Cyber Insurance - Mandatory

Cyber Liability addresses the first- and third-party risks associated with e-business, the Internet, networks and informational assets. It offers protection for exposures arising out of Internet communications and breaches in security such as attacks from malware, lost or stolen equipment (laptops, jump drives, tablets, etc….) and attacks or damage done by disgruntled employees. The risk categories include privacy issues, the infringement of intellectual property, virus transmission, or any other serious trouble that may be passed from first to third parties via the Web.

The concept of Cyber Liability takes into account first- and third-party risks. Third party risk are those risk or liabilities that the WNYRIC has due to the services we provide where information is transferred, handled, stored, manipulated or viewed by the WNYRIC on behalf of the districts we serve. First party risks are those risks that Erie 1 BOCES incurs when Erie 1 BOCES is handling information pertaining to its staff/students, and it only involves Erie 1 and not another district. For example if we had a breach in our system that caused the release of personal and private information about our employees or our workforce development students.

Why do we need cyber liability insurance?

Traditional liability products do not address internet exposures or the housing and transfer of data on computers. The risks involved in breaches of this type of information have increased significantly over the last couple of years. The cost of a breach in data can include legal fees and settlements; crisis response, including required customer notifications; and business interruption costs and fines.

More and more auditors and insurance companies are asking our districts about the coverage Erie 1 BOCES holds as part of their WNYRIC technology services.

With the recent P-2 regulations concerning student data security, it is important to make sure districts are protected from breaches and the cost of such breaches.

Cause of Data Loss

Ninety-five percent of the breaches are caused by one of three things: hackers, rogue employees, or loss/theft of equipment.

• Hackers caused 32 percent of breach events and were responsible for 75 percent of all exposed records. Industry experts concur that these incidents can be directly attributed to increased use of malware.
• Rogue employees— Increased layoffs due to downsizing and generally poor economic conditions coupled with the relative ease of selling stolen information is another growing concern. Findings show rogue employees to be the second largest cause of breaches, comprising 19 percent of breach events.
• Loss or theft - Lost or stolen equipment like laptops, back up tapes, smartphones, and USB drives made up 15 percent of data breach incidents. Another 7% comes from lost paper documents.

When is a district liable?

The district may be responsible for the cost if there is negligence on the part of district employees or due to district procedures/practices inconsistent with WNYRIC guidelines. If the breach involves only district employees and district equipment, that is considered a first party breach for that district and will not be covered. To be clear, the Erie 1 BOCES Cyber Insurance only covers breaches that involve BOCES owned equipment or BOCES and district owned equipment where BOCES employees may be involved in or may have created the breach.

What can districts do to protect themselves?

Review your internal procedures and practices involving:

• Data storage on mobile devices
• Password requirements
• Firewall settings
• Patching and updates on software and equipment
• Staff acknowledgement of acceptable use policies
• Staff development/awareness of hazards of breaches and the practices they can follow to avoid breaches
• Remove or upgrade computer whose operating systems no longer include patching (i.e. Microsoft XP, Microsoft Windows Server 2003)

Talk to your insurance carrier to see how you can obtain first party coverage.

What coverage does Erie 1 BOCES/WNYRIC have?

Erie 1 BOCES/WNYRIC purchased both first-party and third-party coverage for computer expert services, legal services, public relations and crisis management response. This would include paying the cost associated with notifying individuals of an unauthorized release.

What is covered?

The coverage will protect Erie 1 BOCES/WNYRIC and the school districts that we provide services for, in the event that there is a breach of data by any method, including but not limited to computer hacking, disgruntles BOCES employees, or lost/stolen BOCES equipment. In such an event, this insurance will cover cost of notification to impacted people; legal fees; computer investigations (forensics); cyber extortion cost; public relations and crisis management costs.

It will NOT cover breaches created by district staff or loss of district equipment containing data. In the event of any breaches, the insurance company will investigate to determine the cause. It does NOT cover cost for stolen equipment. This is covered under Erie 1 BOCES/WNYRIC’s Inland Marine coverage. It also does not cover lawsuits dealing with personal liability or damage created by such breaches. This is covered under our general liability insurance.

The WNYRIC staff will work individually with requesting districts to determine the most effective implementation for this service.

Provide qualified/responsible personnel to perform needed functions of daily technical activities for the district's technology department.

Provide necessary training for WNYRIC personnel to keep current with new technology.

The WNYRIC utilizes cost effective best practices determined by research from Gartner and Info Tech that allows our experienced and trained technical staff to perform robust testing and piloting on the WNYRIC Network in the areas of; security, infrastructure engineering and design, energy management, virtualization strategies, disaster recovery and business continuity, effective monitoring and pro-active analysis customized for K12 educational environment. By following these principles we are able to be a District advocate for vendor contract issues and aggressively negotiate contract pricing and performance terms.

WNYRIC Service desk is available Monday through Friday from 7:00 a.m. to 4:30 p.m.