Posted on by Ben Armistead

Cyber Insurance and Risk Management 101 for Truck Brokers

On December 25th, 2020, a deranged man parked his recreational vehicle on 2nd Avenue downtown in Nashville, Tennessee in front of the AT & T building. Obviously troubled, he decided to create a huge blast from his vehicle that in essence blew up the street (along with himself). No one knows yet if it was an act of terrorism or something else, but it wreaked havoc in a town already hard hit by Covid, a prior tornado, and other negatives. All that said, we will get through it and resilience is part of our collective American fabric.

That said, some have surmised that the bomb was intended to knock out AT & T- and it did just that. Not only was AT & T’s internet and phones down, it closed all downtown access and flights were canceled at Metropolitan Nashville’s International Airport.

And our personal internet was down. And it was out for days. Now I am one of those guys who can use his computer and telephone with some aptitude and dexterity- yet I am so often humbled by having to ask my daughter how to do something technical that usually turns out to be rudimentary.  I do not Facebook or Twitter and if I can get one less email in my life, it is a victory.

But I can tell you with the internet down for days and we Americans being tethered to a technological life of Smartphones and laptops, it was damn inconvenient, and it made you wonder how you ever lived a life unplugged at all.

At GTU, my friend and business partner has created a “tricked out” operation with assistance from our capable and innovative IT manager. As an agency principal in the Logistics Underwriting unit, I need to be able to count on that we are effectively backstopped to our internet from going out or worse being attacked. Since I run the Logistics Underwriting Practice at GTU, my job is to underwrite and grow the business. That cannot be done without technology.

I feel we at GTU understand the risks facing logistics in general and truck brokers specifically. We have worked to write state-of-the-art industry leading insurance policies, and we also offer necessary and often-required risk management assistance to the $250 billion logistics industry. In the Covid economy, logistics is not only growing but also becoming a bigger part of American lives- involved in the 24/7/365 transportation of essential goods and now vaccines.

Markel Insurance has been a very good underwriting partner, and they asked me if I would be interested in underwriting and selling Cyber coverage.  I said yes.  I knew of instances of freight brokers and 3PLs being ransomed. On a bigger picture basis, I knew that Microsoft had source codes stolen by the Russians. So Cyber-attacks are happening daily. I told Markel I was concerned that Cyber Insurance has become ubiquitous in that everyone has a product, and most folks do not know what it does and does not cover, why they need it, or the language of Cyber and technology. Markel agreed and has packaged it with their professional liability coverage.

Most freight brokers have sophisticated hardware and software along with very good transportation management software (TMS). In fact, most freight brokers could not operate without their TMS. Also, many sales are generated through load boards ( e.g. Truckstop.com) and the freight broker is on-line all day every day. Suffice it to say, a freight broker cannot exist without technology- and that is the essence of what Cyber insurance covers.

My goal is to advise you what the cyber language is, what it covers, and then give the non-tech CFO the terminology that his or her team needs to be able to understand the language- and it’s a daunting language.

With Markel there are 4 coverages applicable to freight brokers (out of 6 total coverages) and it is important to learn the terminology. Let’s discuss what they are and why a truck broker needs this coverage.

  1. Network and Information Security Liability– protects against risks associated with the failure to protect electronic data containing others’ private information, the inadvertent transmission of a computer virus, the inability of authorized users to access your website or computer network, and failure to notify the appropriate party.  A truck broker faces all these issues every day.
  2. Network Security Loss- covers your business in the event of network security failure; which can include a data breach, malware infection, cyber extortion demand, ransomware, or business email compromise. Network security coverage includes first-party costs––expenses that you incur directly as a result of the cyber incident. The biggest component of coverage is Business Interruption Loss. This is the “meat” of coverage and this type of claim or loss is happening every day to truck brokers.
  3. Breach Mitigation Expense– provides coverage for expenses  incurred by the Named Insured with the prior written consent of the Company for: (a) The services of a public relations professional, or other publicity expenses that are recommended by a public relations professional to respond to any actual adverse publicity in the media. A smart product to offer in conjunction with any data breach
  4. Social Engineering Loss- Social engineering fraud (SEF) happens when a cybercriminal purports to be a trusted individual in order to deceive people into releasing confidential, personal information, money or other property. For example, a fund office or finance department of an organization is the victim of SEF when an employee acting in good faith transfers money to a third party in response to fraudulent instructions in an email. The email is sent by a cybercriminal impersonating an individual who has the authority to request the transfer. This is happening daily to truck brokers

This is smart to offer your logistics customers. And you do not want to get a call on a Cyber loss and then tell them they do not have coverage. The other issue is that no one knows the loss cost on Cyber coverage for freight broker. It is one of the things the insurance industry is working diligently toward understanding. Frankly, unlike Covid where the business interruption/loss of earnings remains largely uninsured (as there was not a direct property loss), this is one of the times the insurance industry has stepped up to say we are here for you- a good thing to see.

Rather than take my word for it, take a look at some actual Cyber losses. By the way, I should have mentioned much earlier that Cyber coverage is the same as Data Breach Coverage. Rather than spell out some Cyber Data Breach losses, I thought it might help you to hit the links on some actual claims on logistics operations:

But Markel, like most insurance companies, wants to insure operations that are working to mitigate or prevent cyber losses. So they want to see a risk management approach to Cyber Data Breach losses. But if you are freight broker, you need to understand the terminology so you can discuss same with your staff. Once you understand the terminology, then we can discuss a prudent risk management strategy:

Glossary of IT Terms used for Cyber coverage:

  • IT- IT stands for information technology and is the department within a company that is charged with establishing, monitoring and maintaining information technology systems and services
  • Firewall- a firewall is a network security device that monitors incoming and outgoing network traffic and decides which specific traffic to let through based on a defined set of security rules. Firewalls are the first line of defense in network security and can be hardware, software or both.
  • Cyber- the culture of computers and information technology
  • Cyber Insurance- specialty lines insurance product intended to protect businesses, and individuals providing services for such businesses, from Internet-based risks, and more generally from risks relating to information technology infrastructure, information privacy, information governance liability, and activities related thereto. Risks of this nature are typically excluded from traditional commercial general liability policies or at least are not specifically defined in traditional insurance products.
  • Anti-Virus Software- software that is designed to detect and eliminate computer viruses. Effective Anti-virus software includes network intrusion prevention, centralized definition deployment and ransomware prevention modules.
  • Malware- Malware, short for malicious software, is a blanket term for viruses, worms, Trojans and other harmful computer programs hackers use to wreak destruction and gain access to sensitive information. Malware is a catch-all term to refer to any software designed to cause damage to a single computer, server, or computer network.” In other words, software is identified as malware based on its intended use, rather than a particular technique or technology used to build it. A virus is a type of malware, so all viruses are malware -but not every piece of malware is a virus).
  • Predominate Types of Malware:
  • Ransomware – Software deployed to encrypt critical files in an environment, Ransomware is accompanied by a ransom note requiring payment ranging from $500 to millions of dollars in order to decrypt the files to be used. Paying does not guarantee the files will get decrypted, and even if the perpetrator is paid, the act of encrypting/decrypting certain filetypes can result in them being corrupted and unusable afterwards.
  • Spyware – Used to gain access to information or systems without the end user’s knowledge – This usually leads to a monetary loss from stolen financial credentials or the deployment of ransom demands from exploiting captured user permissions to gather sensitive information or deploy ransomware.
  • Security Awareness Training- a formal process for educating employees about computer security. Employees should receive information about who to contact if they discover a security threat and be taught that data is a valuable corporate asset.
  • Electronic Funds Transfer- The electronic exchange (transfer of money from one bank account to another), either within a single financial institution or across multiple institutions, through computer-based systems. Wire transfers and ACH payments are examples of EFTs.
  • System Backup- the process of backing up the operating system, files and system-specific useful/essential data. Backup is a process in which the state, files and data of a computer system are duplicated to be used as a backup or data substitute when the primary system data is corrupted, deleted or lost.

Now you know how to define or discuss Cyber Insurance and you can now teach your people the information in layman’s terms.

The logistics insured wants freight broker coverage and also wants to prevent, to the extent they can, cyber data breach losses. Our IT manager here at GTU has an excellent pedigree in the cyber security game, having worked for a national firm, specifically in the cyber security business. Here is what he advises:

  1. Develop a Managed Firewall strategy with an IT Expert- Depending on size of business, along with the applications they use and type of data being handled, a typical office of 10 employees or less an adequate firewall and a tech expert to program it should run in the $600 to $2,000 range. Just buying firewall software probably won’t get the job done.
  2. Consider a Managed Service Provider (MSP). An MSP serves as a company’s outsourced IT department. It can be much better solution than having your own IT person paid in the 30 to 40k range. A MSP seldom saves money- but having access to real engineers is a game changer for a company that cannot afford corporate grade talent in house
  3. Buy Antivirus, Anti-Spyware and Anti-malware (they are all the same product). We recommend any paid product with network intrusion detection.
  4. Develop a System backup procedure. This all depends on the hardware and software you have and typically all vendors will have advice on how that system back-up should happen.
  5. Requiring 2 signatures for a wire transfer. An easy solution that a bank can help you with.
  6. Implement Dual Factor authentication on any critical services (specific systems with sensitive information or bank accounts) – If a password is compromised, a perpetrator would still not be able to get in.

All that being said, I suggest that everyone consult with a tech expert for an individualized tech, cyber, and data breach risk management plan- as it is their forte.

For Logistics operations to grow, Cyber coverage will become the norm rather than the exception and we have seen some shipper contracts actually require the freight broker to have same. And having a Cyber/ Data Breach risk management plan will be very necessary too. By being the first to offer Cyber Data Breach coverage to our logistics customers in the package, we hope to help protect their future, and keep the industry growing. GTU is ready to help you.