2017 Most Dangerous Emerging Risks

Cyber Business Interruption

Attacks on internet infrastructure commence, leaving unknown risks for insureds and insurers alike.
By: | April 7, 2017 • 8 min read

There are more than a billion websites on the internet but they rely on just a handful of companies to keep them operating.

Confidence in the system’s resilience declined significantly in October 2016, when a massive distributed denial of service (DDoS) attack assaulted Dyn, a company that controls much of the internet infrastructure.

Advertisement




That DDoS attack, in turn, brought down major sites including Netflix, CNN, Spotify, Airbnb, Twitter and many others in Europe and the U.S.

“At this point we know this was a sophisticated, highly distributed attack involving tens of millions of IP addresses … across multiple attack vectors and internet locations,” said Kyle York, Dyn’s chief strategy officer on Oct. 21.

The attacks originated from Mirai-based botnets via internet-connected DVRs, video cameras and devices. Those attacks substantially disrupted service at the managed DNS (domain name system) infrastructure for about two hours from about 11 a.m. to 1 p.m. GMT, and again from about 4 to 5 p.m. GMT, with residual impact until about 8:30 p.m. on Oct. 21.

Then, to add more uncertainty, came the outages on Feb. 28 connected to Amazon Web Services. Although this was due to human error — apparently a coding error — rather than maliciousness, the result was the same: Companies, large and small, including Netflix, Airbnb, the Securities and Exchange Commission and Expedia, became inaccessible or their sites ran like molasses.

The problem, affecting mostly the East Coast, lasted from about 12:30 p.m. to about 4 p.m. ET.

“I definitely think [internet outages] will continue to happen,” said Nick Economidis, underwriter at Beazley. “I think there are some unknown risks out there.

“We are dealing with new exposures and new risks that we don’t have the background for, and I think there are going to be some surprises. … I think Dyn caught a lot of people’s attention.”

Dan Burke, vice president and cyber product head at Hiscox USA, agreed.

Fred Eslami, senior financial analyst, property and casualty, A.M. Best

“I think this is an attack vector we will continue to see for the foreseeable future, based on the ease in which one can initiate such attacks. … Just the sheer volume of devices that can be compromised and used to launch these attacks — there are such economies of scale in this space that we will continue to see this happen,” he said.

Such broad internet outages affect insureds and insurers alike, and the potential downside could be devastating.

For insureds, it’s the concern that their losses, which could last for months after an outage, will not trigger coverage in their policies. For insurers, it’s the fear of a catastrophic accumulation of cyber exposures.

Low Limits or Lack of Coverage

Steve Bridges, senior vice president of cyber risk and E&O, JLT Specialty USA, said that for many companies, a business interruption loss due to an outage at a cloud partner or ISP would only be covered if caused by a security failure and then only with a sublimit under most cyber policies.

The reason? Fear of risk aggregation, he said. “[Insurers] could have a catastrophic loss across industries and a bunch of different policies,” Bridges said.

“The cyber insurance marketplace is starting to extend contingent/dependent business interruption to include system failure triggers and to offer higher limits, but is wary about the impact of these aggregate loss situations,” he said.

For companies that offer significant CBI coverage, an extended cyber event affecting an ISP or cloud provider could result in them paying huge claims to their insureds resulting from an event affecting a company they didn’t underwrite or insure, Bridges said.

And with the lack of standardization of cyber policies, many insureds are uncertain if they even have coverage.

Plus, insurers have limited experience adjusting cyber BI or CBI claims. There haven’t been that many, and adjusting them is quite different than data breach or privacy claims that have become more common.

Advertisement




There is a lot of skepticism that companies will be able to successfully resolve a cyber BI or CBI claim should they face a cyber-related disruption, said Adam Thomas, principal with Deloitte’s cyber risk services team, and co-author of “Demystifying Cyber Insurance Coverage.”

“Many insurers have tunnel vision when it comes to writing cyber policies, focusing primarily on marketing cyber products for personally identifiable data hacks and business disruption while not offering insurance for the many other cyber risks that companies face,” the report said.

While some insurers and brokers have worked with insureds to help them understand where exposures exist, Thomas said, uncertainty — primarily due to lack of good data — is common.

He noted that coverage is often ultimately decided by court decisions and there is not yet definitive case law relating to this type of claim.

Burke at Hiscox said that CBI coverage is traditionally found in the policies of larger insureds and is making its way down market to smaller insureds. Some policies may offer sublimited coverage for all service providers, while others may provide coverage only for providers specifically named by the insured.

Regardless, “it has been difficult to prove” a BI or CBI loss, he said.

Often, coverage is not triggered until a designated waiting period, typically eight to 12 hours. Plus, it is difficult even in a property-related BI claim to quantify losses during the event or time of restoration, let alone a cyber BI claim. It requires the expertise of a forensic accountant.

“Because Dyn was down only three hours [during the second attack of the day], there was very little insurance loss,” said Scott Stransky, assistant vice president and principal scientist at AIR Worldwide, although the economic loss was more than $100 million.

“If Dyn had been down for a day, it would not only result in billions in economic loss, but in significant insurance losses,” he said.

Companies face additional insurance issues if their websites don’t soon regain profitability.

Linking the recovery of lost revenue after the site comes back online is a challenge. There are other factors that could explain relatively poor performance, said JLT’s Bridges.

Typically, policies provide 60 to 90 days as the period of restoration, but for some companies, it can arguably be much longer before their customers return and revenue returns to expected levels.

Bigger companies that use cloud services from providers such as Amazon, Google, Rackspace, IBM or Microsoft, may have some leverage to contractually negotiate responsibility for losses over a certain amount, Bridges said. Small companies, not so much.

Risk Aggregation Fears

“I’m not getting a feeling that insurance companies themselves have a good idea of how to aggregate these [cyber] exposures,” said Fred Eslami, senior financial analyst, property and casualty, A.M. Best.

Advertisement




“It is scary,” he said, noting that when Dyn was attacked, about 70 companies were affected, with service lost for several hours on different occasions in a 24-hour period.

“I’ve been trying to get information on what the damage was, particularly in terms of business interruption,” he said.

“There is no information right now. I hear companies are working on it since October. But it’s apparently a challenging task to come up with an idea of what the damage was.”

Imagine, he said, if the attack lasted 24 hours and affected hundreds of companies. Insurance companies have “no actuarial or results-oriented data they can depend on to do their proper pricing or proper reserving.”

They may face claims from cyber policies as well as general liability, D&O, E&O or policy packages.

A comparable example might be Hurricane Andrew, which struck Florida and Louisiana in 1992 and drove 12 insurance companies out of business, AIR’s Stransky said.

Although many insurers are working to solve the risk aggregation issue, they remain uncertain what percentage of their book uses specific ISPs or cloud providers, he said, and there’s no easy way to determine that.

Adam Thomas, principal, cyber risk services team, Deloitte

Thomas at Deloitte said accumulated risk “is an area that’s been a hot issue for senior management at most insurers. There is a general level of discomfort over how well — or not well — they understand where the cyber-accumulated risk sits.”

“Some insurers may fear being overwhelmed by a sudden aggregation of losses in which a third-party provider or cloud computing vendor that works with a wide swath of businesses gets hacked and leads to service failures for all of its users,” according to Deloitte’s report on demystifying coverage.

“This sort of systemic event could spell chaos for the insurance industry,” it said.

“Insurers should consider implementing more rigorous underwriting policies to start minimizing aggregation risk.”

“The exposure [for insurers],” said Burke at Hiscox, “can aggregate so quickly and be so massive that I think it has the potential to put insurance company balance sheets at risk.”

Some companies, like AIR Worldwide and RMS, are creating models to help insurers understand their exposure.

Stransky said the AIR model analyzes an insurance company’s portfolio to look at the aggregation risk, using specific company policy inclusions and exclusions.

Burke said Hiscox creates its own scenarios and models them with the help of third-party providers.

Lloyd’s issued an oversight framework two years ago that requires all syndicates, including Hiscox and Beazley, to have a “specific risk appetite for exposure to cyber attack across all classes of business.”

Recently, the New York State Department of Financial Services (DFS) released cyber security requirements for all companies that operate in the state that are governed by the DFS. Among other rules, it requires companies to demonstrate the ability to recover from a cyber event and restore normal operations and services.

Eslami at A.M. Best said the regulation may help to improve the resiliency of insurers to a cyber attack. He noted that the National Association of Insurance Commissioners also requires companies to provide similar information.

It all depends on the elements of coverage, however. “Policy language is not generalized and cannot be applied the same way to all of the companies,” Eslami said.

He said insurance companies that issue cyber policies may want to consider limiting their exposure per industry sector to a certain dollar amount to give them a better handle on potential losses — and their ability to cover those losses.

We are dealing with new exposures and new risks that we don’t have the background for, and I think there are going to be some surprises. … I think Dyn caught a lot of people’s attention.– Nick Economidis, underwriter at Beazley

A.M. Best, he said, has suggested insurers model potential incurred-but-not-reported losses, and put aside a contingency reserve in response.

Right now, a huge natural catastrophe still has a greater potential to impact company solvency, he said. That could change as the frequency and manner of attacks increase, combined with the growth of cyber coverage and the Internet of Things.

Advertisement




“There is a 100 percent chance we will see something worse than Dyn,” Stransky said. “There’s no way to avoid it.

“In some ways, it’s good it happened,” he said.

“It was a great wake-up call. It got people thinking. It’s a good thing if they are nervous about this. It’s better to be nervous now than scrambling around when a big attack happens as they try to figure out what is going on.

“If they are more prepared, they will be more resilient when something happens.” &

________________________________________________________________

2017 Most Dangerous Emerging Risks

Artificial Intelligence Ties Liability in Knots

The same technologies that drive business forward are upending the nature of loss exposures and presenting new coverage challenges.

 

U.S. Economic Nationalism

Nationalistic policies aim to boost American wealth and prosperity, but they may do long-term economic damage.

 

 

Foreign Economic Nationalism

Economic nationalism is upsetting the risk management landscape by presenting challenges in once stable environments.

 

 

Coastal Mortgage Value Collapse

As climate change drives rising seas, so arises the risk that buyers will become leery of taking on mortgages along our coasts.  Trillions in mortgage values are at stake unless the public and the private sector move quickly.

Anne Freedman is managing editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Reputational Risk

Under Siege

Driven by social media, political wars spill over into the corporate arena, threatening reputations.
By: | May 2, 2017 • 12 min read

On Jan. 28, the New York Taxi Workers Alliance called a strike at John F. Kennedy International Airport, one day after President Trump signed an executive order banning entry of foreign nationals from seven Muslim-majority nations, including a blanket ban on refugees. The strike was an act of solidarity with immigrants, and a public display of the Alliance’s opposition to the executive order.

Advertisement




Uber, however, continued to service the airport, tweeting that it would halt surge pricing during the protests. Some saw it as an opportunistic ploy to get more riders to use Uber. A #deleteUber Twitter campaign was quickly born, with users tweeting screen shots of themselves removing the app from their smartphones.

More than 200,000 were estimated to have uninstalled the ride-sharing service over the course of the weekend.

Uber CEO Travis Kalanick reacted, creating a $3 million legal defense fund to provide lawyers and immigration experts for any of its drivers that were barred from the U.S., and promising that drivers would be compensated for lost wages.

Over the same weekend, in response to the travel ban, Starbucks CEO Howard Schultz announced that the company would hire 10,000 refugees worldwide over the next five years. Then it was Starbucks turn to get punished in the public arena. A #boycottStarbucks campaign was launched by people who felt the company should focus more on hiring American veterans.

Athletic shoemaker New Balance suffered blowback in November of 2016 when its vice president of communications, Matt LeBretton, told the “Wall Street Journal” in an interview that he believed “things are going to move in the right direction” under the new administration. Angry customers began posting pictures of themselves trashing or even burning their New Balance sneakers.

These social media-fueled public relations crises demonstrate how fickle public opinion can be. They also serve as warning signs of growing reputational risk for corporations.

Uber, for example, typically stops its surge pricing in the event of emergency so as not to exploit a crisis for its own benefit. To do so during the protests and taxi strike at JFK was perhaps meant to show its respect for the event.

Helen Chue, global risk manager, Facebook

Starbucks’ 10,000 refugee hires would be spread out across its locations around the globe, not just in the U.S., where the coffee conglomerate already promised to hire 25,000 veterans and military spouses by 2025.

New Balance’s LeBretton was speaking specifically about the Trans-Pacific Partnership during his interview, and how the deal could hurt sneaker production in the U.S. while favoring foreign producers — he wasn’t talking about Trump’s other proposed plans.

These companies, in reality, did nothing as abhorrent and scandalous as the Twitterverse may have led some to believe, but context isn’t always provided in 140 characters.

Public Pressure

Complaints and boycotts have been launched at companies via social media for perhaps as long as social media has existed. But the current contentious environment created by one of the most divisive leaders in American history now colors every public statement made by prominent business leaders with a political tint. Executives are stuck between a rock and a hard place. They’re exposed to reputational damage whether they oppose or endorse a Trump action, or even if they do nothing at all.

Take Elon Musk, for example, founder of Tesla and SpaceX and a well-known advocate for climate research and environmental protection. He came under fire for not publicly denouncing the travel ban and for keeping his seat on Trump’s business advisory council.

Musk has largely avoided the limelight on political issues, couching statements when he makes them at all — as most executives are wont to do. But he was prodded to defend himself on Twitter after some users suggested he was a hypocrite.

“Be proactive in your plans to mitigate the aftermath and how to communicate. Own up to error. Be transparent. Salvage your crown jewel.” —Helen Chue, global risk manager, Facebook

A strategy of avoidance may no longer work as consumers, employees and the public at large pressure companies to make a statement or take action in response to political events.

“A large segment of the population expects the people they do business with and the companies they buy from to support their point of view or respond to political or social issues in a certain way,” said Chrystina M. Howard, senior vice president, strategic risk consulting, Willis Towers Watson.

In a damned-if-you-do, damned-if-you-don’t environment, reputation risk is expanding, and risk managers need to re-evaluate how they assess their exposure and build mitigation strategies.

A True Crisis?

The challenge begins with determining whether a negative public relations event is really a crisis. Is it a temporary blow to a brand, or does it have the potential to do long-term reputation damage? Misreading the signs could lead companies to overreact and further tarnish their image.

“These sudden public relations crises are a source of panic for companies, but sometimes it sounds much worse than it actually is. The financial ramifications may not be anywhere near what was feared,” Howard said.

“Uber is probably a good example of what not to do,” said Jeff Cartwright, director of communications at Morning Consult, a brand and political intelligence firm.

“They maybe went over the top in trying to reverse the way they handled the protests at JFK.”

Tracking brand value in real time can give risk managers insight into the true impact of a negative social media campaign or bad press.  Michael Ramlet, CEO and co-founder of Morning Consult, said most events don’t damage brands as much as trending hashtags make it appear.

Morning Consult’s proprietary brand tracking tool allows companies to measure their brand perception against influencing events like a spike of Twitter mentions and news stories. More often than not, overall brand loyalty remains on par with industry averages.

In Uber’s case, Twitter mentions spiked to roughly 8,800 on Jan. 29, up from about 1,000 the day before. By Jan. 31, though, the number was back down to around 1,250 and quickly settled back down to its average numbers. From the beginning of the #deleteUber campaign through the end of February, Uber’s favorability shrunk from 50 percent to roughly 40 percent, based on a series of polls taken by 18,908 respondents.

Advertisement




It’s a significant dip, but likely not a permanent stain on the company’s reputation, especially after Kalanick’s public show of support for immigrants and rejection of the travel ban. Uber’s favorability rating remained higher than competitor Lyft’s throughout the ordeal.

“The #deleteUber campaign turned out to be a very local thing that didn’t have a widespread impact,” Ramlet said.

“Twitter at best is an imputed analysis of what people are saying. The vocal minority might be very active, but there might be a silent majority who still think fondly of a brand, or at least have no negative opinions of it.”

He said risk managers can also benefit by breaking down their brand perception into geographic and demographic subsets. It can, for example, show whether a brand is favored more heavily by Democrats or Republicans.

“If you have that data on day one, it can help you determine how to respond if, say, Trump tweets at you,” Ramlet said.

Of course, some spikes in news media and social media attention are indicative of much deeper problems and true reputational risk.

After the Wells Fargo dummy-account scandal broke, for example, unfavorability ratings as measured by Morning Consult jumped from roughly 20 percent to nearly 55 percent, while favorability dropped from 50 percent to 30 percent. Net favorability, which stood at 33 percent pre-scandal, fell to -4 percent post-scandal.

“They went from being the most popular bank to the least popular in less than four months, according to our data,” Ramlet said.

The contrast between Uber’s and Wells Fargo’s stories demonstrates the difference between a more surface-level public-relations event that temporarily hurts brand image, and a true reputation event.

“Failures that produce real and lasting damage to reputation include failures of ethics, innovation, safety, security, quality and sustainability,” said Nir Kossovksy, CEO of Steel City Re.

“Activists make a lot of noise that can be channeled through various media, but for the most part in the business world, stakeholders are interested in the goods and services a company offers, not in their political or social views. As long as you can meet stakeholder expectations, you avoid long-term reputational damage.”

Wells Fargo’s scandal involved a violation of ethics, sparked an SEC investigation and forced the resignation of its CEO, John Stumpf. It’s safe to say stakeholders were severely disappointed.

That’s not to say, however, that a tarnished brand name doesn’t also impact the bottom line.

“Even if a bad event is short-lived, the equity markets react quickly, so there may be sharp equity dips. There may be some economic impact even over the short term,” Kossovsky said, “because sharp dips are dog whistles for activists, litigators and corporate raiders.”

Social Media Machine

The root of reputation risk’s tightening grip lies in the politicizing of business, and consumers’ increased desire to buy from companies that share their values. Social media may not be driving that trend, but it acts as a vehicle for it.

“Social media has really changed the game in terms of brand equity, and has given people another way to choose who they give their money to,” Howard of Willis Towers Watson said.

Platforms like Twitter make it easier for consumers to directly reach out to big companies and allow news to travel at warp speed.

“Social media are communication channels that can take a story and make it widely available. In that regard, the media risk is no different than that posed by a newspaper or radio channel,” Kossovsky said.

“The difference today that changes the strategy for risk managers and boards is that social media has been weaponized: Stories shared on social media don’t necessarily have to contain truthful content, and there’s not always an obvious difference between what’s true and what’s not.”

Helen Chue, Facebook’s global risk manager, agreed.

“More influential than social media platforms is today’s culture of immediacy and headlines. Because we are inundated with information from so many sources, we scan the headlines, form our opinions and go from there,” she said.

“It’s dangerous to draw conclusions without taking a balanced approach, but who has the time and patience to sift through all the different viewpoints?”

An environment of political divisiveness, driven by speed and immediacy of social media, creates the risk that false or half-true stories are disseminated before companies have a chance to clarify. This is what happened to Uber and New Balance.

“It creates the opportunity to turn a non-problem into a problem,” Kossovksy said.

“That’s how social media changes the calculus of risk management.”

Risk Mitigation

The best way to battle both political pressure and social media’s speed is through an ironclad communication strategy; a process that risk managers can lead.

Advertisement




“Risk managers play a crucial role in mitigating reputation risk,” Howard said.

“They bring with them the discipline of managing and monitoring a risk, having a plan and responding to crisis. Now they really have to partner with communications, marketing and PR.”

They also have to get the attention of their board of directors.

“If you let a gap form between what you say and what you do, that gap is the definition of reputation risk.” — Nir Kossovksy, CEO of Steel City Re

“This is both a company-wide risk and personal leadership risk, so the board needs to drive a company-wide policy that protects the board as well,” Kossovsky said.

The art of mitigating reputation risk, he said, comes down to managing expectations. Corporate communications should clearly convey what a company believes and what it does not believe; what it can do and what it can’t do. And those stated values need to align with the operational reality. It comes down to creating credibility and legitimacy.

“If you let a gap form between what you say and what you do, that gap is the definition of reputation risk,” he said. A strong communication strategy can prevent adverse events from turning into reputational threats.

Willis Towers Watson helps clients test their strategies through a table-top exercise in which they have to respond to a social media-driven reputation event.

“We’ll say, ‘Something happened with X product, and now everyone’s on Twitter lambasting you and calling for resignations, etc.’ What do you do on day one? What do you do a week out? How long do you continue to monitor it and keep it on your radar?” Howard said.

“If you have that plan in place, you can fine-tune it going forward as circumstances change.”

Sometimes, though, the communication strategy fails, and a company falls short of meeting stakeholders’ expectations. Now it’s time for crisis management.

“Volatility creates vulnerability. If you stumble on your corporate message, it creates an opportunity for activists, litigators and corporate raiders to exploit. So you need to have authoritative third parties who can attest to your credibility and affirm the truth of the situation to open-minded stakeholders,” Kossovsky said.

Owning up to any mistakes, reaffirming the truth and being as transparent as possible will be key in any response plan.

Insuring the Risk

Recouping dollars lost from reputation damage requires a blend of mathematics with a little magic. While some traditional products are available, reputation risk is, for the most part, an intangible and uninsurable risk.

“Many companies have leveraged their captive insurance companies in the absence of traditional reputation products in the marketplace,” said Derrick Easton, managing director, alternative risk transfer solutions practice, Willis Towers Watson.

“It goes back to measuring a loss that can include lost revenue, or increased costs. Some companies build indexes in the same way we might create an index for a weather product, using rainfall or wind speed. For reputation, we might use stock price or a more refined index,” he said.

“If we can measure a potential loss, we can build a financing structure.”

While there’s no clear-cut way to measure losses from reputation damage, “stock performance and reported sales changes are some of the best tools we have,” Howard said.

Some insurers, including Allianz and Tokiomarine Kiln, and Steel City Re, an MGA, do offer reputation policies. When these fit a company’s needs, they have the ancillary benefit of affirming quality of governance and sending a signal that the insured is prepared to defend itself.

“Because reputation assurance is only available to companies that have demonstrated sound governance processes, it helps to convince people that if a bad piece of news happens, it’s idiosyncratic; it doesn’t reflect what the company really stands for,” Kossovsky of Steel City Re said.

Advertisement




“And it tells activists, broadly defined, not to look for low-hanging fruit here.”

In a volatile political environment, companies fare best when they simply tell the truth.

“The American public will accept an apology if delivered quickly and if it’s sincere,” said Stephen Greyser, Richard P. Chapman professor (marketing/communications) emeritus, of the Harvard Business School.

“Tell the truth. Don’t stonewall. A bad social media campaign can be an embarrassment, but if you stick to the facts and apologize when you need to, people forget about the bad quickly.”

“Reputation is the crown jewel,” Chue said. “Given the power of social media’s reach, one individual can have a tsunami-like influence. And it can happen when you least expect it, and it will probably be something you thought was innocuous or even positive that sets off a maelstrom.

“Plan for the worst-case scenario. Be proactive in your plans to mitigate the aftermath and how to communicate. Own up to error. Be transparent. Salvage your crown jewel.” &

Katie Siegel is a staff writer at Risk & Insurance®. She can be reached at [email protected]