Protecting your fintech against cyber-crime

Large or small, no business is immune to the threat of cybercrime.  With ever-increasing reliance on technology, the consequences of a cyber-attack can range from temporary disruption of trading to complete financial failure. 

Cybercrime continues to evolve in terms of frequency, cost and complexity and the shift to homeworking brought about by the COVID-19 pandemic have seen cybercriminals further increase activity resulting in some disturbing statistics:

• In the first 6 months of 2020, there was a staggering 715% increase in ransomware attacks compared to the same period in 20191
• During the pandemic, there has been a reported 600% increase in malicious emails2
• A business is now 15 times more likely to have a cyber incident compared to a fire or theft3

Whilst more companies are starting to purchase Cyber Insurance, the take-up of cyber cover in the UK remains low. According to Hiscox’s 2020 Cyber Readiness Report, 58% of cyber-security professionals surveyed said their organisations purchased a cyber insurance policy””either as standalone or as an add-on to an existing policy””compared to 41% in 2019. 

Some common misconceptions around the need for Cyber Insurance include:

• Cybercriminals only target large companies 

Whilst cyber-attacks against high profile businesses such as British Airways and Travelex hit global headlines, small businesses are unfortunately not immune to cybercrime. 

Small businesses are often considered low hanging fruits by cyber criminals due to a lack of resources to invest in IT security and staff training. In 2019 46% of micro and small businesses experienced at least one cyberattack or breach4

• A traditional insurance programme affords adequate protection for the consequences of a cyber incident.  

Unfortunately, in most cases, this is not the case. Cyber Insurance has evolved specifically to provide protection against emerging risks not catered for by a traditional insurance policy.

•  IT security will provide adequate protection against cyber incident.

Whilst investment in IT security will inevitably make a company less vulnerable to cybercrime, increasingly sophisticated cybercriminals are capable of overcoming even the most robust of security systems

In addition, IT security cannot provide protection against the weakest link in any company’s security systems”“ human error. The UK Information Commissioner’s Office reported that the vast majority (90%) of UK cyber data breaches in 2019 were caused by human error5

The scope of cover provided under a cyber insurance policy may include (but is not limited to):

• Costs to recover and/or recreate lost data and restore computer systems following a security breach
• loss of revenue/profit increased cost of working and loss of future customers due to reputational damage following a cyber event
• Legal liability as a result of a breach of personal data /confidential information
• Inadvertent breach of intellectual property rights via cybermedia 
• Financial loss as a result of social engineering attacks such as phishing scams

Importantly, however, one of the most valuable and often overlooked benefits of a Cyber policy is the critical incident support services provided in the event of a cyber incident to help a policyholder navigate both the immediate aftermath and the longer-term consequences of a cyber attack.

Critical incident support services include:

• 24/7 access to IT forensics, data breach/legal experts and public relations advisers, to provide support in the event of an actual (or suspected) cyber incident
• Support in complying with data protection legislation and notification obligations following a data breach
• Access to specialist ransom and extortion advisers

For more information please contact garry.hill@pib-insurance.com

To the sprinters, the spoils!

The sheer complexity of data protection compliance can make it seem hard to get anywhere fast, but it is possible to get a lot done in a short timeframe, explains Wendy Spires, Consultant at data privacy tech company Trace.

As anyone experienced in this fiendishly complex area of compliance will tell you, data protection is an endurance sport which calls for organisations to stay on top of continually changing rules – and risks – that affect virtually every element of their operations. But while it certainly is a marathon, we’re increasingly seeing our client cover impressive amounts of ground via our “sprint” offering.

Organisations often split into two camps on their data protection today: those who view their GDPR programme as a “one and done” effort which can safely be consigned to the mists of 2018 and those more correctly see compliance as a continual process, but who are frequently daunted by about taking those first next steps.

At Trace, we pride ourselves on being both technically and commercially aware, so that our clients can leverage best practice in data compliance as a competitive advantage. But that also extends to seeing how clients can most fruitfully work with us. For start-ups and scale-ups, dedicating huge amounts of time and resources to data compliance isn’t always option, yet they need quantifiable results, fast. Enter our sprint offering.

Like many of our clients, smartKYC is at the cutting edge of technology as a provider of intelligence monitoring solutions which utilise AI. Also like others, it works in a hotly contested field. Maintaining the highest quality compliance is non-negotiable, but so too are staying ahead of competitive pressures and making data protection really work for the business.

Full steam ahead

By delivering a highly focused, yet flexible sprint programme, Trace was able to showcase the full benefits of our model and bench strength. And it was full steam ahead right from the start.

Our initial data protection audit was enriched by a deep-dive discovery session with management to confirm and lift up new areas to tackle to form a roadmap for the next year. This laid out, we then set about key tasks for the near term.

First among these was to get smartKYC up and running with the Trace privacy management platform, so that Records of Processing Activity and other key documentation were built ”“ and ready to be built further upon. We then drew on our internal auditing and accreditation expertise to tighten smartKYC’s infosec policies and procedures, while also advising on best practices in data retention, human resources, data transfers and more. We were even able to squeeze in some highly valuable work on data ethics and future developments on the technological side.

In short, we were able to get smartKYC’s data compliance programme in pretty good shape in a matter of just a few days ”“ and completely bust the myth that compliance has to be a gargantuan effort, and if you can’t do that then it’s best alone.

With the right focus and a team which understands your business quickly, we are proof that you can get a lot of mileage out of just a few days of support. The prize is staying on the pace on the pace of compliance without a huge commitment in time or costs. We say: to the sprinters, the spoils!