Mapping Unknown Risk

There used to be a “lurking” threat to our cyber security. It is no longer just lurking; companies and cyber attackers are now in an ongoing war. Its scale is enormous, and the techniques deployed by those fighting it are incredibly intricate.

The challenges it presents will be a part of everyday life for all individuals, entities, corporations and governments in the coming decades. However, even in this “new reality,” there are ways we can protect ourselves. In fact, there are ways in which we can “win.”

Cyber security is an issue born of the Internet-age. As the connectivity revolution creates tremendous opportunities for industry and economic development, it also poses new challenges for risk managers and insurers. With between ten and 20 billion devices currently connected to the internet (estimated to rise to 40 to 50 billion by 2020), there are tens of billions of access points at which cyber criminals can potentially enter a business’ enterprise system, an individual’s private information store or any government’s sensitive databases.

It is no surprise that Bristsh Prime Minister David Cameron set out an emphasis on cyber security in the government’s Strategic Defence and Security Review in November. His allocation of an extra £1.9 billion to be spent on cyber security should be a strong signal to all governments and corporations that this issue is centre-stage. It should be squarely on the agenda of every CEO and every Board across all industries. We must address it now or otherwise face severe consequences.

Cyber extortion and hacking have become significant challenges for companies. As criminals infiltrate company systems and charge a ransom for the return of sensitive information they are often not only harming the company’s reputation, damaging shareholder value and undermining the company’s work, but also affecting the lives of millions of consumers. With objects and devices increasingly connected there is also a high risk of hacking imperiling physical property and assets, even lives.

Earlier this year two hackers were able to infiltrate a Jeep Cherokee through its radio and remotely access its transmission, air conditioning and other systems. This caused the recall of 1.4 million vehicles, and isn’t the only instance of hackers gaining control of vehicles. Cyber security researchers found six flaws in Tesla’s Model S cars that made them vulnerable to hacking. These “white hat” hackers were able to manipulate the car’s speedometer to show the wrong speed, lock and unlock it, turn it on and off and bring it to a stop while driving.

This is particularly worrying given that Tesla is well regarded for having less vulnerable software than other automakers. The company has since issued a security patch preventing these breaches. These problems that were inconceivable half a decade ago are no longer science fiction; they are a business fact.

Increasingly companies should be concerned with covering the income lost through cyberattacks, not just with remedying data breaches.

What can companies do to prepare for unknowable future risk? The implications of the threat are so far-reaching that a vigilant attitude towards cyber security must be embedded within the culture of an organisation. This should be driven, led and prioritised by its Board and senior executives.

Risk managers must work with other key stakeholders across their organisation and with their insurance advisers to build a comprehensive cyber security strategy. This should include insurance cover that helps when hacking occurs, and access to education and tools that enhance existing security practices already developed by IT departments. The cyber-attack threat is changing and growing, but so is the protection and education provided by insurers, insurance advisers and cyber security experts.

Detailed scenario planning is essential. Organisations must highlight gaps, vulnerabilities and potential impacts on the business and plan what to do if the worst does happen. Good advice to any organisation is: do everything possible to improve your cyber-security, but also prepare to respond when a cyber-attack comes. Your company will be much better positioned to recover quickly.

Prospect: http://bit.ly/1nO005U