Category Archives: Cyber Risk

Business Risk, Catastrophes, Cyber Risk, Emerging Risks, Terrorism Risk

Intent and ability distinguish cyberrisk from natural perils

Leave a comment

Cyberrisk is often compared with natural catastrophe-related threats, but a recent study by global reinsurer Guy Carpenter and analytics firm CyberCube suggests a better analogy is with terrorism.

“Probability is assessed in terms of intent and capability.”

The report – Looking Beyond the Clouds: A U.S. Cyber Insurance Industry Catastrophe Loss Study – quotes Andrew Kwon, lead cyber actuary for Zurich: “Extending the lessons learned from property cats to the cyber space is intuitive and logical, but cyber continues to be a unique force unto itself. A hurricane does not evolve to bypass defenses; an earthquake does not optimize itself for maximum damage.”

This passage resonated as I read it because a few hours earlier I’d been reading a FreightWaves article about risks posed to international shipping by digitalization and pondering the fact that the same technology that helps vessels anticipate and avoid adverse weather also subjects them – and the goods they transport – to a panoply of new risks.

The FreightWaves article quotes U.S. Navy Captain John M. Sanford – who now leads the U.S. Maritime Security Department within the National Maritime Intelligence Integration Office – describing how the NotPetya virus inflicted $10 billion of economic damage across the U.S. and Europe and hobbled company after company, including shipping giant Maersk, in 2017.

Sanford said Russian military intelligence was behind the hacker group that spread NotPetya to damage Ukraine’s economy. The virus raced beyond Ukraine to machines around the world, crippling companies and, according to an article in Wired, inflicting nine-figure costs where it struck.

“Maersk wasn’t a target,” Sanford said. “Just a bystander in a conflict between Ukraine and Russia.”

Collateral damage.

The FreightWaves article describes how supply chains, ports, and ships could be disrupted more intentionally through GPS and Electronic Chart Display and Information System (ECDIS) systems onboard ships, or even via a WiFi-connected printer: “Pirates working with hackers could potentially access a ship’s bridge controls remotely, take control of the rudder, and steer it toward a chosen location, avoiding the expense and danger of attacking a vessel on the high seas.”

The Carpenter/CyberCube report identifies parallels in the deployment of “kill chain” methodologies in both conventional and cyber terrorism: “Considering terrorism risk in terms of probability and consequence, probability is assessed in terms of intent and capability.”

As our work and personal lives become increasingly interconnected through e-commerce and smart thermostats and we look forward to self-driving cars and refrigerators that tell us when the milk is turning sour, these considerations might well give us pause.

Hurricanes, earthquakes, fires, and floods might be scary, but at least we never had to worry that they were out to get us.

 

Cyber Risk

Hope the (fire)wall is high enough

Leave a comment
Getty Images

Fans of Game of Thrones are getting ready to learn the fate of their favorite characters when the final season of the show starts airing on HBO on April 14th. At the same time, security experts are warning that cyber-crooks are ready to take advantage of the show’s popularity to attack people’s computers.

The huge popularity of the show makes illegal download sites, where users can view episodes without the required subscriptions, popular distribution points for malware. In 2018 Game of Thrones accounted for 17 percent of all infected pirated content, according to Kaspersky Labs, even though no new episodes aired that year. This suggests that the coming premiere could be the most dangerous time to be downloading the torrents.

According to Kaspersky, the most popular kind of attack via pirated content was a trojan, a piece of software that is installed on a computer and allows the hacker to take control of that device.

The good news is that, overall, the prevalence of TV show-related malware has been declining. In 2018, the total number of users who encountered this kind of malware was 126,340, a third less than it was the year before. The number of total attempts dropped by 22 percent, to 451,636. Kaspersky said that drop was in line with a reduction in the number of security threats across the internet. But it might also be linked to a drop in the number of people using torrents, as interest in the technology declines.

Cyber Risk, Technology

Reminder: your smart home security system is hackable

Leave a comment

Doors that can be locked remotely with a smartphone app. Facial recognition cameras that alert you when certain people arrive at your front door. Motion sensors that trigger video recordings when someone steals your Amazon packages.

If we’re being honest, smart home security systems sound extremely creepy to me.

But I understand the sell: smart home security devices can keep people safe and offer peace of mind – did I remember to lock the door? Doesn’t matter, my phone can lock it.

Nothing in this world is perfect, though. Unlike smart home security systems, you can’t use a computer to hack into and unlock a standard deadbolt.

The Insurance Journal recently ran a piece describing yet another experiment where researchers easily hacked into someone’s smart home security system. In one scenario, a researcher hacked into a person’s phone using a coffee shop’s free WiFi. Once inside, he accessed their smart light switch app, and then jumped from there into the smart home’s security devices. Voila, smart door unlocked. All that’s missing is a red carpet to welcome thieves as they waltz in the front door.

This shouldn’t be news. Here’s a video from 2016 of researchers hacking into a smart lock:

Everything is a trade-off. As informed consumers, we can’t assume that a solution to one security problem (forgetting to lock our doors) will solve every other security problem – or that it won’t create new ones (hacking into our front doors). It’s important to weigh the risks and benefits of smart home security, and to conduct due diligence in researching the cybersecurity protections of each system. It’s also important to consider additional protections, like purchasing cybersecurity insurance coverage, just in case.

If that sounds onerous, it’s nothing compared to dealing with a robbed house.