National Cyber Security Awareness – Setnor Byer Insurance & Risk

It’s hard to ignore the fact that data security breaches seem to be increasing in frequency and severity, particularly those involving credit and debit card data. Just ask Home Depot, Michaels Stores, Neiman Marcus, or their 50+ million customers whose payment card data may have been compromised in 2014. To reduce the chances of making the list in 2015, preventative measures must be taken by every business that accepts credit and debit card payments.

The PCI Security Standards Council developed the Payment Card Industry Data Security Standard (PCI DSS) to encourage and enhance cardholder data security. This standard includes 12 requirements.

Build and Maintain a Secure Network and Systems

Install and maintain a firewall to protect cardholder data.
Do not use defaults for system passwords or security parameters.

Protect Cardholder Data

Protect stored cardholder data.
Encrypt transmission of cardholder data.

Maintain a Vulnerability Management Program

Protect systems against malware and regularly update anti-virus software.
Develop and maintain secure systems and applications.

Implement Strong Access Control Measures

Restrict access to cardholder data to those who need to know.
Identify and authenticate system access.
Restrict physical access to cardholder data.

Regularly Monitor and Test Networks

Track and monitor all access to networks and cardholder data.
Regularly test security systems and processes.

Maintain an Information Security Policy

Maintain a policy that addresses information security for all personnel.

The PCI Security Standards Council also provides a number of tips and strategies to increase the security of payment card data, such as:

Never store Sensitive Authentication Data, such as the full track contents on the magnetic stripe or chip, card verification codes/values, or PINs.
Ask point-of-sale vendors about the security of payment card systems.
Do not store cardholder data that is not needed.
Consolidate and isolate cardholder data that is needed.

The Council notes that the PCI DSS provides minimum security requirements that may be enhanced by additional controls and practices. Various laws, rules or regulations may also require enhanced security measurers. For example, under the Fair and Accurate Credit Transaction Act (FACTA), electronically printed credit and debit card receipts given to customers cannot include a card’s expiration date or more than the last five digits of the card number.

Sometimes security measures aren’t enough to prevent a data security breach, so businesses should use insurance to manage their cyber risks. There are a number of cyber liability products that protect against privacy injuries, such as identity theft, and that cover the cost of complying with various data breach notice laws. However, given the complexity of the risk, an experienced insurance agent should be consulted to ensure that adequate coverage is obtained.

A solid understanding of your insurance needs is the key to overcoming the quality versus cost argument. An experienced and reputable independent insurance agent can help you purchase insurance that is both economical and effective.

If you would like to learn more about insuring against cyber risks, contact us.

If you would like to subscribe to our newsletters please click here.

According to the Federal Trade Commission, identity theft continues to top the list of consumer complaints. In 2013, American consumers reported losing more than $1.6 billion to fraud, which is approximately $2,294 per incident. The highest reported age group for identity theft is 20-29, and the most common form of identity theft is tax- or wage-related, followed by credit card fraud, utilities fraud and bank fraud. Florida has the highest per capita rate of reported identity theft complaints, followed by Georgia and California.

Since October is National Cyber Security Awareness Month, now is the perfect time to learn about preventing identity theft. Here are some tips from the Insurance Information Institute.

Don’t carry unnecessary personal information (social security card, passport, etc.).
Prevent ‘shoulder surfers’ from seeing credit card numbers or PINs.
Always take credit card or ATM receipts.
Don’t give out personal information, whether on the phone, via mail or online, unless you initiated contact or you know the transmission will be secure.
Only use authenticated websites to conduct business online. Check for the locked padlock image or look for ‘https://’ rather than ‘http://’ in your browser window.
Be aware of phishing and pharming scams that use fake emails and websites to impersonate legitimate organizations. Exercise caution when opening emails and instant messages from unknown sources.
Never send personal, financial or password-related information via email.
Use up-to-date firewall, anti-spyware and anti-virus programs.
Monitor all financial accounts and review monthly statements to make sure all transactions are accurate.
Immediately contact your credit card or bank if you suspect a problem.
Order your credit report from the three major credit bureaus to make sure it’s accurate and includes only authorized activities. You are entitled to one free credit report per year.
Place passwords on your credit card, bank and phone accounts.
Don’t use passwords containing easily available information (mother’s maiden name, birth date, phone number, etc.) or any series of consecutive numbers.
Change passwords if you suspect a problem.
Shred documents containing personal information such as credit card numbers, bank statements, charge receipts or credit card applications.

In the event of identity theft, early detection is the key to limiting the damage. Here are some clues from the FTC that someone may have stolen your identity.

You see withdrawals from your bank account that you can’t explain.
You stop getting bills or other mail.
Debt collectors call you about debts that aren’t yours.
You find unfamiliar accounts or charges on your credit report.
The IRS notifies you that a tax return was already filed in your name.
A company where you do business or have an account suffers a data security breach.

Despite taking preventative measures, identity theft can still happen. However, insurance may be purchased to help victims of identity theft through the often expensive and time consuming battle to clear their name. Depending on the insurance company, identity theft coverage may be included under a homeowners’ policy, or it may be added by endorsement or obtained under a separate, stand-alone policy.

If you would like to learn more about identity theft insurance coverage, please contact us.

If you would like to subscribe to our newsletters please click here.