Enterprise Cyber Risk Management

IntroductionCyber risk represents an ever-growing threat to public and private institutions alike due to its potentially disastrous effects on organizational information systems, reputational risk, and potential loss of consumer-and stakeholder's confidence.With the advent of the internet and the corresponding proliferation of information technology, firms, non-profits, and governmental entities were generally unprepared for identifying and addressing this risk, but the threat has increased in both frequency and severity over time, and the nature of attacks has also changed.In many early cases, the perpetrators of cyber attacks and information disruption campaigns interrupted business operations simply for their own amusement, or viewed breaking into the corporate information technology (IT) infrastructure as a challenge.They would deface websites or take down servers in order to aggravate or simply to challenge other cyber professionals in order to prove they could do it, not to profit (Hallam-Baker, 2008).However, as the Internet has grown and e-commerce has blossomed, employee access to company data has increased, and remote access to internal computer systems has become commonplace, cyber attackers have evolved, becoming more sophisticated and their effects becoming more devastating (Rhemann, 2011).Current cyber threats and attackers are increasingly focused on profiting from the consequences of their attack actions and either exploit the data they illicitly obtain for private gain or require payments from the victimized enterprise to restore service, access, or websites back to operational functionality (Maillart & Sornette, 2010).The focus of this chapter will be on enterprise cyber risk management and risk mitigation (as opposed to individual consumer cyber risk, an extensive connected topic which is of interest in its own right but not addressed here).In this chapter we will investigate cyber risk of importance to enterprise to include information theft, compromise of consumer information, and the interruption of e-commerce.This chapter will focus on several important aspects of cyber risk and how these affect the economics and security of organizations.Cyber risk is unique among other operational enterprise risks due to its mobile location, scope of threat, and high-profile impact.With the proliferation of business services, systems, and data accessible via the Internet, cyber threats to enterprises (public and private) have grown immensely.Furthermore, companies have now realized that they run the risk of creating liabilities from any cyber event that could affect related services and products (e.g. the theft of email addresses from Epsilon on April 2011 also affected customers of numerous other businesses, such as Hilton Hotels, Citibank, etc., and has cast reputational risk on not only the original company but also on their clients, and has created increased potential legal liability as well.). www.intechopen.comRisk Management for the Future -Theory and Cases 320The ripple effect that cyber attacks can engender can influence suppliers, end users, and the organization itself, and could even have the potential to destabilize large swaths of the economy if the target of the cyber attacks were systemically important (such as a systemically important financial institutions, a utility operators, a water treatment facility, a transportation network, etc.).Additionally, cyber espionage techniques are developing rapidly, making enterprise trade secrets also vulnerable to competitor theft.As with many other hazards faced by businesses, insurance companies who specialize in risk assumption and risk pooling saw a potential financial opportunity in filling the cyber risk hazard management needs of enterprises by providing insurance policies designed to protect or indemnify against the financial consequences of these Internet-related threats.Several insurance companies have started to offer connectivity-related policies that cover cyber information and security breaches.Early on, as the insurers tentatively waded into this new market, it was difficult to generate data on electronic losses.Although Internetrelated insurance coverage is still in its infancy (as compared to other insurance classes), insurance companies over the past few years have now improved their ability to more accurately price policies and predict potential losses.These companies, including AIG, Chubb, Fidelity, Marsh, and Lloyds of London, have written policies that can hedge or transfer varying aspects of cyberspace risk (Gordon et al., 2003).Further aspects of cyberrelated insurance will be discussed in detail later in this chapter.The chapter starts with a general discussion of cyber risk threats to organizations including trends and costs.These threats will be dichotomized into those cyber risk threats that arise internal to the organization (e.g., employee cyber-based financial theft, employee data theft, identity theft using internal company data, etc.), and those risk that arise external to the organization (e.g., hackers stealing data, money or trade secrets, or adversaries shutting down or disabling internal information technology, vulnerability of IT systems to external power surges, blackouts, etc.).Next in the chapter we shall discuss emerging cyber risk threats and trends, with particular attention on risk consequences of the emerging trend of organizations and individuals to use wireless mobile technology (smart phones, iPads, etc.) to conduct business to business transactions, access enterprise networks, do banking, and accomplish retail consumer purchases.

Topic: Information and Cyber Security
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences