Cybersecurity Incidents Are Major Business Disruptions

Recently, Allianz Insurance released its Risk Barometer for 2018, which surveyed more than 1,900 risk management experts from more than 80 countries.

The survey covered Allianz customers, insurance brokers, risk consultants, underwriters, executives and surveyors. The poll was carried out in October and November 2017.

Service Interruptions and Security Incidents go Hand-in-Hand

Businesses from small to multinational companies were asked to name their top concerns. For the sixth time in a row, service interruptions made it to the first place with 42% of all polled.

“For the first time, business interruption and cyber risk are neck-and-neck in the Allianz Risk Barometer and these risks are increasingly interlinked,” said Chris Fischer Hirs, Chief Executive Officer, AGCS.

“Whether resulting from attacks such as WannaCry, or more frequently, system failures, cyber incidents are now a major cause of business interruption for today’s networked companies whose primary assets are often data, service platforms or their groups of customers and suppliers.”

With today’s continuous progressions in business digitisation, companies see a strong link between business interruptions and cybersecurity incidents.
 
According to 40% of all those polled, the risk of cybersecurity incidents is considered the second most important issue businesses are facing today. Only five years ago, cyberattacks were listed in 15th place on the risk rating chart.

In Europe, pressure will also increase, as the European General Data Protection Regulation (GDPR) will become effective on 25 May 2018. It seems that smaller and mid-sized companies became more aware of cybersecurity risks over time.

Refocusing from Risk Identification to Prevention

The insurance industry is adapting to the increased recognition of cyber threats, but not necessarily at the same pace as these threats are increasing. Establishing expertise, integrating cyber risk into existing offerings, and adding new products is taking some time.

But the portfolio of cyber insurance offerings is growing, and the outcome of the Allianz Risk Barometer validates a growing demand, especially with GDPR looming. There needs to be a shift toward cyber threat prevention vs. reactive security measures, and that will become more important for the insurance industry, just as it is for the IT security industry.

Paradigm Shift on the Horizon

More and more companies are coming to realise that traditional reactive security efforts from the past are not keeping up with today’s cybersecurity risk landscape, even if they are implementing interconnected platforms of signature-based legacy antivirus technologies.

Typically, up to 75% of a company’s IT spending is used for management and maintenance of existing IT systems. Qualified employees’ adept at migrating legacy IT systems into modern architectures are rare and can be expensive.

On top of that comes a high percentage of legacy security technology that is based solely on detection and response capabilities, not actual prevention. This type of defense strategy consumes and depletes resources, while, at the end, it is totally ineffective.

Today, it still takes an average of 229 days until a breach is detected. Being able to quickly clean up after an incident is important, but preventing the breach in the first place is golden.

The monetary damage averages at $158 USD per breached data record, according to the ICT Ransomware Report. Additional layers of Detect and Respond systems are not capable of protecting against the high cadence of polymorphic and highly sophisticated attacks.

This is why service interruptions now lead the pack of business risks listed in the survey.

While targeted attacks are more sophisticated today, we also see a continuous evolution in malware commercialisation. Mutation and encryption tools are easily available to ‘part-time’ cyber criminals today. While those tools have existed for years, today they are available as-a-service for a low monetary investment.

Today, virtually anyone with an Internet connection can purchase toolkits or even full malware campaign services that can easily bypass traditional security solutions through a broad stack of attack vectors.

So, one piece of malware can be reused infinite times, with low or no knowledge required about malware programming. The phenomenal increase of crypto currencies is just another indicator.

Conclusion

Cybersecurity threats are not the exclusive concern of IT departments anymore - other business units are taking note of the impact to business procedures and continuity. The latest Allianz Risk-Barometer underpins the direct connection between business interruption and cybersecurity incidents.

Many companies are trying to patch their security strategy by adding and connecting more layers of legacy Detect and Respond technology that utilize a common pile of threat intelligence.

However, evasion of such multi-layer systems is possible and progressively cheaper than ever before. Organisations should rethink and modernise their cybersecurity arsenal.

True prevention is possible today, with solutions based on artificial intelligence and machine learning which are not dependent on URL lists, signatures, or heuristics, solutions that prevent attacks by way of self-sufficient math models that are extremely lightweight and compatible with corporate business needs.

To contact the GDPR Advisory Board please visit:  www.gdpr-board.co.uk

Threat Matrix

You Might Also Read: 

Businesses Using Apple & Cisco Products Pay Less For Insurance:

Companies Are Buying Cyber Insurance 'in mad panic':

 

« US City Of Atlanta Suffers An Attack
Have You Gauged The Cost Of A Cloud Outage? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Centre for International Governance Innovation (CIGI)

Centre for International Governance Innovation (CIGI)

CIGI research areas include Conflict Management & Security which encompass cyber security and cyber warfare.

SecureNow Insurance Broker

SecureNow Insurance Broker

SecureNow is a commercial insurance broker based in India. Services offered include Cyber Risk insurance.

KZ-CERT

KZ-CERT

KZ-CERT is the national Computer Emergency Response Team for Kazakhstan.

Physec

Physec

Physec offers innovative security products and solutions for the Internet of Things ecosystem.

SPARTA Consortium

SPARTA Consortium

SPARTA tackles hard innovation challenges, leading the way in building transformative capabilities and forming a world-leading cybersecurity competence network across the EU.

Outsource UK

Outsource UK

Outsource UK is an independent recruitment company supplying highly-skilled technology, change and engineering talent to clients within a range of specialist sectors including Cyber Security.

Arctic Wolf Networks

Arctic Wolf Networks

Arctic Wolf Networks delivers the industry-leading security operations center (SOC)-as-a-service that redefines the economics of cybersecurity.

Findcourses.co.uk

Findcourses.co.uk

Findcourses is a dedicated education search engine designed to make it easy for our learners to search and find exactly what they need from our community of trusted training providers.

Censys

Censys

Our customers rely on Censys data to get the global visibility they need of their attack surfaces in order to proactively prevent nation-state attacks and emerging threats.

NuID

NuID

NuID is a pioneer in trustless authentication and decentralized digital identity.

DECODE

DECODE

DECODE is the premier cyber security conference in the Philippines hosted by Trend Micro.

TwoThreeFour

TwoThreeFour

ThreeTwoFour provide tailored cyber security solutions, delivered by highly-skilled, experienced consultants who respond to the real needs of you and your business.

TheGreenBow

TheGreenBow

TheGreenBow is a trusted VPN software company. We help organizations and individuals become cyber-responsible. For this, we design and develop reliable and easy-to-use solutions.

Stryve

Stryve

Stryve is a leading carbon-neutral provider of specialist cloud and cybersecurity services in Europe.

SMARTEST

SMARTEST

SMARTEST is a world-class IT solutions provider active in the most challenging and demanding industries such as the oil and gas industries.

Securonix

Securonix

Securonix delivers a next generation security analytics and operations management platform for the modern era of big data and advanced cyber threats.