Для тех, кто интересуется безопасным доступом к онлайн-играм, наш партнер предлагает зеркало Вавады, которое позволяет обходить любые блокировки и сохранять доступ ко всем функциям казино.

RIMS TechRisk/RiskTech: Using Cyberrisk Analytics to Improve Your Cyber Insurance Program

Posted on by

As ransomware continues to spread and payment costs increase, cyber insurance rates have gone up exponentially. As a result, it is more important than ever for companies to understand their cyber vulnerabilities and exposures so they can ensure they are properly covered. One way to do this is through analytics.

online pharmacy mobic with best prices today in the USA

In a presentation at the RIMS TechRisk/RiskTech virtual event, Scott Stransky, managing director and head of the Cyber Risk Analytics Center at Marsh McLennan, outlined some of the key data that can help companies get a full view of their risk.

According to Stransky, there are five categories of data that are most important to determining your risk profile. Much of this data is in publicly available datasets that insurers already consult, so it is important that you have a handle on this information as well so you know how underwriters and other outsiders are viewing you:

  1. Firmographics: company demographics like revenue, employee count, industry, location, and company hierarchy
  2. Historical incidents: past breaches and insurance claims
  3. Technographics: a company’s external cybersecurity posture including the presence of firewalls, open ports, frequency of system patching, as well as internal cybersecurity practices like password management and data encryption
  4. Scoring: combines firmographics, historical incidents and technographics into a single number that designates the level of vulnerability
  5. Loss modeling: brings all elements together to predict the likelihood and cost of an event

Armed with this data, companies can take steps to make it easier to access optimal cyber insurance coverage and better insurance pricing. These could include improving your security and claims posture by addressing potential cybersecurity gaps, updating incident response plans, and identifying vendor partners to help improve security posture or respond to incidents. Companies can also explore policy structure options in terms of different program components (limits, attachment, coverage, risk retention, etc.

online pharmacy isofair with best prices today in the USA

) and consider alternative terms and conditions.
online pharmacy robaxin with best prices today in the USA

Finally, it is important to provide robust underwriting data by using assessment tools to minimize the need for supplemental applications, preparing for additional questions from underwriters, and highlighting significant cybersecurity updates and improvements over the past year.

In particular, companies should focus on what Stansky called the top 12 cybersecurity controls for risk mitigation, resilience and insurability:

  1. Multifactor authentication (MFA)
  2. Endpoint detection and response
  3. Secured, encrypted and tested backups
  4. Privileged access management
  5. Email filtering and web security
  6. Patch and vulnerability management
  7. Cyber incident response planning and testing
  8. Cybersecurity awareness training
  9. Hardening techniques, including remote desktop protocol mitigation
  10. Logging and monitoring/network protection
  11. End-of-life system replacement
  12. Vendor/digital supply chain risk management

For those that missed RIMS TechRisk/RiskTech, you can register and access the virtual event here. Sessions will be available on-demand for the next 60 days.

RIMS TechRisk/RiskTech: Opportunities and Risks of AI

Posted on by

On the first day of the RIMS virtual event TechRisk/RiskTech, author and UCLA professor Dr. Ramesh Srinivasan gave a keynote titled “The Opportunities and Downside Risks of Using AI,” touching on the key flashpoints of current technological advancement, and what they mean for risk management. He noted that as data storage has become far cheaper, and computation quicker, this has allowed risk assessment technology to improve. But with these improvements come serious risks.

Srinivasan provided an overview of where artificial intelligence and machine learning stand, and how companies use these technologies. AI is “already here,” he said, and numerous companies are using the technology, including corporate giants Uber and Airbnb, whose business models depend on AI. He also stressed that AI is not the threat portrayed in movies, and that these portrayals have led to a kind of “generalized AI anxiety,” a fear of robotic takeover or the end of humanity—not a realistic scenario.

However, the algorithms that support them and govern many users’ online activities could end up being something akin to the “pre-cogs” from Minority Report that predict future crimes because the algorithms are collecting so much personal information. Companies are using these algorithms to make decisions about users, sometimes based on data sets that are skewed to reflect the biases of the people who collected that data in the first place.

Often, technology companies will sell products with little transparency into the algorithms and data sets that the product is built around. In terms of avoiding products that use AI and machine learning that are built with implicit bias guiding those technologies, Srinivasan suggested A/B testing new products, using them on a trial or short-term basis, and using them on a small subset of users or data to see what effect they have.

When deciding which AI/machine learning technology their companies should use, Srinivasan recommended that risk professionals should specifically consider mapping out what technology their company is using and weigh the benefits against the potential risks, and also examining those risks thoroughly and what short- and long-term threats they pose to the organization.

Specific risks of AI (as companies currently use it) that risk professionals should consider include:

  • Economic risk in the form of the gig economy, which, while making business more efficient, also leaves workers with unsustainable income
  • Increased automation in the form of the internet of things, driverless vehicles, wearable tech, and other ways of replacing workers with machines, risk making labor obsolete.
  • Users do not get benefits from people and companies using and profiting off of their data.
  • New technologies also have immense environmental impact, including the amount of power that cryptocurrencies require and the health risks of electronic waste.
  • Issues like cyberwarfare, intellectual property theft and disinformation are all exacerbated as these technologies advance.
  • The bias inherent in AI/machine learning have real world impacts. For example, court sentencing often relies on biased predictive algorithms, as do policing, health care facilities (AI giving cancer treatment recommendations, for example) and business functions like hiring.

Despite these potential pitfalls, Srinivasan was optimistic, noting that risk professionals “can guide this digital world as much as it guides you,” and that “AI can serve us all.”

RIMS TechRisk/RiskTech continues today, with sessions including:

  • Emerging Risk: AI Bias
  • Connected & Protected
  • Tips for Navigating the Cyber Market
  • Taking on Rising Temps: Tools and Techniques to Manage Extreme Weather Risks for Workers
  • Using Telematics to Give a Total Risk Picture

You can register and access the virtual event here, and sessions will be available on-demand for the next 60 days.

What Employers Need to Know About Federal COVID-19 Vaccine Mandates

Posted on by

In an effort to combat the COVID-19 virus and its subsequent variants, the Biden administration has instituted three important mandates that employers should be aware of as they may impact their business. First, the Emergency Temporary Standard (ETS), issued by the Occupational Health and Safety Administration (OSHA), requires that all employers with 100+ employees mandate vaccination or weekly testing. The second mandate involves federal workers and contractors and requires them to obtain a vaccination without any option for weekly testing. The final mandate was issued by the Centers for Medicare and Medicaid Services (CMS), and requires vaccination of all healthcare workers at CMS-covered facilities.

OSHA’s Emergency Temporary Standard

The mandate that has the most wide-ranging impact is Occupational Health and Safety Administration’s (OSHA) Emergency Temporary Standard (ETS) that calls for employers with 100 or more employees to either require employees to obtain a COVID-19 vaccination or to prove compliance with a weekly-testing program. This ETS is expected to affect over 80 million employees. 

On December 17, the Sixth Circuit Court of Appeals lifted the stay placed on OSHA’s ETS issued by the Fifth Circuit in November. The court held that OSHA does have statutory authority to mandate national vaccines and/or testing for employers with more than 100 employees. Specifically, it outlined that because COVID-19 is a virus that causes bodily harm, OSHA was well within its administrative authority to regulate the health and safety of employees. 

Since the Sixth Circuit’s decision to dissolve the stay, OSHA announced that it will not be issuing citations for noncompliance with the ETS requirements until January 10 and the testing requirements will not be enforced until February 9 with the caveat that the employer must make good faith efforts to come into compliance as soon as possible.

After this ruling by the Sixth Circuit, eight groups challenged the OSHA vaccine mandate and filed emergency applications with the U.S. Supreme Court asking it to stay the mandate again until the case can be heard in the highest court. On December 20, the Supreme Court requested a response from the federal government by December 30. And, on December 22, in an almost unprecedented move, the Supreme Court ordered oral argument on these emergency applications, which will take place on January 7.

Despite the fact that the validity of the ETS is now squarely before the Supreme Court, employers should still operate as if the ETS will go into immediate effect. OSHA has implemented new deadlines to reflect the current status of the ETS.

By January 10, employers should:

  • Track employee vaccination status
  • Create a database detailing vaccination information for each employee
  • Require unvaccinated employees to wear a mask
  • Provide paid time off for employees to get vaccinated and recover

As of February 9, 2022, employers must also require unvaccinated employees must start testing for COVID weekly. Self-administered or self-read tests would not comply. Employers must observe or use a proctor and have employees tested on site, or at a recognized testing facility.

The Mandate for Federal Employees and Contractors

The second mandate stems from President Biden’s executive order that requires most federal employees or contractors to get vaccinated. This mandate does not have a testing option.

On December 7, the U.S. District Court for the Southern Section of Georgia granted a preliminary injunction to temporarily halt the enforcement of the Biden’s administration’s vaccine mandate for federal contractors.The court found that the administration had overstepped the bounds of it authority under the Federal Property and Administrative Services Act 40 U.S.C. 101 et. seq. The injunction effectively prohibits enforcement of the federal contractor vaccine mandate in all 50 states and any territory of the United States. However, on December 17, the Eleventh Circuit, denied the government’s motion to stay. This effectively upheld the injunction. The court found that the government had failed to show that it “would be irreparably harmed absent a stay.”

The CMS Mandate

The third mandate is an interim file rule of the Centers for Medicare and Medicaid Services (CMS), which requires vaccination of all healthcare workers at CMS-covered facilities throughout the United States. The CMS mandate is currently enjoined by court order in 25 states and continues in full effect in 25 other states. After the ruling by the Fifth Circuit in November, however, CMS suspended implementation and enforcement of the mandate pending resolution of the challenges before the Supreme Court.

Detecting and Confronting Procurement Fraud

Posted on by

Accountancy firm Crowe and credit rating company Experian have said that large enterprises and governments experienced 59% of procurement fraud in the United Kingdom, costing them $120 billion (£89 billion) collectively. It is estimated that over $2 trillion (£1.6 trillion) total is lost each year due to procurement fraud, or 4-8% percent of an organization’s procurement spending. This figure dwarfs other areas such as corporate tax avoidance, where HMRC estimates that $94 billion (£70 billion) was avoided between 2011 and 2015.

The main difference is that procurement fraud is so varied that it makes it virtually impossible to detect. More importantly, procurement fraud is difficult to detect because it is often embedded in a genuine expense. For example, when a construction contractor submits an invoice for 100 hours of work in a week, eight of those hours may be fraudulent. This may seem negligible, but when you consider that every purchase in an organization can include an element of fraud, the scale of the problem becomes clear. It is not just about the financial loss; there are many reputational issues too.

Why Procurement Fraud? 

There are two main reasons: greed and opportunity. In terms of motive, we see both individuals and groups committing acts of fraud because they want something for themselves. They might be looking for personal gain, or trying to get away from someone else, or simply seeking revenge on a competitor.

Several studies have shown that around 50% of fraudsters are motivated by either monetary reward or benefits gained by committing a crime. For example, in 2018, a Massachusetts Bay Transportation Authority (MBTA) procurement official was indicted for receiving over $300,000 in illegal bribes and gratuities from a construction company that performed work for MBTA.

Individuals may also notice a weakness in a business process, as trivial as a broken approval process, that allows for invoices to be paid to existing suppliers without checking the outstanding purchase order amount. The problem is that weaknesses can surface at virtually every step of the procurement lifecycle, across the entire supply chain. Additionally, fraud often occurs when suppliers become close with an individual with authority inside an organization that can provide undetected access. Fraudsters see an opportunity to profit from weaknesses and begin exploiting them.

What Can Be Done?

Here are three ways to help your business become less vulnerable to fraudulent activity:

1. Use data analytics tools: Data analytics tools give you access to information about how well suppliers perform against agreed standards. You can use this information to identify potential risks early on, which could save your company millions in wasted spending.

2. Choose suppliers carefully: The larger and more complex your supply chain, the greater the risk for procurement fraud. If you buy goods and services from many suppliers, you should try to choose suppliers based on quality rather than price. Quality is not always reflected in the cost, but this means you need to be wary of the cheapest option. Using data to draw definitive conclusions about a supplier’s performance is a good way to remain objective when selecting.

3. Create a robust process: It is important that have a robust supply chain management process in place. You should be able to trace back how a supplier was added to your supply chain, the selection criteria for any awarded contracts, their ongoing financial standing, and the people involved in managing the relationship.