Cyber Insurance and Corporate Governance: Facing New Threats

With the ever-increasing scale of interconnected information systems, concerns about cyber security dangers and threats increase daily. NYU Tandon School of Engineering (formerly known as NYU Polytechnic School of Engineering) Cyber Security Lecture Series provides an arena for high-level discussion among world-class scholars and practitioners. Sponsored by the Alfred P. Sloan Foundation, lectures and panel discussions are designed to raise the visibility of risks and issues, including personal privacy. Internationally renowned experts join together to stimulate collaborative thinking, especially among New York's regional businesses, government agencies, nonprofits, academic institutions, media, and the public. Practical and timely, the series also focuses on possible strategies that address the impact of growing risks.

Lecture 1: Cyberspace Allies: How Public / Private Partnerships Can Fight Back

Once we became deeply dependent on the Internet, business, government, and our critical infrastructure fell vulnerable to serious security risks. Early on, we recognized that strategic weaknesses can be exploited by foreign agents, resulting in catastrophic failure of our power grid. Transportation systems, and other vital civic arteries. Today, new threats have emerged from criminals who exploit private computers, steal intellectual property, and engage in espionage. Noted expert Marcus H. Sachs, supported by a distinguished panel of fellow cyber experts, examine these Internet threat groups, separating media hype from what is really happening. Sachs and his colleagues call for a power partnership between public and private sectors to protect and secure cyberspace security.

Lecture 2: DEFENDING CYBERSPACE: Are We Ready?

In NYU Polytechnic School of Engineering’s second, eagerly anticipated Sloan Cyber Security Lecture, the National Security Agency’s Information Assurance Director discusses current cyber security threats, vulnerabilities and trends. Debora A. Plunkett outlines critical steps that must be taken to ensure our nation is ready to meet future cyber security challenges. While exploring key technology trends affecting our security posture, IA Director Plunkett highlights the importance of building a robust cyber workforce. Continuing the theme covered by the first lecture in the series, Ms. Plunkett underscores the essential importance of strong industry, government, and academic partnerships, and highlights the tactical benefits of information sharing. The lecture concludes with a call to introduce standard processes and practices, across industry and government, to combat the growing cyber threat.

Lecture 3: RECLAIM YOUR NAME: Privacy in the World of Big Data

In NYU Polytechnic School of Engineering’s third, eagerly anticipated Sloan Cyber Security Lecture, Federal Trade Commissioner Julie Brill explores the expanding collection and use of Big Data in the marketplace, recognizing the challenges it presents for consumers and businesses--as well as for agencies like the Federal Trade Commission, responsible for safeguarding both. Commissioner Brill embraces the enormous benefits offered by Big Data analytics, but also believes it presents fundamental challenges to traditional notions of individual privacy. She encourages the highly decentralized community of Big Data purveyors to adopt practices that follow laws that already govern the way data can be used and calls for industry to engage in robust de-identification of consumer data. She concludes by taking us through her comprehensive initiative, "Reclaim Your Name," to give consumers knowledge and tools to reassert control over their personal data.

Lecture 4: Reducing the Nation's Cyber Risk: White House Insights on the President's Critical Infrastructure Framework

President Obama's Cyber Security Executive Order 13636 calls for an intensive effort to adopt a common national Framework aimed at reducing the cyber risk to our country's critical infrastructure. This event, featuring the White House Director of Critical Infrastructure Cybersecurity, Samara Moore, together with a panel of senior Administration officials, explores the wide-ranging impact the President's new policy will have on US industry. The White House Director will address the implications of the new Cybersecurity Framework on nearly all industries. Speakers provide insight on the proposed Framework on such critical infrastructure sectors as energy, finance, healthcare, communications, transportation, water, chemicals, IT, defense, manufacturing, and nuclear, among others. If you are responsible for cyber infrastructure, or if you are a supplier of goods or services to any organization in the DHS Critical Infrastructure you will be impacted. Be among the first to learn how the President's action will affect your company.

Lecture 5: Surviving on a Diet of Poisoned Fruit: Reducing the Risks of America’s Cyber Dependencies

In his Distinguished Lecture, Richard Danzig proposes strategies for coping with a security paradox presented by cyber systems: As digital systems grant us unprecedented powers, they also make us less secure. While their immense communication capabilities enable wide scale collaboration and networking, they open doors to unprecedented intrusion. Concentrations of data and manipulative power vastly improve efficiency and scale, but these attributes increase the amount that can be stolen or subverted by successful attack. While we are now empowered to retrieve and manipulate data on our own, this beneficial “democratization” removes a chain of human approvals that served as safeguards. In sum, cyber systems nourish us, but at the same time, they weaken and poison us. Wise strategies, aimed at safeguarding the nation's data storehouse of vital information, must embrace a mix of technical responses, economic and business judgments, and policy choices. Focusing on Federal government vulnerabilities--but noting implications for all users--Dr. Danzig argues that we are not doing nearly as well as we could and recommends several paths to improvement.

Lecture 6: Cyber Insurance and Corporate Governance: Facing New Threats

While fears of “Cyber Pearl Harbors” dominate headlines, many of the most costly cyber attacks are better characterized as acts of theft, jeopardizing some of the most valuable assets US companies possess. With intrusions targeting vulnerable intellectual property and the personal information of millions, US corporations have struggled to build adequate corporate governance frameworks to manage risk in the face of cyber breaches. While insurance generally plays a critical role in corporate risk management, serious obstacles stand in the way of creating a robust cyber insurance market.

Today, company executives confront many difficult questions: Should corporations collaborate closely with government to investigate cyber incidents? How should companies navigate inconsistent demands of proliferating cyber security regulators and civil litigants? How can we manage the rapidly expanding liability landscape successfully?

In this sixth Sloan Cyber Security Lecture, Peter Hancock, President and CEO of AIG, together with a panel of cybersecurity experts, explore how we might improve our ability to protect against the mounting losses from breaches. Is there a role for the insurance market in helping companies create a sophisticated cybersecurity risk management framework? What are the most intractable obstacles in the development of robust cyber insurance options? And how might the insurance industry collaborate with other risk management options to form a comprehensive approach to cyber threats?

Lecture 7:The Coming Age of the Internet of Things

Soon many billions of heretofore disconnected devices will be outfitted with Internet access and equipped with software. These appliances will be able to accept control from authorized parties and to emit information that can be used for management and analysis. The introduction of these devices poses a wide range of questions that must ultimately be answered—

• How do I configure large numbers of new devices into my network?
• How do I avoid configuring someone else's devices accidentally into my network and vice versa?
• How does a device know it is talking to an authorized agent?
• How can I grant temporary access to devices to guests, law enforcement, fire departments, third parties?
• How do I revoke access to third parties?
• How can I keep transactions involving these devices private?
• How do I allow guest's devices to become part of my network temporarily?
• How does the Internet of Things affect my daily life? My business? My social relationships?
  My health? My privacy? My security?
• What new businesses might arise as a consequence of a proliferation of Internet-enabled devices?
• What if there are bugs in these devices? How can updates be performed securely? By only authorized parties?

In his distinguished Cyber Security NYU Engineering/Sloan Foundation Lecture, Internet pioneer Vinton G. Cerf does not claim to answer all of these questions, but says it’s important to ask them and to seek answers.