This is a second part in a two-part series on Coronavirus and Cyber. Read Part One here.

Global Interdependencies

There is an increasing awareness that global interdependencies fostered by corporate connectivity, the Internet of things (IoT) and Industry 4.0 are moving re/insurance companies and the corporate clients into uncharted territory.

For many years, the global (re)insurance P/C market has been fixated with geo-coding and a property-led debate. That is understandable to an extent because property is and will continue to be a valuable asset. In this new corporate environment, emerging technology is causing a change in consumer engagement, while companies are revising their strategies to stay relevant to a younger Internet savvy consumer base.

The on-demand gig economy and peer-to-peer market is young, but it is expanding fast. This new environment poses new risks. We are entering an era of hyper connectivity with new rules, opportunities and risks for (re)insurers and corporate risk managers. As Russell Group Limited has mentioned in previous papers, the connected cyber risk is also a mounting concern and one that is being fuelled by today’s increased geo-political tensions that some reports attribute to state sponsored cyber hacks.

The risk affects everyone in the insurance value chain – major corporates, their insurers and their reinsurers. Is cyber cat the new Nat Cat? Well, the answer is yes and no. One of the hottest topics in cyber at the moment is the failure of external networks, which is not covered in treaties and for good reasons. This would be the worst-case scenario for the market. Just imagine the Internet being out of service for 12 hours due to a cyber-attack.

For the Internet, you have several US, European and Asian nodes and if any of these nodes are hacked then it could result in the Internet being switched off. This would be an example of a cyber cat scenario, but from an insurer’s perspective, you cannot insure against it because the insurer cannot limit it to a certain amount or location. Therefore, this cannot be rolled out as a policy across the board as every policy would be different.

Cyber CAT Scenarios

The same applies to power grids. If you have a power outage in Germany, there is a big likelihood that this will extend across Europe but the footprint of such an event cannot be defined. For Nat Cat scenarios, however, we have a footprint for how such events emerge; it is not always the same, but it always follows a certain pattern that you can model. If you have an Internet outage it is not limited to a footprint, as the interconnectivity of companies determines the extent of the event and the potential impact on policies could be numerous and severe.

With the energy, transportation, telecommunications and manufacturing sectors becoming more reliant on robot technologies along with the digital networks of connected devices, they are increasing their vulnerability and exposure to cyber-attacks.

Rather than stealing data, cyber-attacks against critical infrastructure and manufacturers are more likely to target industrial control systems (ICS) to manipulate or shut-down operations.

There is growing concern about the vulnerability of Industrial Control Systems, which are used to monitor or control processes in industrial and manufacturing sectors.

A cyber-attack against an ICS could result in physical damage, such as a fire or explosion, as well as business interruption (BI), says Nigel Pearson, Global Head of Fidelity, AGCS.

“A number of ICS are still used by manufacturing and utilities companies today, which were designed at a time before cyber security became a priority issue.”.

Control System Failures

Meanwhile, in a world of increased business automation, often the greatest cyber risk companies face is not data security, says NAS Insurance Services. Rather, “businesses that rely upon computers and software to manage their refineries and pipelines, power grids, and a wide range of manufacturing systems face enormous cyber risk should their control systems fail.”

According to a report by Norton Rose Fullbright, maritime industries are also becoming increasingly reliant on technology and the use of data. The report says: “The threat is a real one, as demonstrated by a prominent example of a criminal hacking of a port, which occurred at the Port of Antwerp. In this case, hackers remotely accessed the Port’s network to identify containers in which they had hidden illegal goods and removed the goods before they were searched by authorities.

This was done by sending Trojans to the port’s staff, resulting in the port’s IT system being infected, as well as key logging devices being installed to capture the passwords of port employees. The criminal enterprise is thought to have continued for two years.”

Business models need to be re-thought. The fourth industrial revolution is a game changer for insurers and corporate risk managers and the challenge is to stay on top of these developments, understand how business models are being transformed and create products that address these needs.

Cyber Command Upgrade

At the end of 2016, President Barack Obama signed the annual defence policy to legislatively mandate that the Pentagon elevate Cyber Command. Earlier this year, the Trump administration formally elevated its status and made it the Defence Department’s newest “unified combatant command,” only the 10th of its kind, and gave it a streamlined chain of command to the Oval Office.

The promotion was quickly followed by a blitzkrieg of policy moves that herald a new age of warfare and a willingness to act first and ask questions later in the digital domain.

“Our hands are not tied as they were in the Obama administration,” national security adviser John Bolton said in September during a news briefing to unveil the new national cyber strategy. “We’re going to do a lot of things offensively, and our adversaries need to know that” he added. “We’re not just on defence as we have been.”

According to politico.com so far, however, Cyber Command appears to be moving cautiously into its role. In its first known operation to prevent election meddling, it sent messages to Russian operatives in an attempt to prevent them from spreading disinformation to influence U.S. elections.