A recent Zurich Cyber Risk Report argues that cyber-risk management professionals need to look beyond their internal information technology safeguards to interconnected risks which can build up relating to:-

  • Counterparties
  • Outsourced suppliers
  • Supply chains
  • Disruptive technologies
  • Upstream infrastructure
  • External shocks

Zurich warns that a build-up in these risks could create a failure on a similar scale to the 2008 financial crisis. Such interconnected risks are compounded when a company outsources the management of its servers, information technology and cyber security to focus on its core activities.

Little information may be known about the third party’s information security or business continuity safeguards and it may also in turn outsource activities to other companies.

The report calls for organisations to incorporate the best ideas from financial governance such as creating a G20+20 Cyber Stability Board to enhance cyber risk management and identifying and improving the governance of G-SIIOs (Global Significantly Important Internet Organisations).

Axel Lehmann, Group Chief Risk Officer and Regional Chairman Europe at Zurich Insurance Group, said: “The internet is the most complex system humanity has ever devised. Although it has been incredibly resilient for the past few decades, the risk is that the complexity which has made cyberspace relatively risk-free can and likely will backfire.

“Organizations are unknowingly exposed to risks outside their organization, having outsourced, interconnected or exposed themselves to an increasingly complex and unknowable web of networks.

“Few people truly understand their own computers or the internet, or the cloud to which they connect, just as few truly understood the financial system as a whole or the parts to which they are most directly exposed

Zurich’s Seven Cyber Risks are:-

Description Examples
Internal IT enterprise Risk associated with the cumulative set of an organization’s (mostly internal) IT Hardware; software; servers; and related people and processes
Counterparties and partners Risk from dependence on, or direct interconnection (usually non-contractual) with an outside organization University research partnerships; relationship between competing/cooperating banks; corporate joint ventures; industry associations
Outsourced and contract Risk usually from a contractual relationship with external suppliers of services, HR, legal or IT and cloud provider IT and cloud providers; HR, legal, accounting, and consultancy; contract manufacturing
Supply chain Both risks to supply chains for the IT sector and cyber risks to traditional supply chains and logistics Exposure to a single country; counterfeit or tampered products; risks of disrupted supply chain
Disruptive technologies Risks from unseen effects of or disruptions either to or from new technologies, either those already existing but poorly understood, or those due soon Internet of things; smart grid; embedded medical devices; driverless cars; the largely automatic digital economy
Upstream infrastructure Risks from disruptions to infrastructure relied on by economies and societies, especially electricity, financial systems, and telecommunications Internet infrastructure like internet exchange points, and submarine cables; some key companies and protocols used to run the internet (BGP and Domain Name System); internet governance
External shocks Risks from incidents outside the system, outside of the control of most organizations and likely to cascade Major international conflicts; malware pandemic