Sanlam Limited · JSE:SLM
Sanlam — Sanlam Benchmark Consultant Survey 2019
30 slides from Sanlam's conference presentation, 2019
Slide 1: Information Insecurity
Information Insecurity by Tebogo Legodi Digital Lead Sanlam Employee Benefits
Slide 2: Slide 2
Slide 3: Cybercriminals
CYBERCRIMINALS Sophisticated Networks Global Ruthless Skilled Organised Crime State sponsored hacks
Slide 4: Employee data held (numbers, fund values, IDs)
Employee Numbers Fund Values ID No’s Gender Tax No’s Names Age Salaries Employers Contact details (Cell & Email) Beneficiary Details
Slide 5: Information Security
INFORMATION SECURITY Practice of preventing: Unauthorised use Disclosure Disruption Modification Inspection Recording or Destruction of information, whether physical or electronic
Slide 6: Legislation
LEGISLATION Protection of Personal Information Act 4 of 2013 Section 19: (1) A responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent— (a) loss o
Slide 7: Cybercrime Bill
CYBERCRIME BILL Obligation to report acts of cybercrime Preserve evidence (confiscation or seizure)
Slide 8: King IV
KING IV IT Governance addressed in detail for the first time Information Governance Framework
Slide 9: Key Risk Globally
KEY RISK GLOBALLY 2019 Allianz Risk Barometer of Top Business Risks 2,415 Respondents Cybersecurity Top alongside Business Interruption Within Business Interruption, Cybersecurity is most feared threat 5th in 2015 … 1st in 2019! Primary asset = Data
Slide 10: IBM X-Force Threat Intelligence Index
IBM X-FORCE THREAT INTELLIGENCE INDEX Unmanageable levels of cyberthreats Ever-growing attack landscape Increased risk of exposure
Slide 11: IBM X-Force Threat Intelligence Index
IBM X-FORCE THREAT INTELLIGENCE INDEX Most Attacked Industry Finance & Insurance - 19% of Global Attacks Data monetized rapidly Direct profit or Resale
Slide 12: IBM X-Force Threat Intelligence Index
IBM X-FORCE THREAT INTELLIGENCE INDEX 3rd Most Attacked Industry … Professional Services (eg. Consulting firms) Rich personal information of clients Smaller budgets Limited staff Immature security position
Slide 13: Vulnerable and Lucrative
IBM X-FORCE THREAT INTELLIGENCE INDEX “Vulnerable and Lucrative”
Slide 14: Cost of Cybercrime
COST OF CYBERCRIME 2018 Refinitiv Revealing the Cost of Financial Crime Survey 2,373 Global Respondents 123 from RSA 20% have experienced Financial Loss due to Cyber Crime
Slide 15: Cost of Cybercrime
COST OF CYBERCRIME Average cost has increased 62% over 5 years Typical cost per breach - $4m $600Bn pa $208Bn pa average loss from natural disasters over past 10 years
Slide 16: Cost of Cybercrime
COST OF CYBERCRIME Fraudulent Transactions Litigation by Members, Employers, etc. Liability (Trustees, Consultant, Administrator) Reputational damage Business Interruption Regulatory Sanction Mass action
Slide 17: Examples
EXAMPLES Personal Information Sold & Resold Aggregrate stolen information with data from other sources Ultimately used for Identity Theft
Slide 18: Poor Internal Security Practices
POOR INTERNAL SECURITY PRACTICES Phishing Social Engineering Weak Password Practices
Slide 19: Key Enablers of Cyber Resilience
KEY ENABLERS OF CYBER RESILIENCE People. People. People. Culture Training Structure
Slide 20: Consultants' Views
CONSULTANTS’ VIEWS Evaluating Cyber Risk least important business challenge Cyber security lowest ranked risk to EB Consultants Data analytics & IT expertise least cited differentiator Lack of awareness and skills
Slide 21: Cyber Resilient?
CYBER RESILIENT? Jan 2019 – Mar 2019 Standalone Umbrella IT Policies & Procedures 64% 50% System Protocols Revised 40% 27% Invested in securing IT infrastructure 39% 52% Education & Training of Staff 19% 22% Training & Notifications to Members 22% 30% Handled by our Administrator 11% 5% Nothing as y
Slide 22: Yet ...
YET … 68% indicate that they evaluate Administrators’ abilities to mitigate cyber-crime when advising on placement of administration 70% claim to have intermediate knowledge to evaluate protection against cyber crime 25% indicate little knowledge 35% are not sure whether their administrators have im
Slide 23: What If ...
WHAT IF … Trustees and Employers rely on Consultants to provide best advice Including an evaluation of Cyber resilience Data loss can occur at the Consultant … Far greater discipline needs to be applied to evaluate and monitor Cyber Resilience … Collective effort required
Slide 24: Advice Risk
ADVICE RISK Expert Opinion on Service Providers Holds great influence over decisions Cyber risk largely ignored Material differences exist These have not been evaluated Degree of Cyber Resilience can vary wildly …
Slide 25: Fiduciary Duty of Trustees
FIDUCIARY DUTY OF TRUSTEES They must exercise their powers to the benefit of the fund and in such a manner as to always act in the best interest of the fund and its members. Ensure that the fund employs proper control systems Obtain expert advice on matters where they lack sufficient expertise Ensur
Slide 26: Most Capable of Enabling Financial Resilience for Members
MOST CAPABLE OF ENABLING FINANCIAL RESILIENCE FOR MEMBERS Sanlam Umbrella Fund A B C D Other 2019 Sanlam Benchmark Consultant Survey
Slide 27: Crown Jewels
CROWN JEWELS Names Employers ID No’s Employee Numbers Tax No’s Salaries Age Fund Values Gender Beneficiary Details Contact details (Cell & Email)
Slide 28: Cyber Resilience Checklist
Cyber Resilience Checklist SANLAM ADMINISTRATOR Governance » Has your administrator established formal governance policies and processes for Information security, information governance, cyber security, third party management, etc. ? V) Does your administrator have cyber insurance to enable financia
Slide 29: Enabling Financial Resilience
ENABLING FINANCIAL RESILIENCE Apply Checklist Seek expert guidance Implement corrective action Choice of Cyber Resilient service providers Repeat
Slide 30: Enabling Financial Resilience
ENABLING FINANCIAL RESILIENCE Make information security an integral part of culture and overall structure in relation to Funds, Employers, Consultants and Administrators