Website Privacy Policies and Practices – An Insurance Perspective

by Andrew Schulkind

Following up on our recent chat with Amy Goldsmith, today we sit down with Sean O’Rourke to discuss cyber resiliency for small- and mid-sized businesses.

Sean O'Rourke Sean O’Rourke is a cyber liability consultant for Combs & Company, an insurance brokerage and consultancy headquartered in New York City. Sean works with small- and mid-sized businesses to mitigate the financial risks posed to their technology and data by internal and external threats. Sean spent 20 years in the IT arena, so he has a unique perspective on cyber liability and the potential disruptions faced by businesses today’s data-driven world. Sean is also the host of the YouTube channel interview series, Did You Know That?

What exactly is cyber resiliency?

At it’s most basic, cyber resiliency is the ability of a business to survive a cyber incident. My mantra is that when it comes to cyber incidents, it’s a matter of when, not if your business will experience one. So when business and IT talk about cyber, it’s more important, or just as important, to survive an event as it is to prevent one. THIS IS A BUSINESS PROBLEM.

In your estimation, are businesses ready to survive a cyber event?

So the pessimist in me will give you a blanket no. I mean the New York Department of Financial Services just released a report (October 14, 2020) on the Twitter hack that faulted Twitter for not having a CISO [Chief Information Security Officer], standard access controls, multi-factor identity confirmation procedures, among many other standard IT protocols you’d expect a multi-billion dollar enterprise to have in place. The realist in me, though, will tell you that some businesses are more prepared than others, but the majority in the SMB [small- and mid-sized businesses] market, are going to experience serious disruptions to their businesses even from the most basic of cyber incidents.

Before we get to what SMBs can do to be more resilient, can you talk about what types of cyber incidents you’re talking about?

Without getting into the minutiae of various cyber incidents, the ones that most plague SMBs are ransomware attacks, business email compromise fraud, email phishing, and digital data theft. Obviously that list could go on for days, but these are the ones SMBs are most likely to experience.

So why aren’t you advocating for better security to stop these incidents as opposed to surviving them?

Because there’s no way to stop them. If your business is targeted, there’s no amount of money you can spend or technology you can deploy that would stop hackers from getting in. Plus, according to some studies, the majority of cyber incidents are caused by human error. Someone clicks on an email attachment they shouldn’t, or visits a website they shouldn’t, or a myriad of other shouldn’t’s that expose the business. So, defend as best you can, but prepare to properly respond as well.

What does a cyber resiliency plan look like?

At it’s core, a resiliency plan is how a company will respond to a cyber incident. Those companies with a solid plan are a good example of cooperation between the business side of a company and IT.

So how I learned to build one, you first determine your vulnerabilities. Data, core systems, communication tools, and the like. You then prioritize them as to which would be most painful to lose, for whatever reasons. For some companies it will be data; others line of business systems; for some, it may be their phone systems. Once you have them prioritized, then business and IT meet to go over a series of “what if” scenarios for each identified vulnerability. And there will be multiple scenarios per vulnerability.

These tabletop exercises should assign processes, procedures, responsibilities, protocols, and on and on to all business and IT personnel and departments. The plan should take the company from the moment of discovery to the final resolution of a legal or regulatory matter.

And you say small- and mid-sized businesses can do this?

Absolutely. The less IT complexity, the more straight ahead the responses should be. It’s not a matter of cost to build a resiliency plan, it’s a matter of time and will. You have to want to do it and be committed to making it happen. Don’t get me wrong, it’s a lot of work. But at the end of the day, given the current state of cyber affairs, if I still owned a business, I’d sleep better at night knowing this plan was in place.

OK, final question. Where does cyber insurance fit into all of this.

Ideally, the insurance is part of your resiliency plan, not a substitute for it. That said, there’s a current disconnect in the SMB marketplace. Most stats I see say SMBs aren’t investing in cyber insurance and aren’t building resiliency plans, so they’re rolling the dice. That baffles me. Why would you gamble with such a high out-of-pocket expense like cyber when a moderate premium offers such expansive backup protection?

I think the old mindset of “it won’t happen to me,” or, “I have nothing anyone would want” still has a hold. It also doesn’t help that the media virtually ignores the hundreds of thousands of SMBs that have experienced destructive cyber incidents. So they don’t realize they are a target, whether on purpose or by accident. SMBs are in a tough spot, but they do have options. From here, it’s just a matter of whether they take advantage of any.

--- Strategy, Research & Planning ---

Password Safety and Security Tips and Insights

What’s better: long passwords or 8-character passwords that include at least one number, one capital letter, one lower case letter and one “special” character? I recently chatted with Will Hunt of in.security about a favorite geeky topic of mine: passwords. We answer this very question, as well as a bunch of others. Will is full…MORE >
--- Strategy, Research & Planning ---

Coming Changes for Digital Marketing From an SEO and PPC Expert

We’ve worked with Terri Jenkins and her team at Clear Blue Sky Digital for more years than we can count. We’ve come to rely on her for her expertise and business experience, which make all the difference in search engine marketing. It’s not just about the technical aspects. I sat down with her recently —…MORE >
--- Strategy, Research & Planning ---

Marketers Ruin Everything

Remember when email was cool? Before everyone had an email address. Before everyone had even heard of email. The really, really cool kids had “@well.com” email addresses. (That’s WELL as in “Whole Earth ‘Lectronic Link.”) The rest of us had addresses like 92304.1263@compuserve.com. Then there was the huge influx of @aol.com addresses and email wasn’t…MORE >

Cookie	Duration	Description
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-non-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Non Necessary".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Cookie	Type	Duration	Description
_ga	0	2 years	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, camapign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assigns a randoly generated number to identify unique visitors.
_gid	0	1 day	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
.ASPXANONYMOUS	1	2 months	This cookie is used by sites using the .NET technology platform from Microsoft. It enables the site to maintain an anonymous user-id to track unique users within a session without them logging in or otherwise identifying themselves.
GPS	0	30 minutes	This cookie is set by Youtube and registers a unique ID for tracking users based on their geographical location
uvc	0	1 year	The cookie is set by addthis.com to determine the usage of Addthis.com service.

Cookie	Type	Duration	Description
di2	0	1 year	This cookie is set by addthis.com on sites that allows sharing on social media. The cookie is used to track user behavior anonymously to generate usage trends to improve relevance to their services and advertising.
IDE	1	2 years	Used by Google DoubleClick and stores information about how the user uses the website and any other advertisement before visiting the website. This is used to present users with ads that are relevant to them according to the user profile.
loc	0	1 year	This cookie is set by Addthis. This is a geolocation cookie to understand where the users sharing the information are located.
NID	1	6 months	This cookie is used to a profile based on user's interest and display personalized ads to the users.
uid	0	1 year	This cookie is used to measure the number and behavior of the visitors to the website anonymously. The data includes the number of visits, average duration of the visit on the website, pages visited, etc. for the purpose of better understanding user preferences for targeted advertisments.
VISITOR_INFO1_LIVE	1	5 months	This cookie is set by Youtube. Used to track the information of the embedded YouTube videos on a website.

Cookie	Type	Duration	Description
__utma	0	2 years	This cookie is set by Google Analytics and is used to distinguish users and sessions. The cookie is created when the JavaScript library executes and there are no existing __utma cookies. The cookie is updated every time data is sent to Google Analytics.
__utmb	0	30 minutes	The cookie is set by Google Analytics. The cookie is used to determine new sessions/visits. The cookie is created when the JavaScript library executes and there are no existing __utma cookies. The cookie is updated every time data is sent to Google Analytics.
__utmc	0		The cookie is set by Google Analytics and is deleted when the user closes the browser. The cookie is not used by ga.js. The cookie is used to enable interoperability with urchin.js which is an older version of Google analytics and used in conjunction with the __utmb cookie to determine new sessions/visits.
__utmt	0	10 minutes	The cookie is set by Google Analytics and is used to throttle the request rate.
__utmz	0	6 months	This cookie is set by Google analytics and is used to store the traffic source or campaign through which the visitor reached your site.
YSC	1		This cookies is set by Youtube and is used to track the views of embedded videos.

Cookie	Duration	Description
__atuvc	1 year	This cookie is set by Addthis to make sure you see the updated count if you share a page and return to it before our share count cache is updated.
__atuvs	30 minutes	This cookie is set by Addthis to make sure you see the updated count if you share a page and return to it before our share count cache is updated.
na_id	1 year	This cookie is set by Addthis.com to enable sharing of links on social media platforms like Facebook and Twitter
ouid	1 year	The cookie is set by Addthis which enables the content of the website to be shared across different networking and social sharing websites.
um	1 year	Set by addthis.com.(Purpose not known)
vc	1 year	This cookie is set by addthis.com on sites that allow sharing on social media.