Spotlight falls on CROs as business faces up to cyber risk in 2018

Chief risk officers (CROs) will become one of CEOs’ “most valuable assets” in 2018 as companies face up to cyber risk, according to Aon firm Stroz Friedberg in a set of cyber security predictions for the year ahead. In a new report, Stroz Freidberg says companies have woken up to the enterprise-wide risks posed by cyber that go beyond the IT department and simple data breaches. “As the physical and cyber worlds collide, chief risk officers take centre stage to manage cyber as an enterprise risk,” the 2018 Cybersecurity Predictions: A Shift to Managing Cyber as an Enterprise Risk report states. It adds that silos in cyber security risk management have previously left the door wide open for cyber criminals to exploit weaknesses. “The c-suites of mature organisations will empower the CRO to enter the cybersecurity spotlight, aligning them closely with information security teams. In 2018, the CROs and chief information security officers will become risk collaborators to better understand their organisation’s cyber risk exposures and potential ‘real-world’ operational consequences,” the report predicts. According to Stroz Friedberg, CROs will be expected to improve their organisation’s cyber risk modelling across the business to provide boards with a holistic picture of cyber risk impacts. “This unique perspective will make the CRO one of the CEO’s most valuable assets, as they provide a more meaningful risk story for boards and executive leadership, enabling more effective investment in cybersecurity measures and cyber insurance,” the firm says. The increasing role of technology in business, combined with regulation of consumer data and the growing value of non-physical assets, have collided to compel companies to integrate cyber as an enterprise risk, the company’s report explains. “Today’s silo-driven approach to cyber risk management will begin to disintegrate in 2018, in favour of a coordinated, c-suite-driven approach as leading companies begin to view the impact of cyber risk holistically across all functions of the enterprise,” commented Jason Hogg, CEO of Aon Cyber Solutions. Mr Hogg believes that the liability and accountability of businesses is also likely to increase. He predicts that more successful claims will be brought against directors and officers, making them personally responsible for handling cyber incidents. Concerns about liability, coupled with the financial and operational impact of cyber risk that played out in 2017, will drive changes in the insurance market, the report notes. It predicts that buyers will step up demand for standalone cyber insurance policies as “silent” coverage or add-ons become inadequate. Moreover, the report predicts that standalone policies will extend to sectors beyond traditional buyers of cyber insurance to cover cyber-related business interruption risks impacting airlines and airports, power grids, manufacturing plants and utilities companies. The market will also expand outside the US, the report states. Stroz Friedberg believes that calls for more harmonised rules governing cyber risk will define 2018. National and international regulators will enforce cybersecurity regulations and introduce new rules making the landscape more complex for businesses to navigate, it adds. The report warns: “The compliance burden for companies across sectors will get tougher in 2018 before it gets better.” Stroz Friedberg notes that the EU’s Global Data Protection Regulation (GDPR) has gained worldwide significance. Many countries, including Australia and Japan, are aligned with the EU approach, while the EU is likely to enforce the rules at US companies that collect data on EU citizens, it adds. “In 2018, we expect the European Commission will hold major US and global companies to account for GDPR violations, through one or more major enforcement actions demonstrating its seriousness to enforce the regulation internationally,” the report states. Stroz Friedberg’s eight predictions for cybersecurity in 2018 are: Businesses adopt standalone cyber insurance policies as boards and executives wake up to cyber liability. As the physical and cyber worlds collide, chief risk officers take centre stage to manage cyber as an enterprise risk. Regulatory spotlight widens and becomes more complex, provoking calls for harmonisation. The EU holds global company to account over GDPR violation; big data aggregators come under scrutiny in the US. Criminals look to attack businesses embracing the internet of things, in particular targeting a small to mid-sized company providing services to a global organisation. As passwords continue to be hacked, and attackers circumvent physical biometrics, multi-factor authentication becomes more important than ever before. Criminals will target transactions that use points as currency, spurring mainstream adoption of bug bounty programmes. Ransomware attackers get targeted; cryptocurrencies help ransomware industry flourish. Insider risks plague organisations as they underestimate their critical vulnerability and liability, and major attacks continue to fly under the radar.

Spotlight falls on CROs as business faces up to cyber risk in 2018

Want to read this article?

Read Next

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Want to read this article?

Read Next

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Related Articles