Raising the profile of digital risks
© lloyds.com Limited 2002
Tuesday, 7th May 2002 - DK Matai, chairman and CEO of mi2g, a digital
risk management and bespoke security architecture group, tells lloyds.com
the appetite for digital risk insurance is not as strong as it should be -
especially as such cover is usually excluded from traditional policies.
Viruses, worms, denial of service attacks receive high profile media coverage
and can cost companies millions of dollars in downtime. But DK Matai, chairman
and CEO of mi2g, tells lloyds.com that many companies are not sufficiently
aware of the nature of digital risks or what coverage is available for them.
Matai regularly lectures on electronic security and defence issues and is
a specialist advisor to the International Underwriting Association's (IUA)
Digital Risk Working Party, which was established in November 2001.
What does the IUA's Digital Risk Working Party hope
The IUA's digital risk working party hopes to establish greater awareness
of the precise nature of digital risks and liabilities within the insurance
and reinsurance industry – both at the supplier and customer level – and their
impact on existing risk transfer solutions, as well as new mechanisms.
Since January 2002, what kind of policies have excluded
digital risks because of September 11?
Even before September 11 the issue of data exclusion and other digital liabilities
was under consideration by insurers and reinsurers for exclusion. But the
shrinking of the capital base of many players post-September 11 has galvanised
action amounting to data exclusion in the property, business interruption
and liability areas.
Are companies sufficiently aware of their digital
Businesses are largely unaware of the ramifications of data exclusion. They
have not fully understood and quantified the cost of downtime, loss of business,
damage to brand name, share price crash, loss of data to rivals and upstream
and downstream liability. The Carlsbad-based Computer Economics Institute
has estimated the worldwide economic impact of malicious code attacks reached
$13.2bn in 2001. For example, post the recent exclusions, property insurance
cover does not include the data on a CD-ROM burned in a fire.
The value of the intellectual property on the CD may be £1m ($1.4m), but
property insurance excludes data and cover for the loss of the CD at £1 to
£10. Insurance companies would argue that property cover never covered digital
risks such as loss of intellectual property, but now they have made it an
If a business suffers an interruption as a direct result of erroneous feeds
of data or omission of certain data, the business interruption cover may not
apply post the data coverage exclusions.
In this case, insurance companies would argue that business interruption
cover never covered digital risk such as errors and omissions, but now they
have made it an explicit exclusion.
What do you feel is the right balance between companies
adopting risk management measures and buying insurance?
Preventive digital risk management encompasses buying the appropriate insurance
cover as one of the measures from mi2g's perspective. Digital risk management
covers four key areas: Technology, people, law and insurance. Within technological
areas one would look at the configuration of computer equipment, disaster
prevention and recovery, its compliance with the ISO17799/BS7799 standard
as a benchmark, as well as intrusion detection and the speed of response in
dealing with anomalous digital behaviour patterns.
On the people side - which is the critical area as 70% of digital attacks
are due to people-related exposures - it comes down to the correct policies,
training and vetting that help to control the most unpredictable element of
digital risk without stifling creativity.
With respect to law, the issue is jurisdiction. This includes dealing with
breaches of the Data Protection Act, litigation and defence within the international
Regarding insurance, it is a case of procuring the usual business interruption,
workers' compensation, property and liability cover suites along with appropriate
specialist digital risk covers that fill the gaps created by exclusions.
Premiums have soared post-September 11, and we are finding the appetite
to buy digital risk cover is not as strong as it should be. Businesses are
cutting back even on their existing policies within this hard priced environment.
Will cyber insurance ever become ubiquitous?
Yes. Either when the government legislates and makes it mandatory, or when
there is a high profile digital disaster which makes captains of industry
at CEO or CFO level sit up and take note of digital risks and effective ways
to manage or mitigate them. According to the 2002 FBI/CSI computer crime survey,
commercial and governmental organisations are reluctant to admit breaches
– even to the police. This culture is understandable. But it will need to
change to arrive at a juncture where buying digital risk cover will be considered
Hackers are often part of the companies and organisations
they attack. Should fidelity risks be managed alongside digital exposures?
Yes. The biggest digital threat to organisations is from within, unless
that organisation is specifically targeted during a war by an online enemy
attacker or enemy-sympathetic attackers.
You have spoken of 'asymmetric warfare'. What is
an 'asymmetric' digital attack and how are the risks of one evaluated?
An asymmetric digital attack may be from very few individuals, but impacts
thousands - say 40% of the 40,000-strong workforce of a multinational. Most
digital attacks are asymmetric. The typical impacts of a digital attack may
- Piracy: The loss of sensitive information or intellectual property.
- Surrogacy: The usurping of the electronic identity of an organisation
or individual and abusing their brand or good name.
- Denial of service: Business interruption.
- Hazards: Malfunctioning fire alarm, elevators, security cameras, air conditioning
How can such attacks be mitigated?
Digital attacks can be mitigated only through a concerted and holistic effort
to remove vulnerabilities on multiple fronts. On the technical side, mitigation
may be achieved through bespoke security architecture comprising firewalls,
intrusion detection and anti-virus toolkits. With respect to human resources,
it may be achieved through the correct personnel policy and training that
prevent social engineering, plus up-to-date employment contracts and vetting
On the legal side, mitigation may be achieved through the appropriate adherence
to the UK Data Protection Act and service level management umbrellas that
encapsulate the appropriate security measures within service level agreements.
There is no such thing as 100% security, which is where insurance comes
in. In such circumstances, the appropriate insurance cover that deals with
business interruption, liability, property and workers’ compensation specifically
relating to data risks would be appropriate.
Has the correlation between political conflict and
digital atttacks become more evident since the NATO air strikes on Serbia
We have found over the last four years that most international digital attacks
not internally motivated by disaffected employees are driven by ideological
concerns. Those concerns may range from such groups as anti-capitalist protestors,
environmentalists, animal rights demonstrators, and anti-biotechnology and
genetics modification protestors to political activists who oppose a particular
government or ideology. The other primary reason is intellectual challenge.
The China-Taiwan cyber war of July-August 1999, the America-China cyber
war of April 2001 and the anti-NATO countries cyber attacks in September and
October 2001 are good examples of political conflicts that led to digital
The one to watch in 2002 is the Israel-Arab conflict and how digital attacks
square up in the months ahead as a direct result of political tension.
To comment on this or other articles please contact lloyd's.com