Cyber operational risk scenarios for insurance companies

Abstract

Cyber Operational Risk: Cyber risk is routinely cited as one of the most important sources of operational risks facing organisations today, in various publications and surveys. Further, in recent years, cyber risk has entered the public conscience through highly publicised events involving affected UK organisations such as TalkTalk, Morrisons and the NHS. Regulators and legislators are increasing their focus on this topic, with General Data Protection Regulation (“GDPR”) a notable example of this. Risk actuaries and other risk management professionals at insurance companies therefore need to have a robust assessment of the potential losses stemming from cyber risk that their organisations may face. They should be able to do this as part of an overall risk management framework and be able to demonstrate this to stakeholders such as regulators and shareholders. Given that cyber risks are still very much new territory for insurers and there is no commonly accepted practice, this paper describes a proposed framework in which to perform such an assessment. As part of this, we leverage two existing frameworks – the Chief Risk Officer (“CRO”) Forum cyber incident taxonomy, and the National Institute of Standards and Technology (“NIST”) framework – to describe the taxonomy of a cyber incident, and the relevant cyber security and risk mitigation items for the incident in question, respectively.Summary of Results: Three detailed scenarios have been investigated by the working party:∙Employee leaks data at a general (non-life) insurer: Internal attack through social engineering, causing large compensation costs and regulatory fines, driving a 1 in 200 loss of £210.5m (c. 2% of annual revenue).∙Cyber extortion at a life insurer: External attack through social engineering, causing large business interruption and reputational damage, driving a 1 in 200 loss of £179.5m (c. 6% of annual revenue).∙Motor insurer telematics device hack: External attack through software vulnerabilities, causing large remediation / device replacement costs, driving a 1 in 200 loss of £70.0m (c. 18% of annual revenue).Limitations: The following sets out key limitations of the work set out in this paper:∙While the presented scenarios are deemed material at this point in time, the threat landscape moves fast and could render specific narratives and calibrations obsolete within a short-time frame.∙There is a lack of historical data to base certain scenarios on and therefore a high level of subjectivity is used to calibrate them.∙No attempt has been made to make an allowance for seasonality of renewals (a cyber event coinciding with peak renewal season could exacerbate cost impacts)∙No consideration has been given to the impact of the event on the share price of the company.∙Correlation with other risk types has not been explicitly considered.Conclusions: Cyber risk is a very real threat and should not be ignored or treated lightly in operational risk frameworks, as it has the potential to threaten the ongoing viability of an organisation. Risk managers and capital actuaries should be aware of the various sources of cyber risk and the potential impacts to ensure that the business is sufficiently prepared for such an event. When it comes to quantifying the impact of cyber risk on the operations of an insurer there are significant challenges. Not least that the threat landscape is ever changing and there is a lack of historical experience to base assumptions off. Given this uncertainty, this paper sets out a framework upon which readers can bring consistency to the way scenarios are developed over time. It provides a common taxonomy to ensure that key aspects of cyber risk are considered and sets out examples of how to implement the framework. It is critical that insurers endeavour to understand cyber risk better and look to refine assumptions over time as new information is received. In addition to ensuring that sufficient capital is being held for key operational risks, the investment in understanding cyber risk now will help to educate senior management and could have benefits through influencing internal cyber security capabilities.

Insurance of Cyber Risks in International Transport

“…A39-19. The Assembly's resolution on cybersecurity is also only of a recommendatory nature and, in addition, the activities set out therein were implemented by the 40 th session of the ICAO General Assembly (Resolution A40-10: Addressing Cybersecurity in Civil Aviation), which took place from 24 September 2019 to 4 October 2019 and resulted in the approval of the ICAO Cybersecurity Strategy, which is again 13 15 On that ground the Study group is analysing recent developments of cyber-security control measures and giving guidance how to reduce risk of cyber-security attacks aimed on the critical aviation information systems.…”

“…The Electronic Chart and Display Information System 19 (ECDIS) is an electronic assistance system employed in the management of vessel. The cybersecurity of the ECDIS system is often underestimated by the ship--owners, who are implementing software and hardware components 15 ECAC Doc. 30, chapter 14.…”

“…Insurance of ground vehicles (besides the railway fleet) is one of the major insurance risks only if the policyholder exceeds the limits for at least two of the criteria set out in Article 13(27) of the Solvency II directive 62. According List of data breaches and cyber attacks of 2020 there were reported15 data breaches in transport and automotive (Irwin, L. (2021) 2020 cyber security statistics, IT Governance Available from: www.itgovernance.co.uk/blog/2020-cyber-security-statistics [Accessed 24 June 2021]). 63 According to the summarized Assessment report of AIG designed for the client with annual revenue 51.000.000 USD the Data Breach Impact (median impact value per record volume) Bentley et al hold an opinion that only limited data on cyber incidents are available and thus it is very difficult to get data pertaining to the losses suffered by one organization…”

The Digital (R)evolution of Insurance Business Models

“…Several media articles and studies, mostly by practitioners and fewer from academic researchers, attempt to investigate the impact of digitisation applied to the insurance sector (Segev and Vickers, 2017;Muller et al, 2015;McKinsey, 2016;Willis Towers Watson, 2017). They analyse the strategic implications of new technologies on cost structures (Freysoldt et al, 2018;Berger et al, 2016;Catlin et al, 2015), business processes (KPMG, 2019;EY, 2018), customer satisfaction (Larsson and Broström, 2019;Moneta, 2014), human resources (Johansson and Vogelgesang, 2015) and newly emerging risks (Singh et al, 2020;Egan et al, 2019;Biener et al, 2015).…”

The actuarial science editorship of the Accounting & Finance Review: some general considerations

“…Thus, new topics have widened the research agenda in actuarial science. Cyber risk (Egan et al, 2019;Eling, 2018) and the internet of things (with its major impact on the area of health) (Spender et al, 2019) can both be mentioned here. Similarly, not so recent techniques, such as predictive modeling, are being used more and more (again particularly in health) (Duncan, Loginov & Ludkovski, 2016;Lally & Hartman, 2016).…”