Cybersecurity Incidents Are Major Business Disruptions

Recently, Allianz Insurance released its Risk Barometer for 2018, which surveyed more than 1,900 risk management experts from more than 80 countries.

The survey covered Allianz customers, insurance brokers, risk consultants, underwriters, executives and surveyors. The poll was carried out in October and November 2017.

Service Interruptions and Security Incidents go Hand-in-Hand

Businesses from small to multinational companies were asked to name their top concerns. For the sixth time in a row, service interruptions made it to the first place with 42% of all polled.

“For the first time, business interruption and cyber risk are neck-and-neck in the Allianz Risk Barometer and these risks are increasingly interlinked,” said Chris Fischer Hirs, Chief Executive Officer, AGCS.

“Whether resulting from attacks such as WannaCry, or more frequently, system failures, cyber incidents are now a major cause of business interruption for today’s networked companies whose primary assets are often data, service platforms or their groups of customers and suppliers.”

With today’s continuous progressions in business digitisation, companies see a strong link between business interruptions and cybersecurity incidents.
 
According to 40% of all those polled, the risk of cybersecurity incidents is considered the second most important issue businesses are facing today. Only five years ago, cyberattacks were listed in 15th place on the risk rating chart.

In Europe, pressure will also increase, as the European General Data Protection Regulation (GDPR) will become effective on 25 May 2018. It seems that smaller and mid-sized companies became more aware of cybersecurity risks over time.

Refocusing from Risk Identification to Prevention

The insurance industry is adapting to the increased recognition of cyber threats, but not necessarily at the same pace as these threats are increasing. Establishing expertise, integrating cyber risk into existing offerings, and adding new products is taking some time.

But the portfolio of cyber insurance offerings is growing, and the outcome of the Allianz Risk Barometer validates a growing demand, especially with GDPR looming. There needs to be a shift toward cyber threat prevention vs. reactive security measures, and that will become more important for the insurance industry, just as it is for the IT security industry.

Paradigm Shift on the Horizon

More and more companies are coming to realise that traditional reactive security efforts from the past are not keeping up with today’s cybersecurity risk landscape, even if they are implementing interconnected platforms of signature-based legacy antivirus technologies.

Typically, up to 75% of a company’s IT spending is used for management and maintenance of existing IT systems. Qualified employees’ adept at migrating legacy IT systems into modern architectures are rare and can be expensive.

On top of that comes a high percentage of legacy security technology that is based solely on detection and response capabilities, not actual prevention. This type of defense strategy consumes and depletes resources, while, at the end, it is totally ineffective.

Today, it still takes an average of 229 days until a breach is detected. Being able to quickly clean up after an incident is important, but preventing the breach in the first place is golden.

The monetary damage averages at $158 USD per breached data record, according to the ICT Ransomware Report. Additional layers of Detect and Respond systems are not capable of protecting against the high cadence of polymorphic and highly sophisticated attacks.

This is why service interruptions now lead the pack of business risks listed in the survey.

While targeted attacks are more sophisticated today, we also see a continuous evolution in malware commercialisation. Mutation and encryption tools are easily available to ‘part-time’ cyber criminals today. While those tools have existed for years, today they are available as-a-service for a low monetary investment.

Today, virtually anyone with an Internet connection can purchase toolkits or even full malware campaign services that can easily bypass traditional security solutions through a broad stack of attack vectors.

So, one piece of malware can be reused infinite times, with low or no knowledge required about malware programming. The phenomenal increase of crypto currencies is just another indicator.

Conclusion

Cybersecurity threats are not the exclusive concern of IT departments anymore - other business units are taking note of the impact to business procedures and continuity. The latest Allianz Risk-Barometer underpins the direct connection between business interruption and cybersecurity incidents.

Many companies are trying to patch their security strategy by adding and connecting more layers of legacy Detect and Respond technology that utilize a common pile of threat intelligence.

However, evasion of such multi-layer systems is possible and progressively cheaper than ever before. Organisations should rethink and modernise their cybersecurity arsenal.

True prevention is possible today, with solutions based on artificial intelligence and machine learning which are not dependent on URL lists, signatures, or heuristics, solutions that prevent attacks by way of self-sufficient math models that are extremely lightweight and compatible with corporate business needs.

To contact the GDPR Advisory Board please visit:  www.gdpr-board.co.uk

Threat Matrix

You Might Also Read: 

Businesses Using Apple & Cisco Products Pay Less For Insurance:

Companies Are Buying Cyber Insurance 'in mad panic':

 

« US City Of Atlanta Suffers An Attack
Have You Gauged The Cost Of A Cloud Outage? »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Authenware

Authenware

AuthenWare delivers the highest level of identity security based on behavioral biometrics.

Cydome

Cydome

Cydome offers full-spectrum cybersecurity solutions tailored for the maritime industry.

CryptoTec

CryptoTec

CryptoTec is a provider of security concepts and encryption solutions for secure communication between decentralized computerized systems.

LightEdge Solutions

LightEdge Solutions

LightEdge’s highly-trained compliance and security experts take the guesswork out of keeping your business protected.

Search Guard

Search Guard

Search Guard® is an Open Source security suite for #Elasticsearch and the entire #ELK stack that offers encryption, authentication, authorization, audit logging and multi tenancy.

Caulis

Caulis

Caulis FraudAlert is a cyber security solution. It can detect fraud and identity theft based on users’ online behaviour.

Redstor

Redstor

Redstor's complete data management helps you discover, manage and control your data from a single control centre, unifying backup and recovery, disaster recovery, archiving and search and insight.

CyberSwarm

CyberSwarm

CyberSwarm is developing a neuromorphic System-on-a-Chip dedicated to cybersecurity which helps organizations secure communication between connected devices and protect critical business assets.

Rocheston

Rocheston

Rocheston is an innovation company with cutting-edge research and development in emerging technologies such as Cybersecurity, Internet of Things, Big Data and automation.

Cybersecure Policy Exchange (CPX)

Cybersecure Policy Exchange (CPX)

Cybersecure Policy Exchange is a new initiative dedicated to advancing effective and innovative public policy in cybersecurity and digital privacy.

Toothpic

Toothpic

ToothPic has invented, designed, developed and patented a solution to enable companies to turn every smartphone into a secure key for a user-friendly online authentication.

FortKnoxster

FortKnoxster

FortKnoxster is a cybersecurity company within the Crypto & FinTech space. Our encryption technologies are blockchain integrated.

Virtual Technologies Group (VTG)

Virtual Technologies Group (VTG)

Virtual Technologies Group is a single source, IT product and services provider for SMBs and IT departments, delivering reliable, cost-efficient service, maintenance and support solutions.

Northrop Grumman

Northrop Grumman

Northrop Grumman is a global provider and integrator of complex, advanced and rapidly adapting information technology, cybersecurity, mobility and optimized services and solutions.

PCI Security Standards Council (PCI SSC)

PCI Security Standards Council (PCI SSC)

The PCI Security Standards Council is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments.

St Fox

St Fox

St. Fox is a leading consultancy helping enterprises secure their Cloud, Data, endpoints, and applications.