News + Resources

Over the last 25 years, reportage on information risk and cyber security has moved from arcane articles on information assurance in specialist journals, to regular news items in the mainstream media. These days there’s nothing like a good breach to get the creative juices flowing. For a brief time everyone is an expert; lurid stories of imminent catastrophe abound, geopolitical tensions rise and global meltdown is presaged. And when there is a breach – or a big ransom payment – market forecasts shoot through the roof, both in terms of estimates of damage to the world economy, and predictions of the growth in expenditure on cyber security. But then the wave subsides. Until the next one.

If the damage caused by cybercrime was more visible, or the true extent of it understood, it would cause an outcry: according to analysts, cyber-crime in 2020 cost the world economy $1trillion[1].  That’s the GDP of the Netherlands. Ransomware is estimated to have cost $7.5bn in 2019[2] and $250bn by 2035[3] – that’s the GDP of Portugal. These are appalling numbers, and the amount spent on cyber security is trivial in comparison. One source reports global cyber security spending  at around $60bn per annum[4].

The continuing ransomware plague demonstrates the unrelieved tension between governments and industry about what to do about it. Governments are wondering out loud (most recently the Dutch) about making ransom payments illegal, since such payments just encourage more ransomware.  The US are using OFAC and sanctions as a disincentive to pay ransoms.  But moral suasion and dark imprecations against funding terrorism have not had much of an impact.  If ransomed, most companies would still pay (or ask their insurers to pay if they had the right cover) to get their data back – and would be happy if it could be kept quiet – rather than invest in people, processes and technology to limit ransomware’s reach.  The question is, why?

Basic cyber hygiene – including patching, updating systems, training, multifactor authentication, comprehensive anti-virus and firewalls, control over removable media and proper back up arrangements etc – would reduce much of the impact of ransomware. Yet company boards, while naturally concerned not to get hit, are reluctant to spend any more than they have to on IT security, as it feels like  an investment with no return.  There are still too many cases of systems and programmes being used long after the manufacturers have stopped supporting them. In some cases, companies take the view ‘if it ain’t broke, don’t fix it’; in others, companies do not want to upgrade because they cannot be sure that some critical applications will work on newer platforms.   And horror stories abound of hackers getting through insufficient defences, exploiting well known vulnerabilities at will, to bring services – in some cases critical – to a standstill. Some, particularly in areas of critical infrastructure, have realised doing nothing is not sensible and are now playing catch up.  But despite all the news, many companies are still seriously under-weight in their approach to cyber security, either hoping for the best or reckoning the cyber threat is over-hyped and not a legitimate reason to invest more than the minimum in preventive activities or technologies.  

The UK’s National Cyber Security Centre is doing a Herculean job in making good advice available to all who might wish to read it. In many jurisdictions, national and supra-national organisations are doing similar. Cyber security regulations are tightening in areas of critical national infrastructure, and around the use and protection of personal data. But the application of good cyber security practice is still patchy. And given the interconnectedness of everything, this patchiness is a risk in and of itself.

In cyber land, prevention is always better than cure. We in the insurance sector have a role to play in risk transfer (and risk management), provided we can see that the insured is doing what they can proportionately and pragmatically to manage the risks. But prevention, like vaccination, can be unpopular, especially at times of economic uncertainty. All we would say is that dealing with a breach or a successful ransomware attack is far more costly, in real cost and negative return on management effort, than getting your basic cyber hygiene right in the first place.

Company directors have a duty to their shareholders to safeguard the assets and equity of the companies they lead. The definition of the term ‘asset’ does not yet include information or data.  Yet failure to protect information assets can seriously damage both shareholder value and consumer confidence. On the principle of ‘what gets measured gets done’, enshrining in law the obligation to afford information assets the same degree of care as financial or physical assets (e.g. through amendments to the Companies Act) could significantly improve the treatment of information risk at the corporate level and reduce risks in bigger agendas of e.g. smart cities, autonomy and even climate change.

It’s not all bad – there is a lot of good stuff being done out there. But:

• If government believes that paying ransom is against public policy, they should ban it – but it needs to be banned globally to avoid ‘ransom arbitrage’
• If governments and investors want information assets to be as well protected as financial and tangible assets, they need to legislate changes to what constitutes an asset (in e.g. the Companies Act) and require CEOs and boards of directors to apply the same level of fiduciary duty to information assets as they must to tangible and financial assets
• Governments might wish to incentivise boards to comply, through e.g. tax incentives for security investments, to avoid the costs being passed onto customers

Unless and until data assets get the same protection in law as financial or physical assets, the asymmetric struggle will continue to leach profit, compromise investor and customer confidence and frustrate valiant efforts to improve national security and resilience. The proliferation of ransomware and other breaches are indications that in most cases vulnerabilities were left unplugged and critical data was exposed.  While it is easy to fire the CIO for this error, it is also often the case that the board was culpable in refusing to deal with cyber risks appropriately and quickly. Let’s call breaches what they really are – failures.  But let us also give boards a reason to do something about them rather than an excuse to do nothing.

[1] https://www.techradar.com/news/cybercrime-cost-the-world-over-dollar1-trillion-in-2020

[2] Ransomware may have cost the US more than $7.5 billion in 2019 | MIT Technology Review

[3] 1 Brave, David, Global Ransomware Damage Costs Predicted to Reach $250 Billion (USD) by 2031, Cyber Security Ventures, June 1, 2021. Quoted by CISCO (The cost of ransomware attacks: How to protect your data – Cisco Umbrella)

[4] https://www.statista.com/statistics/991304/worldwide-cybersecurity-spending/