2222222222

Risk Insider: Greg Bangs

Cyber Gang Vigilance

By: | June 29, 2016 • 2 min read
Gregory W. Bangs is chief underwriting officer of global crime at XL Catlin. Over the last 30 years, he’s been underwriting insurance and developing new products in the U.S., U.K., Hong Kong and France. He can be reached at [email protected]

The Bank of Bangladesh didn’t know what hit it. More than $80 million vanished before anyone even noticed last February. The good news is that the criminals did not accomplish what they initially set out to do – steal nearly $1 billion from the bank’s account at the Federal Reserve Bank of New York.

The hackers, however, did succeed in installing malware in the Bangladesh central bank’s computer systems. Then they watched, probably for weeks.

They observed how to go about withdrawing money from the bank’s U.S. account, using its credentials for the SWIFT (Society for Worldwide Interbank Financial Telecommunication) messaging system.

SWIFT is used by banks around the world along with other financial institutions like brokerages, securities dealers, asset management companies, and others, for secure financial communication.

If an email’s subject line is so tempting that you can’t resist opening it, you probably shouldn’t.

Bangladesh’s central bank was not alone; the same crooks took $12 million from an Ecuadorean lender in January 2015. Fortunately, another attack trying to steal about $1 million from a Vietnamese bank late last year was thwarted.

In all of these incidents, the perpetrators got access to the codes the banks use to connect to the SWIFT global payments network to request fund transfers that were directed elsewhere and then quickly disappear.

All indicators are pointing to one prime culprit – Dridex, a notorious gang of cyber criminals operating in Russia and former parts of Eastern Europe.

Dridex is a disciplined, highly organized gang that operates very much like any other company, following a Monday-to-Friday work week. During those working hours, it sends millions of phishing emails, managing to infect an average of 3,000 to 5,000 computers a day with its malware, also known as Dridex.

Once released, the malware lurks on a user’s computer, watching everything he or she does, waiting for some online banking activity, at which time it uses keystroke logging or web injections to steal the necessary user name and password so that it can carry out its own transactions later on.

These incidents are prompting central banks worldwide, as well as other businesses, to beef up security. After all, some security firms are already reporting that Dridex recently stepped up its attacks and added ransomware to its inventory. Most predict financial institutions will not be the prime target for long.

In addition to conducting regular audits and building strong information security awareness protocols, businesses, no matter what industry, are wise to reinforce some simple, yet vital, messages to all colleagues:

Delete any suspicious-looking emails and be wary of attachments: To unleash malware, hackers are smart enough to disguise attacks as generically worded messages such as, “Please look this over and get back to me by end of day.”

If it’s too good to be true, don’t look. If an email’s subject line is so tempting that you can’t resist opening it, you probably shouldn’t.

Working with their information security and technology teams, as well as many others, risk managers can play an integral role in driving online vigilance throughout their organizations.

Adopting the gang-style approach of the cyber criminals, risk managers can coordinate multiple disciplinary roles throughout the organization to fight cyber gangs’ crime games.

2018 Most Dangerous Emerging Risks

Emerging Multipliers

It’s not that these risks are new; it’s that they’re coming at you at a volume and rate you never imagined before.
By: | April 9, 2018 • 3 min read

Underwriters have plenty to worry about, but there is one word that perhaps rattles them more than any other word. That word is aggregation.

Advertisement




Aggregation, in the transferred or covered risk usage, represents the multiplying potential of a risk. For examples, we can look back to the asbestos claims that did so much damage to Lloyds’ of London names and syndicates in the mid-1990s.

More recently, underwriters expressed fears about the aggregation of risk from lawsuits by football players at various levels of the sport. Players, from Pee Wee on up to the NFL, claim to have suffered irreversible brain damage from hits to the head.

That risk scenario has yet to fully play out — it will be decades in doing so — but it is already producing claims in the billions.

This year’s edition of our national-award winning coverage of the Most Dangerous Emerging Risks focuses on risks that have always existed. The emergent — and more dangerous — piece to the puzzle is that these risks are now super-charged with risk multipliers.

Take reputational risk, for example. Businesses and individuals that were sharply managed have always protected their reputations fiercely. In days past, a lapse in ethics or morals could be extremely damaging to one’s reputation, but it might take days, weeks, even years of work by newspaper reporters, idle gossips or political enemies to dig it out and make it public.

Brand new technologies, brand new commercial covers. It all works well; until it doesn’t.

These days, the speed at which Internet connectedness and social media can spread information makes reputational risk an existential threat. Information that can stop a glittering career dead in its tracks can be shared by millions with a casual, thoughtless tap or swipe on their smartphones.

Aggregation of uninsured risk is another area of focus of our Most Dangerous Emerging Risks (MDER) coverage.

The beauty of the insurance model is that the business expands to cover personal and commercial risks as the world expands. The more cars on the planet, the more car insurance to sell.

The more people, the more life insurance. Brand new technologies, brand new commercial covers. It all works well; until it doesn’t.

As Risk & Insurance® associate editor Michelle Kerr and her sources point out, growing populations and rising property values, combined with an increase in high-severity catastrophes, threaten to push the insurance coverage gap to critical levels.

This aggregation of uninsured value got a recent proof in CAT-filled 2017. The global tally for natural disaster losses in 2017 was $330 billion; 60 percent of it was uninsured.

Advertisement




This uninsured gap threatens to place unsustainable pressure on public resources and hamstring society’s ability to respond to natural disasters, which show no sign of slowing down or tempering.

A related threat, the combination of a failing infrastructure and increasing storm severity, marks our third MDER. This MDER looks at the largely uninsurable risk of business interruption that results not from damage to your property or your suppliers’ property, but to publicly maintained infrastructure that provides ingress and egress to your property. It’s a danger coming into shape more and more frequently.

As always, our goal in writing about these threats is not to engage in fear mongering. It’s to initiate and expand a dialogue that can hopefully result in better planning and mitigation, saving the lives and limbs of businesses here and around the world.

2018 Most Dangerous Emerging Risks

Critical Coverage Gap

Growing populations and rising property values, combined with an increase in high-severity catastrophes, are pushing the insurance protection gap to a critical level.

Climate Change as a Business Interruption Multiplier

Crumbling roads and bridges isolate companies and trigger business interruption losses.

 

Reputation’s Existential Threat

Social media — the very tool used to connect people in an instant — can threaten a business’s reputation just as quickly.

 

AI as a Risk Multiplier

AI has potential, but it comes with risks. Mitigating these risks helps insurers and insureds alike, enabling advances in almost every field.

 

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]