Cyber Risk

Cyber Risk

1. Ex-Ante Mitigation

   • From a company's perspective
     • Demonstrate due diligence, ownership, and effective management of cyber risk
     • Create an appropriate cyber risk escalation framework that includes risk appetite and reporting thresholds
     • Align cyber risk program and capabilities to peer organizations and industry standards
     • Monitoring the risk environment
     • Keep track of data assets
       • Technology Risk Exposure Assessment
     • Establish a risk plan
     • Obtain management support
     • Prepare employees
     • Build strong public relationships
     • Implement security protocols
     • Evolve with the technological environment
       • Cyber Threat Environment Assessment
     • Embed cybersecurity awareness culture into operations

2. Ex-Post Responses

   • Mobilize the incident response team
   • Manage external relations
   • Secure systems and ensure business continuity
   • Conduct a thorough investigation
   • Address legal and regulatory requirements
   • Bear liability
   • Cybersecurity risk insurance
   • Enhance enterprise resilience

3. Drivers (Risk Analysis)

   • Increased use of technologies
   • Globalization
   • Criminal syndicates
   • Careless employees
   • Ineffective risk governance and oversight
   • Device proliferation

4. Historical Impact

   • WannaCry ransomware (May 2017) (150 countries affected) (Over $4B in losses)
   • One of the largest health insurers in U.S. had addresses, employment information, and income data exposed (2015) (78M users affected)
   • Another major insurer had personal information breached (2015) (1.1M members affected)
   • U.S. health insurer had confidential information exposed (July 2016) (3.7M customers and health care providers affected)

5. AXA Emerging Risks Survey 2017: #2 on list of main emerging risks by 2025

6. Importance of Cyber Risk Management

   • Evade data leakages
   • Technology has become an increasingly integral aspect of the workplace
   • Businesses rely on technology to be connected at all times and to perform work effectively
   • Ransomware protection
   • Mitigates direct economic costs
   • Avoid reputational damage
   • Curtails legal consequences that would have to be dealt with in aftermath of a cyber crisis