2016 Most Dangerous Emerging Risks

Cyber Grid Attack: A Cascading Impact

The aggregated impact of a cyber attack on the U.S. power grid could cause huge economic losses and upheaval. 
By: | April 4, 2016 • 8 min read

SCENARIO: The hackers used a range of tactics to gain access to the U.S. electric grid system without alerting security teams — targeting laptops and personal electronic devices of key personnel, conducting phishing attacks, hacking remote access systems and physically intruding on network monitoring locations.

Advertisement




Months later, they systematically disabled safety systems that would prevent power generators from being desynchronized. They sent control signals to open and close the generator’s rotating circuit breakers in quick succession.

This used the inertia of the generator itself to force out of sync the bearings of 50 generators. They had hoped to destroy 100.

The generators began to smoke and burn. Some were partially destroyed. One gas turbine facility exploded from the generator fire. Operators shut down even the uncontaminated generators until the cause of the damage was determined.

The cascading impact of the cyber attack stuns the nation. Engineers have no definitive explanation for the damage, which plunges 15 Northeastern states and Washington, D.C. into darkness, leaving 93 million people without power.

Back-up generators at hospitals, public facilities and some companies remain available for essential services. Phones, internet, ATMs, street lights, subway cars, gas stations, water systems, manufacturers, and just about everything else goes down. Communications systems are mostly unavailable, except for 911.

No one immediately knows the scope of the infection. Or whether it will reoccur.

VIDEO: Media reports highlight the vulnerability of the U.S. power grid.

ANALYSIS: This “Business Blackout” scenario by the University of Cambridge Centre for Risk Studies and Lloyd’s of London suggests a range of $61 billion to $223 billion in economic losses, depending on the number of impacted generators and whether it took two, three or four weeks to restore 90 percent of the power.

Nick Beecroft, emerging risks and research manager, Lloyd’s of London

Nick Beecroft, emerging risks and research manager, Lloyd’s of London

“This is a real risk management issue facing the power sector around the world right now,” said Nick Beecroft, emerging risks and research manager, Lloyd’s of London, who worked on the “Business Blackout” project.

But even more, he said, it is a risk that “all of society has to confront as more and more of our infrastructure and economy become connected to digital networks.”

Such an attack “would disrupt businesses spanning the entire economy.” In the scenario, it takes several months and up to three years for the economy to fully revert to the GDP levels prior to the attack.

One insurance executive who asked to remain anonymous said it’s impossible to calculate the cascading impact of a cyber attack on the power grid.

“The honest answer is we don’t know,” the executive said. “It’s difficult to say if this is a one-in-100-year event or a one-in-10-year event. How do we know it won’t happen tomorrow or twice in a week? That’s the scary part for us.”

“Cyber is definitely the most dangerous emerging risk. The digital infrastructure was not designed to protect against bad guys.” —Andrew Coburn, senior vice president, RMS; director of the advisory board at the Cambridge Centre for Risk Studies

In 2003, overgrown tree limbs short-circuited sagging transmission lines amid hot weather in Ohio that had already strained generating capacity. Combined with human error, the result was a blackout of eight states and part of Canada for 36 hours, affecting 50 million people.

“I think that shows how interconnected the power grid is,” said Jamie Bouloux, president, cyber practice, Ryan Specialty.

Utilities Are “Under Constant Attack”

Advertisement




Recently, North Korea was accused of hacking a nuclear operator in South Korea; Russia was accused of shutting down Ukraine’s power grid for up to six hours in a sophisticated cyber attack that left up to 230,000 residents in the dark; and Israel’s electric authority successfully fought off a hacking attempt.

“The utilities, energy and infrastructure industries — petroleum, gas, electric power, nuclear, renewable, telecoms, water and sewage — are under constant attack,” said Kevin Kalinich, national cyber leader, Aon Risk Solutions.

The “poster child” for sophisticated nation-state hacks is Stuxnet, where unnamed hackers generally believed to be the United States and Israel introduced malware into Iran’s industrial control systems, causing nuclear centrifuges to spin out of control and damage themselves even while displays indicated normal functioning.

Joe Weiss, managing director of Applied Control Solutions

Joe Weiss, managing director of Applied Control Solutions

The controllers used in Iran are the same as those used in U.S. military systems, power plants, water systems, transportation, manufacturing and other commercial and industrial enterprises, said cyber security expert Joe Weiss, managing director of Applied Control Solutions.

“There are only 10 to 15 vendors [of control systems] worldwide and they supply every industry.”

And they are vulnerable, he said.

“It is possible to compromise the power grid via a cyber attack. Depending on the attack, it is possible to bring the grid down for nine to 18 months. This is existential to the United States.

“Nation-states are actively targeting our critical infrastructure and actively trying to compromise control systems,” Weiss said. “We know that.

“Not much is being done and the cyber insurance world needs to understand the cyber risks to these critical control systems.”

Security Has Increased

Utilities have been working to better secure infrastructure, including the grid and their distribution and transmission networks, said Gary Gresham, senior vice president, power practice, Aon Global Power.

In 2012, $14 billion was spent to shore up grid reliability and redundancy. That’s compared to about $5 billion spent in 2003.

R4-16p35-36_1CCyberrev.inddUtilities and power generators are also working in conjunction with local law enforcement, Homeland Security and the FBI to share information on the types of attacks seen.

But the utility industry is more advanced in protecting their systems and sharing information than other sectors of the country, including transportation, communications, industrial and manufacturing, which also rely on industrial control systems, Gresham said.

Tim Francis, enterprise cyber lead, Travelers

Tim Francis, enterprise cyber lead, Travelers

Tim Francis, enterprise cyber lead, Travelers, noted that insurers and the private sector have dealt with the threat of data breaches for a while, but are “just beginning the journey” on threats to industrial control systems.

For businesses, it may come down to a question of size and scale, said Bouloux.

“Ultimately, if you are a big enough business, you should be able to marginalize the exposure due to a power outage,” he said.

Experts often compare the impact of a power grid hack to the damage and losses resulting from large natural disasters such as Katrina and Sandy, but Bouloux said 9/11 might be a better model for understanding the economic impact such an event could have on the insurance industry, if it was found to be an act of terrorism.

Commercial claims in the New York area alone were varied and complicated — amounting to about $40 billion, of which an estimated $27 billion was paid in claims associated with business interruption, liability and property damage (other than damage to the World Trade Center buildings), he said.

As a single, isolated act of terrorism, it calls into question Lloyd’s estimated insured losses from the 15-state blackout scenario of $21.4 billion to $71.1 billion.

The cascading impact of a cyber attack complicates the picture for insurers.

Andrew Coburn, senior vice president, RMS

Andrew Coburn, senior vice president, RMS

“They need to look at how many insureds’ policies they have that have certain coverages on them,” said Andrew Coburn, senior vice president, RMS, and director of the advisory board at the Cambridge Centre for Risk Studies.

“About 12 classes of insurance lines were impacted in the scenario,” he said.

The formula to determine potential losses is complex, often depending on whether companies have “supplier’s extension coverage,” which may have ambiguous wording relating to perils.

To come up with a potential loss, the insurance companies need to work through how long each insured is impacted — which could range from one to four weeks or more — and then take into account deductibles, limits and sublimits, Coburn said.

“We spent the past couple of months working with insurance companies to apply this to their book as a stress test scenario,” he said. “It’s not the easiest one for them.”

Risk Mitigation

Regardless of whether a power outage is due to a natural event or a cyber attack, companies need to prepare in similar ways, Francis said.

They need back-up continuity plans, plans for employees working offsite, and they

Jamie Bouloux, president, cyber practice, Ryan Specialty

Jamie Bouloux, president, cyber practice, Ryan Specialty

need to talk to their broker and insurer prior to any such event to determine what is covered and what gaps exist.

Experts said coverage is available to cover most exposures related to a power-grid attack, but one policy alone will probably be insufficient. For example, power

outages are generally not covered by insurance policies — such as for property coverage — unless there is physical damage.

When planning for continuity, risk managers should look at the electric grid and ensure they have facilities in other grids so those facilities would not be affected, Bouloux said.

Effective mitigation requires an ongoing review of potential exposures from an enterprise risk management perspective, said Gresham.

Risk managers must continually review and update processes and practices to ensure the organization is as resilient as possible and operations have redundancy.

Aon’s Kalinich said it’s possible for insureds to identify and quantify their business interruption losses on a micro level. “The bigger question,” he said, “is the macro level aggregated risk of grid-type exposures” for insurance companies.

“For us, it’s not an academic exercise,” Beecroft of Lloyd’s said. “It’s a real challenge for the industry. We have to be able to pay out claims.

Gary Gresham, senior vice president, power practice, Aon Global Power.

Gary Gresham, senior vice president, power practice, Aon Global Power

“We recognize that there is a large degree of ambiguity and uncertainty about whether or not existing insurance covers would respond in the event of a cyber event.”

Managing the risk requires a partnership of government, insurance and business, he said. “We can’t just accept the vulnerability and throw our hands up. We can manage to make life difficult for hackers, but we can’t reduce the risk to zero.”

“Cyber,” said Coburn, “is definitely the most dangerous emerging risk. The digital infrastructure was not designed to protect against bad guys. It was designed to be efficient. … What is society willing to spend to make that threat go away?” &

BlackBar

2016’s Most Dangerous Emerging Risks

brokenbridgeThe Fractured Future Infrastructure in disrepair, power grids at risk, rampant misinformation and genetic tinkering — is our world coming apart at the seams?

01b_cover_story_crackCrumbling Infrastructure: Day of Reckoning Our health and economy are increasingly exposed to a long-documented but ignored risk.

01d_cover_story_vaccineFragmented Voice of Authority: Experts Can Speak but Who’s Listening? Myopic decision-making fostered by self-selected information sources results in societal and economic harm.

01e_cover_story_dnaGene Editing: The Devil’s in the DNA Biotechnology breakthroughs can provide great benefits to society, but the risks can’t be ignored.

Anne Freedman is managing editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Report: Hospitality

Bridging the Protection Gap

When travelers stay home, hospitality companies recoup lost income through customized, data-defined policies.
By: | October 12, 2017 • 9 min read

In the wake of a hurricane, earthquake, pandemic, terror attack, or any event that causes carnage on a grand scale, affected areas usually are subject to a large “protection gap” – the difference between insured loss and total economic loss. Depending on the type of damage, the gap can be enormous, leaving companies and communities scrambling to obtain the funds needed for a quick recovery.

Advertisement




RMS estimates that Hurricane Harvey’s rampage through Texas could cause as much as $90 billion in total economic damage. The modeling firm also stated that “[National Flood Insurance Program] penetration rates are as low as 20 percent in the Houston area, and thus most of the losses will be uninsured.”

In addition to uninsured losses from physical damage, many businesses in unaffected surrounding areas will suffer non-physical contingent business interruption losses. The hospitality industry is particularly susceptible to this exposure, and its losses often fall into the protection gap.

Natural catastrophes and other major events that compromise travelers’ safety have prolonged impacts on tourism and hospitality. Even if they suffer no physical damage, any hotel or resort will lose business as travelers avoid the area.

“The hospitality industry is reliant on people moving freely. If people don’t feel safe, they won’t travel. And that cuts off the lifeblood of the industry,” said Christian Ryan, U.S. Hospitality and Gaming Practice Leader, Marsh.

Christian Ryan
U.S. Hospitality and Gaming Practice Leader, Marsh

“People are going away from the devastation, not toward it,” said Evan Glassman, president and CEO, New Paradigm Underwriters.

Drops in revenue resulting from decreased occupancy and average daily room rate can sometimes be difficult to trace back to a major event when a hotel suffered no physical harm. Traditional business interruption policies require physical damage as a coverage condition. Even contingent business interruption coverages might only kick in if a hotel’s direct suppliers were taken offline by physical damage.

If everyone remains untouched and intact, though, it’s near impossible to demonstrate how much of a business downturn was caused by the hurricane three states away.

“Hospitality companies are concerned that their traditional insurance policies only cover business interruption resulting from physical damage,” said Bob Nusslein, head of Innovative Risk Solutions for the Americas, Swiss Re Corporate Solutions.

“These companies have large uninsured exposure from events which do not cause physical damage to their assets, yet result in reduced income.”

Power of Parametrics

Parametric insurance is designed specifically to bridge the protection gap and address historically uninsured or underinsured risks.

Parametric coverage is defined and triggered by the characteristics of an event, rather than characteristics of the loss. Triggers are custom-built based on an insured’s unique location and exposures, as well as their budget and risk tolerance.

“Triggers typically include a combination of the occurrence of a given event and a reduction in occupancy rates or RevPar for the specific hotel assets,” Nusslein said. Though sometimes the parameters of an event — like measures of storm intensity — are enough to trigger a payout on their own.

For hurricane coverage, for example, one policy trigger might be the designation of a Category 3-5 storm within a 100-mile radius of the location. Another trigger might be a 20 percent drop in RevPAR, or revenue per available room. If both parameters are met, a pre-determined payout amount would be administered. No investigations or claims adjustment necessary.

Advertisement




The same type of coverage could apply in less severe situations where traditional insurance just doesn’t respond. Event or entertainment companies, for example, often operate at the whim of Mother Nature. While they may not be forced to cancel a production due to inclement weather, they will nevertheless take a hit to the bottom line if fewer patrons show up.

Christian Phillips, focus group leader for Beazley’s Weatherguard parametric products, said that as little as a quarter- to a half-inch of rain over a four- to five-hour period is enough to prevent people from coming to an event, or to leave early.

“That’s a persistent rainfall that will wear down people’s patience,” he said.

“A rule of thumb for parametric weather coverage, if you’re looking to protect loss of revenue when your event has not actually been cancelled, you will probably lose up to 20 to 30 percent of your revenue in bad weather. That depends on the client and the type of event, but that’s the standard we’ve realized from historical claims data.”

The industry is now drawing on data to establish these rules of thumb for more serious losses sustained by hospitality companies after major events.

“Until recently the insurance industry has not created products to address these non-physical damage business interruption exposures. The industry is now collaborating with big data companies to access data, which in turn, allows us to structure new products,” Nusslein said.

Data-Driven Triggers

Insurers source data from weather organizations that track temperature, rainfall, wind speeds and snowfall, among other perils, by the hour and sometimes by the minute. Parametric triggers are determined based on historical storm data, which indicates how likely a given location is to be hit.

“We try to get a minimum of 30 years of hourly data for those perils for a given location,” Phillips said.

“Global weather is changing, though, so we focus particularly on the last five to 10 years. From that we can build a policy that fits the exposure that we see in the data, and we use the data to price it correctly.”

New Paradigm Underwriters collects their own wind speed data via a network of anemometers that stretch from Corpus Christi, Texas, all the way to Massachusetts, and works with modeling firms like RMS to gather additional underwriting information.

The hospitality industry is reliant on people moving freely. If people don’t feel safe, they won’t travel. And that cuts off the lifeblood of the industry.– Christian Ryan, U.S. Hospitality and Gaming Practice Leader, Marsh

While severe weather is the most common event of concern, parametric cover can also apply to terrorism and pandemic risks.

“We offer a terror attack quote on every one of our event policies because everyone asks for it,” said Beazley’s Phillips.

Advertisement




“We didn’t do it 10 years ago, but that’s the world we live in today.”

An attack could lead to civil unrest, fire or any number of things outside an insured’s control. It would likely disrupt travel over a wide geographic region.

“A terrorist event could cause wide area devastation and loss of attraction, which results in lost income for hospitality companies,” Nusslein said.

Disease outbreaks also dampen travel and tourism. Zika, which was most common in South America and the Caribbean, still prevented people from traveling to south Florida.

“Occupancy went down significantly in that region,” Marsh’s Ryan said.

“If there is a pandemic across the U.S., a parametric coverage would make sense. All travel within and inbound to the U.S. would go down, and parametric policies could protect hotel revenues in non-impacted areas. Official statements from the CDC such as evacuation orders or warnings could qualify as a trigger.”

Less data exists around terror attacks and pandemics than for weather, though hotels are taking steps to collect information around their exposure.

“It’s hard to quantify how an infectious disease outbreak will impact business, but we and clients are using big data to track travel patterns,” Ryan said.

Hospitality Metrics

Any data collected has to be verified, or “cleaned.”

“We only deal with entities that will clean the data so we know the historical data we’re getting is accurate,” Phillips said.

“There are mountains of data out there, but it’s unusable if it’s not clean.”

Parametric underwriters also tap into the insured’s historical data around occupancy and room rates to estimate the losses it may suffer from decreased revenue.

Bob Nusslein, head of Innovative Risk Solutions for the Americas, Swiss Re Corporate Solutions.

“The hospitality industry uses two key metrics to measure loss of business income. These include occupancy rate and revenue per available room, or RevPAR. These are the traditional measurements of business health,” Swiss Re’s Nusslein said.  RevPAR is calculated by multiplying a hotel’s average daily room rate (ADR) by its occupancy rate.

“The hotel industry has been contributing its data on occupancy, RevPAR, room supply and demand, and historical data on geographical and seasonal trends to independent data aggregators for many years. It has done an exceptional job of aggregating business data to measure performance downturns from routine economic fluctuations and from major ‘Black Swan’ events, like the 9/11 terrorist attacks, the 2008 financial crisis or the 2009 SARS epidemic.”

Claims history can also provide an understanding of how much revenue a hotel or an event company has lost in the past due to any type of business interruption. Business performance metrics combined with claims data determine an appropriate payout amount.

Like coverage triggers, payouts from parametric policies are specifically defined and pre-determined based on data and statistical evidence.

This is the key benefit of parametric coverage: triggers are hit, payment is made. With minimal or no adjustment process, claims are paid quickly, enabling insureds to begin recovery immediately.

Applying Parametric Payments

For hotels with no physical damage, but significant drops in occupancy and revenue, funds from a parametric policy can help bridge the income gap until business picks up again, covering expenses related to regular maintenance, utilities and marketing.

Because payment is not tied to a specific type or level of loss, it can be applied wherever insureds need it, so long as it doesn’t advance them to a better financial position than they enjoyed prior to the loss.

Advertisement




Parametric policies can be designed to fill in where an insured has not yet met their deductible on a separate traditional policy. Or it could function as excess coverage. Or it could cover exposures excluded by other policies, or for which there is no insurance option at all. Completely bespoke, parametric coverages are a function of each client’s individual exposures, risk tolerance and budget.

“Parametric insurance enables underwriting of risks that are outside tolerance levels from a traditional standpoint,” NPU’s Glassman said.

The non-physical business interruption risks faced by the hospitality industry match that description pretty closely.

“Hotels are a good fit for parametric insurance because they have a guaranteed loss from a business income standpoint when there is a major storm coming,” Glassman said.

While only a handful of carriers currently offer a form of parametric coverage, the abundance of available data and advancement in data collection and analytical tools will likely fuel its popularity.

Companies can maximize the benefits of parametric coverages by building them as supplements to traditional business interruption or event cancellation policies. Both New Paradigm Underwriters and Beazley either work with other property insurers or create hybrid products in-house to combine the best of both worlds and assemble a comprehensive risk transfer solution. &

Katie Siegel is an associate editor at Risk & Insurance®. She can be reached at [email protected]