Making digital risk a board-level concern

A key part of the UK Government’s National Security Strategy for 2010 focuses on the increasing risks of cyber attack. “The revolution in global communications and increased movement of people, goods and ideas has also enabled the use of cyberspace as a means of espionage,” it points out.

If politicians are making cyber risk a priority, then so too should businesses. This is the compelling case put forward by a new digital risk report produced by Lloyd’s in co-operation with HP Labs.

With businesses increasingly reliant on technology, attacks becoming more sophisticated and more widely targeted, regulators threatening to levy fines for data breach, companies have a multitude of reasons for pushing digital risk up the board room agenda.

Growing exposures

The rich and evolving threat environment is making it increasingly difficult for the business world to keep on top of digital risk, with organised cyber-criminals behind a growing number of attacks. At the same time, the way companies use technology is also changing rapidly. 

Phishing, viruses, malware, worms and hacking may sound like the stuff of Hollywood movies, but they are a very real threat to individuals, businesses and governments. The report details numerous real-life examples of victims of cyber attacks – ranging from supermarkets and banks to nuclear facilities. 

“Risk managers need to pay attention to both future threats and future uses of technology, moving beyond today’s largely reactive approaches,” the report advises.

Companies face numerous exposures as a result of digital risk and are “increasingly vulnerable to system failures, data losses and cyber attacks”. This includes operational, financial, intellectual property, legal, regulatory and reputational risks.

“It’s not only financial information people are looking for,” says Iain Ainslie, technology and cyber liability underwriter at Ace European Group. “It could be critical business information such as plans, new product

information – so anyone in the design and manufacturing arena is potentially a target.”

“In the US market there’s a big growth in trying to steal people’s medical information – so personal information is a massive growth area for hackers.”

While people may think an obvious target for digital attacks is online retail, this industry sector (along with financial services) are generally well-versed in the digital risks they face, implementing necessary control systems. It is the traditional “bricks and mortar” businesses which have moved into the online space who may be more vulnerable, thinks Ainslie.

It is not just the risk of data theft that is of concern. System failures caused by cyber attacks can bring down whole supply chains.

“Companies do need to raise the profile of digital risk,” says Ainslie. “It’s becoming unfair for the head of IT to be burdened with the risk of an organisation.”

“The actual decisions made regarding the risk of a whole organisation should be made at a much higher level.”

Risk transfer

With many traditional property and commercial liability insurance policies excluding cover for digital risks, there may also be a gap in cover that companies are not aware of. Traditional business interruption policies focus on damage caused by fire or flood but not on non-physical damage, such as denial of service attacks.

“There are two or three areas starting to converge and perhaps as insurers, it’s easier for us to see those different areas coming together, Ainslie says.

“This is why we’re trying to get the information out there as part of the learning process but also to raise the profile of the market that we’re able to provide that kind of cover.”

Various types of insurance cover for cyber risk are now available, covering online fraud, data theft and other forms of cyber risk. Some cover the reputational damage caused by an attack.

Risk transfer for digital risk may not be considered by many firms because the motivation of IT managers differs from that of risk managers. It is natural for IT professionals to want to reassure their employers that systems are adequately protected - risk managers are more likely to take a realistic view of the exposure.

“Today most digital risk mitigation happens within the IT department,” the report concludes. “We advise that risk managers are involved, and bring broader business perspectives to decisions.”