How to halt the hackers
More than 100 professionals gathered in Sydney to hear expert insights on cybersecurity
By Miranda Maxwell
The Insurance News cyber seminar in Sydney attracted a crowd of insurance professionals hungry for expertise in managing this growing risk.
The half-day event at Doltone House in November was sponsored by Coalition, Wotton Kearney and Australia Underwriting. Here are some highlights …
The Swiss cheese defence: layer up to plug cybersecurity holes
Marsh head of cyber Gill Collins said defence strategies must have depth and be multi-layered, as each single method will have gaps.
“I always liken it to Swiss cheese, which has big holes in it, but if you lay out all those slices upon each other, eventually the holes are going to be closed,” Ms Collins said.
Marsh head of cyber Gill Collins addresses the seminar in Sydney. She warned that attackers are now using “really advanced techniques”
“That’s what defending against cyber is like – there’s going to be holes, but if you keep on having more and more defences and layer them upon each other, you’ll be stronger to fight.”
The insurance industry “really helps identify where those holes are and what you need to do to cover them up”, she said.
Attendees heard cyber risk is escalating as the complexity and interconnectedness of systems creates vulnerabilities that can be exploited.
Lloyd’s estimates a single major cyberattack on a global payment system could cost the world economy $US3.5 trillion, and the overall cost of cybercrime is projected to hit $US24 trillion by 2027, up from $US8.5 trillion in 2022.
The real prospect of a catastrophic cyber incident is reason to consider a reinsurance pool, Ms Collins said. She called on government to “really establish clear regulations, promote awareness, foster collaboration and consider a framework and a fund which might cover those risks that, for whatever reason, are uninsurable”.
“Attackers are employing these really advanced techniques now, and machine learning. Traditional insurance is really trying to understand and provide cover for these risks, but there might be gaps.”
Australia ‘on the map’ for attackers
Taylor Fry principal Win-Li Toh told the audience high-profile attacks such as those on Optus, Latitude, HBL Ebsworth Lawyers and Medibank “really put Australia on the map for cyberattackers”, and small businesses are now prime targets due to their weaker defence capabilities.
Last financial year, more than 1000 incidents were flagged under the notifiable data breaches scheme.
And significant cyber incidents produce a long-tail insurance claim, she warned.
Taylor Fry principal Win-Li Toh
“It is quite important to cyber insurers to know, what else are you covering, other than just the legal and forensic investigations?” Ms Toh said, listing heightened security, legal costs, regulator investigations, litigation, lifting business resilience and restoring customer trust as some of the expenses that can take years to be quantified and resolved.
For example, Medibank is facing five legal actions, which are not yet on the balance sheet as management have said it is not practicable to estimate the financial impact. The results of these class actions could drive the kind of covers insurers provide in future, Ms Toh said.
She recommended that boards be better prepared. “The cost can go on for years. A spectrum of fines, penalties and other surprising costs can arise from a breach. A cyber incident is a long tail … the kind of analysis you have to do stretches out years.”
Insurers should also be aware of the cost of non- malicious cyber incident claims, Ms Toh said, with about one in three events causing insured losses the
result of human error.
“I don’t mean clicking on phishing emails, because that’s malicious attack. It can include things like erroneously sending a spreadsheet to the wrong recipient with personal data – who’s never done that before, and then it’s retracted? That sort of thing is actually covered by a lot of cyber insurance.”
Healthy role play
Wotton Kearney partners Kieran Doyle and Nicole Gabryk conducted a panel discussion – “So, You’ve Been Attacked? What Next?” – in which they role-played a ransomware incident at Beige Automation Healthcare, a fictional $4 billion listed company.
Triskele Labs incident response lead Richard Grainger played the company’s forensics expert, while Porter Novelli CEO Rhys Ryan played the communications expert as the team responded to a criminal group stealing 500GB of client data.
“It looks like Justin Timberlake came through one of the clinics and got some work done, so we’ve got some pretty high-profile people that we might need to notify,” incident manager Mr Doyle said, adding the chairman’s private “rhinoplasty information” was also probably stolen.
(“The chairman had adenoids which required surgery – nothing to do with any rhinoplasty,” quickly responded spin doctor Mr Ryan.)
Legal counsel Ms Gabryk advised against paying the ransom, while the communication strategy focused on timely updates to mitigate reputational damage.
The process of data review and notification under the Privacy Act was outlined, emphasising the importance of expert co-ordination and early engagement.
From Lake Michigan to Manly
Coalition’s general manager of Australia Sam Weaver – who moved from Chicago to Sydney’s northern beaches last year to start the local operation – said the cyber specialist has no minimum premium, and the smallest policy in force in Australia costs about $200.
Coalition has become the largest cyber insurer in North America, he said.
Its clients range from a UK bouncy castle operator paying less than £100 premium to businesses with $US2 billion in turnover.
Coalition says complacency is enemy number one, and every small business should have a “security champion” familiar with best practice and responsible for
in-house training.
Senior security analyst George Oosthuizen told the seminar multifactor authentication is free to implement and will “stop 95% of anybody taking up your data”. Four-step authentication for devices is now widely available.
“If somebody clicks a link on a phishing email, it’s usually because they’re not aware that they shouldn’t be doing that,” Mr Oosthuizen added.
“Awareness training covers that and could be a low cost, almost $2 per person per month.”
