2016 Finity Consulting Pty Limited

Transcription

1 2016 Finity Consulting Pty Limited

2 < Picture to go here > Cyber Attack Scenario Insurance response Chris Mackinnon General Representative Lloyd s Australia March 2016

3 Quantifying the Threat. Cyber crime is a bigger threat than drugs (UK Ex-Fraud Police Chief) There are two kinds of big companies in the US. There are those who've been hacked and those who don't know they've been hacked. (2014 FBI director James Comey) We are in the midst of a crime wave unlike any since the 1920s and the age of gangsters (Tom Kellermann, Professor of cyber-security, American University) < Picture to go here > There were 43 million global security incidents detected in that's more than 100,000 attacks a day (PWC Security Survey 2015) 3

4 And the cost is.? Annual global cost of cyber crime is over $445 bn. (Mcafee) < Picture to go here > Source: Allianz Global Corporate & Specialty Report 2015 Cyber crime will cost global business $2.1 trillion dollars by the year 2019 (Juniper Research report) Average cost of a data breach is $3.8 million and rising each year. (2015 Cost of Data Breach Study Ponemon Institute) 4

5 So Should we be worried? The answer is a definitive yes: Big organizations hold caches of individual information (which is useful for identity theft and other crimes), they make tempting targets for cyber criminals. In 2013, 43% of companies had a data breach in which hackers got into their systems to steal information. In 2014, 47% of American adults had their personal information stolen by hackers, primarily through data breaches at large companies. Data breaches targeting consumer information are on the rise, increasing 62% from 2012 to 2013 That added up to a staggering total of $18,000,000,000 in credit card fraud for the year. < Picture to go here > 5

6 Types of attack < Picture to go here > Source: IBM 2015 Cyber Security Intelligence Index Report 6

7 Todays product Cyber policies can now cover a suite of 1 st and 3 rd party, Non Physical and Physical exposures relating to:- - Cyber crime, sabotage, espionage and extortion - Accidental loss/damage of your own or someone else s data - Business Interruption/Contingent Business Interruption - Network Security and privacy breaches - IP and multi-media liability - Bodily injury - Property damage - Crisis management /Reputational harm expenses: increase costs of working; data restoration costs; PR expenses - Investigation, notification/response and monitoring costs - Regulatory defence costs and fines/penalties Risk audits and post claim assistance from specialist vendors < Picture to go here > 7

8 Drivers of future growth The Internet of Things Increasing Attacks Business Interruption / Supply Chain Industry and government sponsored information sharing of claims data and threat analysis, to aid Cyber Resilience Evolving Legislation: - EU regulations effective 2017 < Picture to go here > CONFIDENTIAL: Market update - November

9 Where? < Picture to go here > Source: IBM 2015 Cyber Security Intelligence Index Report 9

10 Challenges Matching Emerging Risks with Insurance Solutions Global interconnectedness Cars, ships, aircraft, space, trains, Logistics and supply chain Food, water, sanitation Smart devices Evolution of risk out pacing evolution of product How viable will 12 month policies be in the future? < Picture to go here > Traditional lines of business unintentionally covering cyber risk D&O exposures for failing to address risk Unanticipated aggregation of risk across multiple lines CONFIDENTIAL: Market update - November

11 Lloyd s oversight Underwriting Performance monitoring: - o Establishment of common core date requirements o Consistent terminology and precise definitions o Establishment of specific Cyber risk codes :- Effective 2013: Effective 2015: CY - Cyber security data and privacy breach CZ - Cyber security including property damage Underwriting Analysis and development of various Realistic Disaster Scenarios, with market returns required to monitor aggregation < Picture to go here > 11

12 The insurance implications of a cyber attack on the US power grid We chose to investigate the economic and insurance costs of cyber attack against part of the US power grid: Demand is emerging for insurance cover against the impacts of cyber attack against industrial control systems and operational technology in the critical infrastructure sector Representative of the aggregate exposure management challenges that will emerge in the digitally connected economy The scenario was designed to be plausible but extreme that is, within solvency requirements and based upon threats and vulnerabilities known to exist It is not a worst case scenario the attackers capability and intent is limited to targeting a relatively small part of the US power grid

13 Scenario Year 1 Year 2 Year 3+ Research Dormancy Activation Blackout Aftermath

14

15 Direct cost of electricity interruption: S1: $61 billion S2: $130 billion X1: $223 billion Total economic cost: S1: $243 billion S2: $544 billion X1: $1,024 billion

16 Insurance claimants Estimated insurance industry loss: S1: $21 billion S2: $40 billion X1: $71 billion

17

18

19

20 Lloyd s Thought Leadership

21