chat:CYBR Episode 5 - Joan Woodward

Well thank you so much for having me. It's an important topic for us to talk about, so I appreciate it.

Well great, thank you for asking. Yes the Institute, The Travelers Institute, which again is our public policy educational platform, we're actually celebrating our 15th year this year. I was approached by our CEO Alan Schnitzer to establish The Travelers Institute as our company's thought leadership and public policy platform. And my mission was really to find ways for our company to leverage its deep risk management experts, 30,000 of us at the company, to be part of an important public policy conversation. So we think of ourselves not just a think tank but we're a do tank. And so we've hosted over a thousand educational events in person, reaching about 500,000 people through the last 15 years in about 200 cities. So we are very proud of our policy work that we do with regulators, legislators, and governors around the country. We also have some live events with our webinar series which is called Wednesdays with Woodward, it's Wednesdays with Woodward at 1:00 Eastern. During the height of the pandemic, and so we've recently launched a podcast, The Travelers Institute Risk and Resilience podcast. So it went from a very small team, innovative powerhouses, we interviewed lots of experts, and I'm very proud to be a part of The Travelers Institute for the last 15 years.

Sure, actually this interview is great timing because October, as you probably know, is Cybersecurity Awareness Month. And we are dedicated to helping business leaders and consumers really learn how to protect themselves. Our Travelers Risk Index, which is something we do every year, cyber risk reclaim the number one spot as a leading concern for business owners across the country. So a cyber event can cause a major operational and financial disruption to an organization, and these risks are really evolving, they are not static. Which is why we think it's important for businesses, especially small businesses, to take preventive measures and really be diligent about their cyber hygiene. And this all started about eight years ago for The Travelers Institute. We've hosted more than 60 in-person events. Just three years ago, President Biden invited technology CEOs, so think about all the big tech company CEOs, and there was one insurance CEO that was invited into that cyber summit with the president, and that was our CEO Alan Schnitzer. He was asked to join the meeting really to talk about cyber insurance. And just talking about cyber insurance really does allow business owners to focus on what's important. And we reaffirmed our commitment to working across the government and industries to help advance cyber education. And that's part of our Cyber Prepare, Prevent, and Restore national series that you came to, and it sounds like it was interesting.

Yeah, those who responded to our survey, we had about 600 plus CFOs, Chief Financial Officers took this study. They listed a number of concerns. We're glad that cyber was certainly on the list; about half listed cyber as their number one main challenge they face when managing risk. But they're a real concern for all businesses, very small mom and pops up to the larger. We see in stories all the time that big companies get impacted a lot, and also infrastructure gets impacted, waterways, electrical grid. In recent years there's been a lot of hacks and attacks. But a single breach can result in significant cost and damage, loss of consumer confidence in your company, financial harm, legal challenges, and business interruptions. So given today's climate, it's really imperative that business leaders have the tools they need to prepare for and respond to cyber attacks. Most people believe you've either been hacked already or you're going to be hacked. And that CFO study really did reinforce that to us.

Sure, and all of these are on our TravelersInstitute.org website if you don't want to write them down or I'm going too fast. TravelersInstitute.org. There are five things you need to do to get ready for a potential cyber incident. And the first thing we talk about is MFA, multi-factor authentication, to verify a user's identity before granting access. MFA uses authentication factors that fall into two or three categories: number one, something you know, such as your username or your password; something you have, such as a one-time code texted to you on your phone or authenticator app; and something that verifies who you are, such as a fingerprint or iris scan. So MFA is number one. Number two is securing your network with updates, we should also patch, patching our programs to protect their software is number two. Third is enhance your defenses with endpoint detection and response. That endpoint detection and response (EDR) solution is more sophisticated than traditional antivirus software, checking both software and user behaviors on a system. It watches what users do and can stop that suspicious activity by triggering alerts. Number four is really talking to your company individuals, your people who work for you, your employees about an incident response plan. Company leaders should have an incident response plan on the shelf, it should be updated every six months or every year, and it should be practiced. So that incident response plan is going to tell everyone what to do. And don't forget to print it, don't just have it on your cloud or on your laptops, print a copy and hand it out to your employees. The last one is building cyber resilience with backups. Be sure to inventory your data, decide how frequently data should be backed up, and if your organization suffers a cyber attack, know how to restore the systems and files to get your business up and running quickly. So those are our five best practices.

Sure, and this is actually not that complicated to be honest with you. We sell a cyber insurance product. What does that mean? It means that if you are breached or hacked, you have insurance to help you with a breach coach, with data and privacy notifications to your customers. If personal identifiable information, such as a lot of healthcare companies have, notification, 50 different states have 50 different laws, so this is complicated stuff. What if you're hit with a ransomware? Insurance is there potentially to pay some part of that ransomware for you if you choose to pay the ransom. So even before buying the cyber insurance, we take companies through a journey of preparing themselves for a potential cyber hack. So it's not just buying the insurance and letting it sit on the shelf; it is implementing these five best practices we talk about so you're much more cyber secure. Having insurance, but we make sure you're cyber secure before you even buy the insurance, and that's the process that we think is really critically important. So we always recommend talking to an insurance agent or broker to talk about your specific needs for your company. But this is an insurance product that's been evolving over the last 10 to 15 years and will continue to evolve because these bad actors on the dark web, they're not stopping; they're innovative in how they're attacking different businesses, and they're becoming smarter. So we need to be one step ahead of those bad actors.

Yeah, I tell people being proactive is really key. It's crucial that businesses educate your employees and put proper risk management systems in place. Test your employees, send those phishing emails, and when someone clicks on that link they're not supposed to, talk to that person about why they clicked on that link. So educating employees number one. The other little-known agency at the federal government at the Department of Homeland Security, which was created about five or six years ago, it's called CISA, Cybersecurity and Infrastructure Security Agency, and they are crucial in providing free, I'm going to underline that free, complimentary, your tax dollars already paid for this, services for businesses. You can get a free cyber risk assessment for your business through that government agency. So look up CISA.gov, C-I-S-A.gov, and they will help you navigate all these complicated issues for businesses. And most importantly, ensure that a company has proper protection by seeking that insurance coverage, that cyber insurance product, critically important.

Sure, we can only succeed as a business if our communities do too. And so we are dedicated to helping those businesses and nonprofits worry about their evolving cyber risk. So we always keep a pulse on these issues to affect our customers. And The Institute is going to continue to host these free informational events to help agents and brokers and the broadest business community get these tools and resources. So again, TravelersInstitute.org is the place you should go, not only to learn more about cyber hygiene and how you become more cyber prepared, but also a place you could watch our webinars. We've done 150 webinars over the last five years, and a lot of those webinars are focused on cybersecurity. We do in-person events as I said, we've done almost 60 in the last eight years. So look on our website for places we'll be in the next 6 to 12 months; we always publicize that. You can connect with me on LinkedIn, Joan Woodward at Travelers. And I'm very active on LinkedIn and I post a lot of content. It's free and available to the public. And we feel an obligation, responsibility as a large insurance company to educate consumers, the business community, government officials. We have a terrific partnership with Department of Homeland Security and CISA, and they come with us on our road show and they talk to business community about what's important and how to protect themselves while managing risk well.

Certainly. Well it was a pleasure, and again, free resources, why not use them, right?

Thanks for having me.