[et_pb_section fb_built="1" _builder_version="4.0.9"][et_pb_row _builder_version="4.0.9"][et_pb_column type="4_4" _builder_version="4.0.9"][et_pb_text _builder_version="4.0.9" hover_enabled="0"]<h1 class="headArticle" style="text-align: center;"><span style="color: #000000;"><strong>Surge in working from home raises cyber exposure issues</strong></span></h1>
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row _builder_version="4.0.9"][et_pb_column type="4_4" _builder_version="4.0.9"][et_pb_text _builder_version="4.0.9"]<div id="mntl-sc-block_1-0" class="comp mntl-sc-block finance-sc-block-html mntl-sc-block-html" style="text-align: justify;">
<div id="mntl-sc-block_1-0" class="comp mntl-sc-block finance-sc-block-html mntl-sc-block-html">
<div class="smallmugshot"><img src="https://bicontent.businessinsurance.com/0cccd928-c00a-481c-a7ce-4c174afdd455.jpg" alt="cyberattack" /></div>
<p class="pricingbox"></p>
<div id="dvContent">
<p><span style="color: #000000;">Companies directing large numbers of employees to work from home for the first time because of the coronavirus pandemic face a host of cybersecurity issues, including concerns over the security of workers’ personal computers and vulnerability to phishing attacks.</span></p>
<p><span style="color: #000000;">In addition, data lines may be strained as the number of staffing corporate systems remotely surges.</span></p>
<p><span style="color: #000000;">While it’s likely that many problems would be covered by cyber insurance or other policies, now is a good time for firms to review their policies, experts say.</span></p>
<p><span style="color: #000000;">Meanwhile, employers should reinforce the need for employees working from home to follow best “cyber hygiene” practices, including using two-party authentication; being sure their systems have the latest security updates and patches; that employees back up their data; and that they are warned about the proliferation of phishing scams as cyber criminals try to turn the crisis to their advantage, they say.</span></p>
<p><span style="color: #000000;">“The problem is, we’re suddenly pushing out a very large contingent of the folks who work for you, and not all of them may be sophisticated telecommuters,” said Robert Parisi, New York-based managing director and cyber product leader for Marsh LLC.</span></p>
<p><span style="color: #000000;">Those who work from home on a regular basis “already know the drill,” but people who are not used to telecommuting are in an environment “that’s emotionally stressful and that’s going to create problems,” Mr. Parisi said.</span></p>
<p><span style="color: #000000;">Small- to medium-sized firms that may have not previously addressed remote access and telecommuting may see the most acute problems, he said.</span></p>
<p><span style="color: #000000;">Thomas Srail, executive vice president, cyber risk team, for Willis Towers Watson PLC in Cleveland, said over the past week many employers had a test day for working remotely, keeping staff home for a day and testing remote connections.</span></p>
<p><span style="color: #000000;">The results have been “kind of a mixed bag,” with professional services organizations that have many travelers “probably finding it easier vs. more traditional employers who don’t have a lot of traveling,” Mr. Srail said.</span></p>
<p><span style="color: #000000;">Companies should ensure they have procedures in place, Mr. Parisi said.</span></p>
<p><span style="color: #000000;">Employers must have a secure way for employees to access systems, which usually means a virtual private network, or VPN, said Tedrick A. Housh III, a partner with Lathrop GPM LLP in Kansas City, Missouri, who focuses on data security and privacy. </span></p>
<p><span style="color: #000000;">“If you have a lot of people working off of their own computer devices, you’re of course counting on the fact that they have practiced good cyber hygiene at home, meaning do they patch and update their systems regularly and do they have high-quality protection on their computers,” said policyholder attorney Joshua Gold, a shareholder with Anderson Kill P.C. in New York.</span></p>
<p><span style="color: #000000;">“And, of course, you have to hope that people, when they’re at home, are doing the smart things” by logging out of their computer systems, using strong passwords and keeping their computers in secure places in their homes, even “where obviously the employer is not going to be able to do too much quality control checking,” Mr. Gold said.</span></p>
<p><span style="color: #000000;">Employees should be trained that any sensitive data that is on the network is behind a VPN that is using multifactor authentication, said Stephanie Snyder, Chicago-based senior vice president and commercial strategy leader for cyber solutions with Aon PLC.</span></p>
<p><span style="color: #000000;">Another concern is many people have internet of things devices in their homes, from nanny cams to appliance-based software or hardware, that “can provide an opportunity for someone to overhear, or see, things that the person’s doing at work,” Mr. Housh said.</span></p>
<p><span style="color: #000000;">Mr. Gold said some employers issue company laptops to employees, which is the safest way to address the computer security issue, but that accounts for a just a fraction of organizations. </span></p>
<p><span style="color: #000000;">He said the issue evokes the concerns of several years ago, when “bring your own device” to work was a major issue, though it’s now largely permitted. </span></p>
<p><span style="color: #000000;">Employees may also work out of coffee shops, in cities and states where they remain open, which use insecure public Wi-Fi, said Dan Burke, San Francisco-based national cyber practice leader for Woodruff Sawyer &amp; Co. </span></p>
<p><span style="color: #000000;">Lindsey Nelson, London-based cyber development leader for CFC Underwriting Ltd., said 80% of cyber incidents, including ransomware, last year were initiated through remote desk protocols and logins. </span></p>
<p><span style="color: #000000;">“Many cyber criminals are now capitalizing on the opportunity” presented by the coronavirus outbreak with phishing campaigns, sending out emails inviting employees to click on links to malicious software that purportedly presents health  safety measures, Ms. Nelson said.</span></p>
<p><span style="color: #000000;">Employees may also be misled by emails appearing to be from their own information technology departments requesting credentials, Ms. Snyder said.</span></p>
<p><span style="color: #000000;">John Farley, New York-based managing director of cyber for Arthur J. Gallagher &amp; Co., said people working from home may be more likely to receive emails purportedly from company officials but actually from cyber criminals requesting fund transfers, where normally this would be handled person-to-person. </span></p>
<p><span style="color: #000000;">Experts say cyber-related events are likely to be covered by corporate cyber policies, even if they stem from an employee working at home. “If it’s going to be a pure cyber incident, such as a breach, or something driven by cyber, working from home wouldn’t change that. That’s typically not excluded,” said Anthony Dagostino, New York-based global cyber and technology practice leader for Lockton Cos. LLC, although firms should check their policies to confirm the definition of computer system is broad enough to include employees working from home.</span></p>
<p><span style="color: #000000;">Scott N. Godes, partner with Barnes &amp; Thornburg LLP in Washington said, “I’m not aware of insurance carriers that have denied coverage under cyber insurance policies for cyber events that happened” while employees were using their own computer, he said.</span></p>
<p><span style="color: #000000;">However, Mr. Srail said if a claim is tied to a home computer, “a forensic investigation may involve people’s home network,” which could add “some complicating factors to the claim,” and “increase the expense and the time it takes to figure out some of the factors involved in a particular incident.”</span></p>
<p><span style="color: #000000;">Mr. Gold said one possible issue is when employees bring unencrypted data home on thumb drives. “I’ve seen some insurance companies have exclusions in their policy where, if storage devices have unencrypted data, they will not pay those claims.” Any sensitive data taken outside of the office on a thumb drive should be encrypted, he said.</span></p>
<p><span style="color: #000000;">Mr. Dagostino said also that the insurance market is in transition with insurers moving to explicitly include or exclude cyber coverage in traditional policies. Because not all these policies have renewed “there’s the potential there are going to be different responses” in the event of an incident, he said.</span></p>
<p><span style="color: #000000;">Employers should review their coverage and make sure their work-from-home policies are designed to ensure that coverage exists should something happen, said Daniel S. Marvin, a partner with Morrison Mahoney LLP in New York, who is co-leader of the firm’s cybersecurity, privacy and data protection  practice.</span></p>
<p><span style="color: #000000;">“I don’t know if it’s the time to implement a lot of new processes and procedures, but I do think (companies) should be re-enforcing the ones they have,” Mr. Dagostino said.</span></p>
<p><span style="color: #000000;">As to how many cyber-related claims the coronavirus crisis is expected to create, “it depends on how sophisticated the social engineering schemes are, and how well educated the workforce is to recognize those threats,” Mr. Farley said.</span></p>
<p><span style="color: #000000;">The expansion of telecommuting also heightens the risk of  business interruption losses as businesses’ systems, which do not normally deal with a significant number of employees signing in from home, become overwhelmed.</span></p>
<p><span style="color: #000000;">Many organizations have only so much capacity available for VPNs, and it is incumbent upon them “to ensure there is adequate security” for any type of alternative network access, Ms. Snyder said.</span></p>
<p><span style="color: #000000;"></span></p>
</div>
</div>
<div id="mntl-sc-block_1-0-21" class="comp mntl-sc-block finance-sc-block-html mntl-sc-block-html">
<p><span style="color: #000000;">You can see the original post</span> <a href="https://www.businessinsurance.com/article/20200317/NEWS06/912333556/Surge-in-working-from-home-raises-cyber-exposure-issues">here</a>.</p>
</div>
</div>
<div id="mntl-sc-block_1-0-44" class="comp mntl-sc-block finance-sc-block-html mntl-sc-block-html"></div>[/et_pb_text][/et_pb_column][/et_pb_row][/et_pb_section]