise from the last two years. Employees remain the weak link in network security, and this is a huge source of vulnerability to these industries. Employee education and training are highly critical; employees must be educated on why the rules are in place and how their missteps can create catastrophic exposure to their firm or company.

Checklist for Purchasing Data Privacy Insurance

This last point cannot be stressed enough. The market for data privacy insurance continues to evolve as insurers use vastly different forms to write the coverage. Because of the disparity in the policies, where the devil is truly in the details, it is imperative for these vulnerable industries to be more proactive in purchasing cyber insurance. Here are some tips in placing data privacy coverage:

• Use a team approach in purchasing cyber insurance ' insured, broker, coverage counsel.
• Understand your risk profile.
• Review existing coverages to know what is already available in your current program.
• Put into place other data privacy coverage as needed.
• Understand that data coverage is broader than just “cyber.”
• Ensure there is coverage for using cloud services.
• Negotiate for a retroactive date of at least one year.
• Know what legal counsel and vendors will be supplied by insurers.
• Carefully review the insurance application.

Because these four industries do not see themselves as likely targets, they have been behind in considering and placing data privacy insurance. That is a mistake. The costs associated with restoring data, closing the entry point into the network, and public relations can be huge. These industries need to realize that the major costs in a data breach incident are not related to liability to customers, but to internal costs. Shifting the risk to insurers needs to be a critical part of any data privacy program.

Ransomware: The Next Frontier

According to a report from Intel Corp.'s McAfee Labs, the number of cyberattacks where malware holds user data “hostage” is expected to grow in 2016 as hackers target more companies and advanced software is able to compromise more types of data. See, “2016 Threats Predictions.”'

Malware encrypts files on a system's hard drive using an unbreakable key, and this is decrypted by the attacker once a ransom is paid, typically by online currency, such as Bitcoin. The malware is usually delivered via e-mail, which makes the hospitality industry particularly susceptible in light of current trends to communicate with customers through e-mail.

The best defense is a robust backup of all data in an offline environment. Companies must also ensure their computer networks are regularly updated with security patches. Jens Monrad, systems engineer at FireEye, notes that “most malware will execute with the same privileges as the victim executing the payload. If the person getting compromised has local or global administrative privileges, the malicious code will have access to the same resources.”

Cyber insurance is the ultimate backstop in a cyber extortion situation. It can pay the ransom as well as the cost of restoring the network. But remember, it is critical that the insurance be properly placed at inception to ensure the coverage is there when needed.

The Scope of the Problem Is Growing

This year is likely to see a new rash of high-profile breaches in these industries. Hotels, management companies and restaurants are all vulnerable and remain prime targets for criminals. Smaller healthcare and higher educational institutions are ripe for ransomware attacks to extort payments. Law firms and their highly sensitive data make them perpetual targets for the organized crime sector. As the saying goes: “It is not if you will be hacked, but when.” When it comes to deterrence, the best defense is an aggressive offense. Now is the time for action.

Collin Hite leads the Insurance Recovery Group and the Data Privacy & Security practice at the law firm of Hirschler Fleischer in Richmond, VA. He may be reached at 804-771-9595 or by e-mail at [email protected].