allianz global corporate & specialty se cyber insurance a ... · allianz global corporate &...

Allianz Global Corporate & Specialty SE

CYBER INSURANCE A YOUNG BUSINESS MODEL WITH NEW CHALLENGES

Jens KrickhahnAGCS / PL Cyber, Tech & Media PI CEEMunich 30.10.2019

2Copyright © 2019 Allianz Global Corporate & Specialty SE (All rights reserved) 5-Nov-19

01 CYBER EXPOSURE

02 RECENT EXPOSURE TRENDS

03 UNDERWRITING POINTS TO ASSESS

AGENDA


01 CYBER EXPOSURE



AGENDA


TOP 10 UNTERNEHMENSRISIKEN WELTWEIT IN 20191

37%

Betriebsunterbrechung(inkl. Lieferkettenunterbrechung)

619%

Feuer, Explosion

237%

Cybervorfälle(z.B. Cyberkriminalität, IT-Ausfall, Datenschutzverletzungen, Geldbußen und Strafen)

719%

Neue Technologien(z.B. Auswirkung der Vernetzung von Maschinen, Nanotechnologie, künstliche Intelligenz, 3D-Druck, autonome Fahrzeuge, Blockchain)

328%

Naturkatastrophen(z.B. Sturm, Überschwemmung, Erdbeben)

813%

Klimawandel/steigendeVolatilität des Wetters

427%

Rechtliche Veränderungen (z.B. Handelskriege und Zölle, Wirtschaftssanktionen, Protektionismus, Brexit, Zerfall der Euro-Zone)

913%

Reputationsverlust oderBeeinträchtigung des Markenwerts

523%

Marktentwicklungen(z.B. Volatilität, verstärkter Wettbewerb/neue Wettbewerber, M&A, stagnierende Märkte, Marktschwankungen)

109%

Fachkräftemangel

2018: 21% (5)

2018: 42% (1) 2018: 20% (6)

2018: 40% (2) 2018: 15% (7)

2018: 10%(10)2018: 30% (3)

2018: 22% (4)

2018: 13% (8)

2018: 6% (15)

= =

=

=

=12

3

Quelle: Allianz Global Corporate & Specialty. Fotos: Adobe, iStock. Die Zahlen geben die Anzahl der ausgewählten Risiken als Prozentsatz aller Umfrageantworten (hier: 2.882) an. Die 2.451 Befragten konnten Antworten für bis zu zwei Branchen und bis zu drei Risiken pro Branche auswählen. Die Prozentwerte addieren sich daher nicht auf 100%.1 „Betriebsunterbrechungen“ und „Cybervorfälle“ liegen mit jeweils rund 37% gleichauf an der Spitze der Rangliste. Allerdings erhielt die Betriebsunterbrechung mehr Antworten nach Anzahl.2 „Feuer und Explosionen“ rangieren nach Anzahl der Antworten höher als „neue Technologien“.3 Der „Klimawandel/die zunehmende Volatilität des Wetters“ erhielt mehr Antworten als der „Reputationsverlust oder Beeinträchtigung des Markenwerts“.

3

Copyright © 2019 Allianz Global Corporate & Specialty SE (All rights reserved) 5-Nov-19 5

CRITICAL INFRASTRUCTURE


SOME EXAMPLES OF WHAT COULD HAPPEN (I)


SOME EXAMPLES OF WHAT COULD HAPPEN (II)


CYBER BUSINESS INTERRUPTION

All businesses operate in a technologically and data-driven hyperconnected world fully or partially dependent on digitally controlled systems and infrastructures. A single point of failure can disrupt operations and revenue streams due to:

HYPERCONNECTED WORLDTECHNOLOGY

DATASMART

Production1

BlockchainHow will its adoption change the cyber risk landscape?

Industry 4.0What does it mean in practice for the businesses?

Embargoed until further notice: not for distribution


Nige

l Fen

wick

EVERY STEP OF DIGITALIZATION CREATES NEW RISKS


UNDERSTANDING ATTACK VECTORS

Hacking/manipulating data

Spoofing

Phishing

Denial of Service

Distributed Denial

of Service Malware

Ransomware

Keylogging

Accident


Digitalization increases the attack surface


The Defender


The Attacker


Threat actors: Cyber = Hacker?… they come in different shapes and sizes!

© Copyright AGSE SE Cyber Criminals

Hacktivists

© U

SA N

etw

orks

© W

arne

r Bro

s.

APT

zazz

le.c

o.uk

“script kiddies”


You do not need a hacker to suffer a Cyber IncidentThe cause can easily be internal

System failure Employee error

© Copyright AGCS


You do not need a hacker or an Employee to suffer a Cyber IncidentThe cause can easily be your business model or your supplier or customer

© Copyright AGCS

Supply Chain (interfaces with suppliers/customers)

digitization transformation (technical failure)


UNDERSTANDING THE PROCESS

THREATS VULNERABILITIES vs RESILIENCE IMPACT

Government sponsored

Terrorism

Hacktivist

Disgruntled insider

Organised crime

Lack of continuity strategy

ATTA

CK

SU

RFA

CE

People

Process

Technology

Revenue

Reputation

Assets

Server – basedvsClient - based

MITMSpoofingPhishingDDoSSocial EngineeringSQLiRansomware

ATTACK VECTORS

INSURANCE

CR

ISIS

RES

PON

SE


Golden rules of Cybersecurity by Robert Morris, Sr:

1. Do not own a computer

2. Do not power it on

3. Do not use it

The 100% effective Cyber security framework.

CYBER RISK MITIGATION


Reality of Cyber risk mitigation

The real face of Cyber risk management:

1. You are never fully secure

2. Arms race

3. Constantly evolving landscape

4. Imbalance of resources

5. Law of diminishing returns


01 CYBER EXPOSURE



AGENDA


1. Business Interruption due to technical failure

Ø Creates huge impact in a digital company

2. GDPR fines

Ø see BA, Marriot, Google

3. Cyber Extortion

Ø DDoS to Crypto Locker

Ø Small amount of Bitcoins to large amount of Bitcoins

The threat landscape is changing very fast!

RECENT EXPOSURE TRENDS


RANSOMWARE STATISTICS FOR 2019: Q2 TO Q3 REPORT

Source: https://blog.emsisoft.com/en/34335/ransomware-statistics-for-2019-q2-to-q3-report/

https://blog.emsisoft.com/en/34335/ransomware-statistics-for-2019-q2-to-q3-report/


RANSOMWARE STATISTICS FOR 2019: Q2 TO Q3 REPORT




OUTSIDE TOP 10 BUT VERY DISRUPTIVE & PROFITABLE




EMOTET & RYUK: SHARED WORK

Source: EMISoft Blog (https://blog.emsisoft.com/en/34193/state-of-ransomware-in-the-u-s-2019-report-for-q1-to-q3/)

https://blog.emsisoft.com/en/34193/state-of-ransomware-in-the-u-s-2019-report-for-q1-to-q3/)


01 CYBER EXPOSURE



AGENDA


UNDERSTANDING THE DAMAGE

First & Third Party Data Intellectual Property Fines Misappropriation of goods

Delay/Business interruption costs

Incident response costs Reputation Physical damage Personal Injury


Depending on the Exposure of the Insured we use different UW tools

CYBER UNDERWRITING APPROACH

Differentiators of the Exposure are:

Ø IndustryØ Position in the Supply ChainØ Size of the CompanyØ Global FootprintØ PII DataØ CapacityØ etc.

UW tools are:

Ø Digital UW tools Ø Application FormsØ ARC Desk Top ReviewØ ARC Risk Dialog Meeting Ø All together


Ø Know the Insured

Ø Understand the Insured’s Business Model Ø Understand the Insured’s Cyber Exposure and the Impact of Cyber EventsØ Understand the Insured’s Risk Management of the InsuredØ Regular Update of UW InformationØ Adequate Terms & Conditions

Ø Accumulation Management – especially “silent cover”

Ø Don‘t underwrite for prestige

CYBER UNDERWRITING – SOME PRINCIPLES


PRINCIPLES OF CYBER UNDERWRITING

Why Underwriting is important?

Ø Young product(s)Ø Not much historical dataØ Not much UW experienceØ Not much Claims experienceØ Fast changing Threat LandscapeØ Hard competitionØ Completely different Cyber Market developmentØ Completely different Claims development


CYBER UNDERWRITING – OUR AIM


+49 7121 9 28 47 99

[email protected]

Jens KrickhahnPractice Leader Cyber & Tech/Media PIFinancial Lines Central & Eastern Europe

ALLIANZ GLOBAL CORPORATE & SPECIALTY

Follow AGCS

mailto:[email protected]

allianz global corporate & specialty se cyber insurance a ... · allianz global corporate &...

Documents